{ "identity": { "id": 195235, "uuid": "64e174ea-3f11-4c1b-b4c9-df2264084106", "original_uuid": "N/A", "title": "http-mm-sha-favicon", "version": "1.1", "format": "nse" }, "content": { "to_string": "local http = require \"http\"\nlocal nmap = require \"nmap\"\nlocal openssl = require \"openssl\"\nlocal shortport = require \"shortport\"\nlocal stdnse = require \"stdnse\"\nlocal string = require \"string\"\nlocal url = require \"url\"\nlocal base64 = require \"base64\"\n\ndescription = [[\nGets the favicon from a web page then hash it using md5, sha256 and the method\n\"http.favicon.hash\" used by shodan.io murmur3_32(base64(favicon))\nThe results is displayed as a signed integer.\n\nIf the script argument favicon.uri is given, that relative URI is\nalways used to find the favicon. Otherwise, first the page at the root of the\nweb server is retrieved and parsed for a \nelement. If that fails, the icon is looked for in /favicon.ico. If\na favicon points to a different host or port, it is ignored.\n]]\nauthor = \"CIRCL/Paul JUNG (Thanat0s)\"\nlicense = \"GNU Affero General Public Licence https://www.gnu.org/licenses/agpl-3.0.en.html\"\n\n---\n-- @args favicon.uri URI that will be requested for favicon.\n-- @args favicon.root Web server path to search for favicon.\n--\n-- @usage\n-- nmap --script=http-favicon.nse \\\n-- --script-args favicon.root=,favicon.uri=\n-- @output\n-- |_ http-mmfavicon: signed integer\n\n-- HTTP default favicon murmur32 (shodan like) / md5 / sha256 hash\n-- rev 1.0 (2025-10-10)\n-- Original NASL script inspiration by Javier Fernandez-Sanguino Pena\n-- NSE http-favicon.nse by Vlatko Kosturjak\n-- SHA256 Implementation by OGabrieLima https://github.com/OGabrieLima (2024-04-08)\n\ncategories = {\"default\", \"discovery\", \"safe\"}\nportrule = shortport.http\n\n--[[\nFor thoses who wonder, in NMAP v7.94, LUA NSE is bundled with the following Openssl module:\n - bignum_dec2bn\n - bignum_pseudo_rand\n - supported_ciphers\n - supported_digests\n - ripemd160\n - DES_string_to_key\n - bignum_num_bytes\n - bignum_bn2hex\n - decrypt\n - bignum_bn2mpi\n - bignum_mod_exp\n - bignum_set_bit\n - bignum_rand\n - encrypt\n - hmac\n - digest\n - bignum_div\n - bignum_bn2dec\n - bignum_bin2bn\n - bignum_clear_bit\n - md5\n - bignum_bn2bin\n - bignum_num_bits\n - md4\n - rand_pseudo_bytes\n - bignum_is_safe_prime\n - bignum_add\n - rand_bytes\n - bignum_hex2bn\n - sha1\n - bignum_is_bit_set\n - bignum_is_prime\n]]--\n\n-- Auxiliary function: right rotation (bitwise)\nlocal function bit_ror(x, y)\n return ((x >> y) | (x << (32 - y))) & 0xFFFFFFFF\nend\n\n-- helpers since lib int seems not available in nmap\nlocal function toUint32(x) return x % 0x100000000 end\nlocal function toInt32(x)\n x = x % 0x100000000\n if x >= 0x80000000 then x = x - 0x100000000 end\n return x\nend\nlocal function rshift(x,n) return math.floor(toUint32(x) / 2^n) end\nlocal function lshift(x,n) return toUint32(toUint32(x) * 2^n) end\nlocal function rol(x,n) return toUint32(lshift(x,n) + rshift(x,32-n)) end\nlocal function bxor(a,b)\n local r, bitval = 0,1\n for i=1,32 do\n if (a % 2 + b % 2) % 2 == 1 then r = r + bitval end\n a = math.floor(a/2); b = math.floor(b/2); bitval = bitval * 2\n end\n return toUint32(r)\nend\nlocal function imul32(a,b)\n local a_lo, a_hi = a % 0x10000, math.floor(a / 0x10000)\n local b_lo, b_hi = b % 0x10000, math.floor(b / 0x10000)\n local low = a_lo * b_lo\n local mid = a_lo * b_hi + a_hi * b_lo\n return toUint32(low + mid * 0x10000)\nend\n\n-- Main function: MurmurHash3 32-bits\nlocal function murmur3_32(data, seed)\n local h1 = seed or 0\n local c1, c2 = 0xcc9e2d51, 0x1b873593\n local len = #data\n local nblocks = math.floor(len/4)\n\n -- body\n for i=0,nblocks-1 do\n local j = i*4 + 1\n local k1 = data:byte(j) + lshift(data:byte(j+1),8) + lshift(data:byte(j+2),16) + lshift(data:byte(j+3),24)\n k1 = imul32(k1, c1)\n k1 = rol(k1,15)\n k1 = imul32(k1, c2)\n h1 = bxor(h1, k1)\n h1 = rol(h1,13)\n h1 = toUint32(imul32(h1,5) + 0xe6546b64)\n end\n\n -- tail\n local tail_index = nblocks*4 + 1\n local k1 = 0\n local rem = len % 4\n if rem == 3 then k1 = lshift(data:byte(tail_index+2),16) end\n if rem >= 2 then k1 = bxor(k1, lshift(data:byte(tail_index+1),8)) end\n if rem >= 1 then\n k1 = bxor(k1, data:byte(tail_index))\n k1 = imul32(k1, c1)\n k1 = rol(k1,15)\n k1 = imul32(k1, c2)\n h1 = bxor(h1,k1)\n end\n\n -- finalization\n h1 = bxor(h1, len)\n h1 = bxor(h1, rshift(h1,16))\n h1 = imul32(h1,0x85ebca6b)\n h1 = bxor(h1,rshift(h1,13))\n h1 = imul32(h1,0xc2b2ae35)\n h1 = bxor(h1,rshift(h1,16))\n\n return toInt32(h1)\nend\n\n-- Main function: SHA256\nsha256 = function(message)\n local k = {\n 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,\n 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,\n 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,\n 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,\n 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,\n 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,\n 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,\n 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2\n }\n\n local function preprocess(message)\n local len = #message\n local bitLen = len * 8\n message = message .. \"\\128\" -- append single '1' bit\n\n local zeroPad = 64 - ((len + 9) % 64)\n if zeroPad ~= 64 then\n message = message .. string.rep(\"\\0\", zeroPad)\n end\n\n -- append length\n message = message .. string.char(\n bitLen >> 56 & 0xFF,\n bitLen >> 48 & 0xFF,\n bitLen >> 40 & 0xFF,\n bitLen >> 32 & 0xFF,\n bitLen >> 24 & 0xFF,\n bitLen >> 16 & 0xFF,\n bitLen >> 8 & 0xFF,\n bitLen & 0xFF\n )\n\n return message\n end\n\n local function chunkify(message)\n local chunks = {}\n for i = 1, #message, 64 do\n table.insert(chunks, message:sub(i, i + 63))\n end\n return chunks\n end\n\n local function processChunk(chunk, hash)\n local w = {}\n\n for i = 1, 64 do\n if i <= 16 then\n w[i] = string.byte(chunk, (i - 1) * 4 + 1) << 24 |\n string.byte(chunk, (i - 1) * 4 + 2) << 16 |\n string.byte(chunk, (i - 1) * 4 + 3) << 8 |\n string.byte(chunk, (i - 1) * 4 + 4)\n else\n local s0 = bit_ror(w[i - 15], 7) ~ bit_ror(w[i - 15], 18) ~ (w[i - 15] >> 3)\n local s1 = bit_ror(w[i - 2], 17) ~ bit_ror(w[i - 2], 19) ~ (w[i - 2] >> 10)\n