[liquidsec]

Closes #3510

Adds a favicon module that identifies technologies by the mmh3 hash of their favicon, using the signatures in nuclei-templates' favicon-detect.yaml (MIT, actively maintained, ~700 hashes). Other sources were evaluated: FavFreak and EHole are largely subsets of the same Shodan-derived lineage, and Rapid7 Recog's MD5 set has not been updated since 2024.

How it works

• Watches HTTP_RESPONSE, emits TECHNOLOGY.
• Signatures are downloaded at setup (signatures_url is configurable, e.g. to pin a tag). Matchers in an unrecognized format are skipped with a warning; if nothing parses, the module soft-fails.
• Icon candidates per page: <link rel="icon"> / rel="shortcut icon" hrefs, then /<first path segment>/favicon.ico when the page is in a subdirectory and declares no icon (apps mounted under a path), then /favicon.ico. Stops at the first match.
• Follows redirects when fetching icons (e.g. OWA redirects /favicon.ico to /owa/favicon.ico). Skips non-200, empty, and HTML responses (soft 404s).
• Hashes with mmh3(base64.encodebytes(body)) to match the Shodan/nuclei convention.
• Signature names have a redundant trailing favicon stripped (e.g. asp.net-favicon becomes asp.net).
• The TECHNOLOGY event's url is the page that triggered the check. The matched hash and the final icon URL are in the event context.

Dedup

• Incoming: keyed on the list of icon URLs a page leads to, so pages sharing the same icons are only checked once. Favicons never become URL events.
• Outgoing: keyed on host + technology, so the same favicon across ports, schemes, or subdirectories of a host is reported once.

Presets

• Flagged web-heavy (not web) pending a resource evaluation.
• Added to tech-detect.

Related: #3531 (helpers.download() ignores cache_hrs, so signatures currently refresh weekly instead of daily).

[codecov]

Codecov Report

❌ Patch coverage is 97.27891% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 91%. Comparing base (484cfb6) to head (83ad697).

Files with missing lines	Patch %	Lines
bbot/modules/favicon.py	95%	4 Missing ⚠️

Additional details and impacted files

@@          Coverage Diff           @@
##             dev   #3532    +/-   ##
======================================
+ Coverage     91%     91%    +1%     
======================================
  Files        463     465     +2     
  Lines      49758   49905   +147     
======================================
+ Hits       44890   45037   +147     
  Misses      4868    4868            

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

📊 Performance Benchmark Report

Comparing dev (baseline) vs favicon (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name	📏 Base	📏 Current	📈 Change	🎯 Status
Bloom Filter Dns Mutation Tracking Performance	3.79ms	3.76ms	-0.7% ⚪	✅
Bloom Filter Large Scale Dns Brute Force	15.37ms	15.26ms	-0.7% ⚪	✅
Large Closest Match Lookup	327.30ms	335.24ms	+2.4% ⚪	✅
Realistic Closest Match Workload	179.99ms	180.35ms	+0.2% ⚪	✅
Event Memory Medium Scan	1402 B/event	1402 B/event	+0.0% ⚪	✅
Event Memory Large Scan	1527 B/event	1527 B/event	-0.0% ⚪	✅
Event Validation Full Scan Startup Small Batch	407.57ms	407.81ms	+0.1% ⚪	✅
Event Validation Full Scan Startup Large Batch	517.03ms	520.61ms	+0.7% ⚪	✅
Make Event Autodetection Small	20.86ms	20.89ms	+0.1% ⚪	✅
Make Event Autodetection Large	209.49ms	208.69ms	-0.4% ⚪	✅
Make Event Explicit Types	8.61ms	8.63ms	+0.2% ⚪	✅
Excavate Single Thread Small	3.699s	3.702s	+0.1% ⚪	✅
Excavate Single Thread Large	9.490s	9.513s	+0.2% ⚪	✅
Excavate Parallel Tasks Small	3.975s	3.874s	-2.5% ⚪	✅
Excavate Parallel Tasks Large	6.034s	5.981s	-0.9% ⚪	✅
Intercept Throughput Small	880.09ms	878.42ms	-0.2% ⚪	✅
Intercept Throughput Medium	923.55ms	876.15ms	-5.1% ⚪	✅
Dns Throughput Quiet	2.518s	2.505s	-0.5% ⚪	✅
Dns Throughput Loaded	1.828s	1.712s	-6.4% ⚪	✅
Dns Throughput Inherited	2.099s	2.053s	-2.2% ⚪	✅
Is Ip Performance	2.30ms	2.32ms	+0.7% ⚪	✅
Make Ip Type Performance	204.89µs	205.07µs	+0.1% ⚪	✅
Mixed Ip Operations	2.44ms	2.38ms	-2.5% ⚪	✅
Memory Use Web Crawl	1.2 MB	1.2 MB	-0.9% ⚪	✅
Memory Use Subdomain Enum	28.3 MB	28.3 MB	+0.0% ⚪	✅
Memory Use Deep Chain	5.0 MB	5.0 MB	+0.0% ⚪	✅
Memory Use Parallel Chains	12.5 MB	12.5 MB	+0.2% ⚪	✅
Scan Throughput 100	2.454s	2.661s	+8.4% ⚪	✅
Scan Throughput 1000	17.570s	17.535s	-0.2% ⚪	✅
Typical Queue Shuffle	5.47µs	5.47µs	-0.0% ⚪	✅
Priority Queue Shuffle	26.71µs	27.14µs	+1.6% ⚪	✅

🎯 Performance Summary

✅ No significant performance changes detected (all changes <10%)

---

🐍 Python Version 3.11.17