$ show sharsil/favicorn
Favicorn is a command-line OSINT tool that searches for websites by their favicon hashes. It accepts input via favicon URL, file, or domain, computes multiple cryptographic and perceptual hashes (MMH3, MD5, SHA256, etc.), and generates search URLs for 11 security/search platforms (Shodan, ZoomEye, Censys, etc.). Optionally, it fetches and displays preview results from Shodan, ZoomEye, and Netlas using API keys. The architecture features a modular design: the Favicon class handles hash computation and platform-specific URL generation, while specialized Fetcher classes (Shodan, ZoomEye, Netlas) encapsulate API interactions, caching, and response parsing. The CLI orchestrates workflow, parallel execution, and output formatting. Key dependencies include requests, mmh3, dnspython, and platform-specific SDKs.
The LLM identified 1 files worth highlighting for reuse:
The Favicon class encapsulates favicon acquisition (from URL/file/domain) and computation of multiple hashes (MMH3, MD5, SHA256, etc.) with optional perceptual hash via Netlas. It demonstrates strong cohesion, low coupling, and is easily reusable in other projects needing favicon processing. The Fetcher base class and its subclasses (ShodanPreviewAPIKeyFetcher, ZoomEyePreviewFetcher, NetlasPreviewAPIKeyFetcher) implement a template pattern for API requests: each handles endpoint construction, response caching, and parsing while sharing common output formatting via the base class. This pattern is highly extensible for adding new OSINT sources with minimal boilerplate.