w[i] = (w[i - 16] + s0 + w[i - 7] + s1) & 0xFFFFFFFF\n end\n end\n\n local a, b, c, d, e, f, g, h = table.unpack(hash)\n\n for i = 1, 64 do\n local s1 = bit_ror(e, 6) ~ bit_ror(e, 11) ~ bit_ror(e, 25)\n local ch = (e & f) ~ ((~e) & g)\n local temp1 = (h + s1 + ch + k[i] + w[i]) & 0xFFFFFFFF\n local s0 = bit_ror(a, 2) ~ bit_ror(a, 13) ~ bit_ror(a, 22)\n local maj = (a & b) ~ (a & c) ~ (b & c)\n local temp2 = (s0 + maj) & 0xFFFFFFFF\n\n h = g\n g = f\n f = e\n e = (d + temp1) & 0xFFFFFFFF\n d = c\n c = b\n b = a\n a = (temp1 + temp2) & 0xFFFFFFFF\n end\n\n return (hash[1] + a) & 0xFFFFFFFF,\n (hash[2] + b) & 0xFFFFFFFF,\n (hash[3] + c) & 0xFFFFFFFF,\n (hash[4] + d) & 0xFFFFFFFF,\n (hash[5] + e) & 0xFFFFFFFF,\n (hash[6] + f) & 0xFFFFFFFF,\n (hash[7] + g) & 0xFFFFFFFF,\n (hash[8] + h) & 0xFFFFFFFF\n end\n\n message = preprocess(message)\n local chunks = chunkify(message)\n\n local hash = {0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19}\n for _, chunk in ipairs(chunks) do\n hash = {processChunk(chunk, hash)}\n end\n\n local result = \"\"\n for _, h in ipairs(hash) do\n result = result .. string.format(\"%08x\", h)\n end\n\n return result\nend\n\nlocal function add_crlf(str, width)\n width = width or 76\n local t = {}\n for i = 1, #str, width do\n table.insert(t, str:sub(i, i + width - 1))\n end\n local s = table.concat(t, \"\\n\")\n return s .. \"\\n\"\nend\n\naction = function(host, port)\n local md5sum,answer\n local match\n local status, favicondb\n local results = stdnse.output_table()\n -- local results = {}\n local index, icon\n local favicon_file\n local root = \"\"\n\n if(stdnse.get_script_args('favicon.root')) then\n root = stdnse.get_script_args('favicon.root')\n end\n\n -- If parameter favicon.uri is given, we fetch it, always and only this.\n local favicon_uri = stdnse.get_script_args(\"favicon.uri\")\n if(favicon_uri) then\n favicon_file = root .. \"/\" .. favicon_uri\n answer = http.get( host, port, favicon_file)\n stdnse.debug4(\"Using URI %s\", favicon_uri)\n else\n -- Otherwise, first try parsing the home page \"/\" for favicon reference.\n index = http.get( host, port, root .. \"/\" )\n if index.status == 200 or index.status == 503 then\n -- find the favicon pattern\n icon = parseIcon( index.body )\n -- if we find a pattern, we fetch it.\n if icon then\n local hostname = host.targetname or (host.name ~= \"\" and host.name) or host.ip\n stdnse.debug1(\"Got icon URL %s.\", icon)\n local icon_host, icon_port, icon_path = parse_url_relative(icon, hostname, port.number, root)\n if (icon_host == host.ip or\n icon_host == host.targetname or\n icon_host == (host.name ~= '' and host.name)) and\n icon_port == port.number then\n -- request the favicon\n answer = http.get( icon_host, icon_port, icon_path )\n favicon_file = icon_path\n else\n answer = nil\n end\n else\n answer = nil\n end\n end\n\n -- If that didn't work, try /favicon.ico.\n if not answer or answer.status ~= 200 then\n favicon_file = root .. \"/favicon.ico\"\n answer = http.get( host, port, favicon_file )\n stdnse.debug4(\"Using default URI.\")\n end\n end\n\n-- Finaly if we have a favicon, we hash it.