The LOLBAS project is a curated dataset of Windows binaries, scripts, and libraries that can be abused for malicious purposes (Living Off The Land Binaries and Scripts). Each entry is documented in YAML files with a standardized schema, including technical details, use cases, MITRE ATT&CK mappings, detection artifacts, and external references. The repository serves as a threat intelligence resource for offensive security research and defensive security operations, enabling threat hunting and detection rule development. Data is organized by file type (binaries, libraries, scripts) and maintained through community contributions with automated validation via Pydantic schemas.
Favicorn is a command-line OSINT tool that searches for websites by their favicon hashes. It accepts input via favicon URL, file, or domain, computes multiple cryptographic and perceptual hashes (MMH3, MD5, SHA256, etc.), and generates search URLs for 11 security/search platforms (Shodan, ZoomEye, Censys, etc.). Optionally, it fetches and displays preview results from Shodan, ZoomEye, and Netlas using API keys. The architecture features a modular design: the Favicon class handles hash computation and platform-specific URL generation, while specialized Fetcher classes (Shodan, ZoomEye, Netlas) encapsulate API interactions, caching, and response parsing. The CLI orchestrates workflow, parallel execution, and output formatting. Key dependencies include requests, mmh3, dnspython, and platform-specific SDKs.