\nif answer and answer.status == 200 then\n stdnse.debug1(\"Favicon found.\")\n local debugs = \"\"\n --\u00a0MurmurHash3 32 bits should be done on a B64 CLRF\u00a0enabled dump.\n local rb64 = add_crlf(base64.enc(answer.body)) \n results.favicon_file = favicon_file\n results.favicon_mmhash = murmur3_32(rb64)\n md5sum = stdnse.tohex(openssl.md5(answer.body))\n results.favicon_md5 = md5sum\n local sha256sum=sha256(answer.body)\n results.favicon_sha256 = sha256sum\n \n if nmap.verbosity() > 1 then\n local hex_debug = {}\n for i = 1, 128 do \n hex_debug[#hex_debug+1] = string.format(\"%02X\", rb64:byte(i))\n end\n -- In debug mode, shows the first bytes of favicon file.\n local hex_string = table.concat(hex_debug, \"\")\n results.debug = sha256sum .. \" \" .. \"->\" .. hex_string .. \"<-\"\n end\nelse\n stdnse.debug1(\"No favicon found.\")\n return\nend\nreturn results\nend\n\nlocal function dirname(path)\n local dir\n dir = string.match(path, \"^(.*)/\")\n return dir or \"\"\nend\n\n-- Return a URL's host, port, and path, filling in the results with the given\n-- host, port, and path if the URL is relative. Return nil if the scheme is not\n-- \"http\" or \"https\".\nfunction parse_url_relative(u, host, port, path)\n local scheme, abspath\n u = url.parse(u)\n scheme = u.scheme or \"http\"\n if not (scheme == \"http\" or scheme == \"https\") then\n return nil\n end\n abspath = u.path or \"\"\n if not string.find(abspath, \"^/\") then\n abspath = dirname(path) .. \"/\" .. abspath\n end\n return u.host or host, u.port or url.get_default_port(scheme), abspath\nend\n\nfunction parseIcon( body )\n local _, i, j\n local rel, href, word\n\n -- Loop through link elements.\n i = 0\n while i do\n _, i = string.find(body, \"<%s*[Ll][Ii][Nn][Kk]%s\", i + 1)\n if not i then\n return nil\n end\n -- Loop through attributes.\n j = i\n while true do\n local name, quote, value\n _, j, name, quote, value = string.find(body, \"^%s*(%w+)%s*=%s*([\\\"'])(.-)%2\", j + 1)\n if not j then\n break\n end\n if string.lower(name) == \"rel\" then\n rel = value\n elseif string.lower(name) == \"href\" then\n href = value\n end\n end\n for word in string.gmatch(rel or \"\", \"%S+\") do\n if string.lower(word) == \"icon\" then\n return href\n end\n end\n end\nend\n", "description": "Gets the favicon from a web page then hash it using sha256 and the method\r\n\"http.favicon.hash\" used by shodan.io murmur3_32(base64(favicon))\r\nThe results is displayed as a signed integer.\r\n\r\nIf the script argument favicon.uri is given, that relative URI is\r\nalways used to find the favicon. Otherwise, first the page at the root of the\r\nweb server is retrieved and parsed for a \r\nelement. If that fails, the icon is looked for in /favicon.ico. If\r\na favicon points to a different host or port, it is ignored.", "source": "https://github.com/D4-project/Plum-Rules-NSE", "github_path": "app/rule_from_github/Rules_Github/D4-project/Plum-Rules-NSE/http-mm-sha-favicon.nse", "extension": "nse" }, "authorship": { "author": "CIRCL/Paul JUNG (Thanat0s)", "license": "0BSD", "creation_date": "2026-02-02 12:10", "last_modif": "2026-04-28 06:34", "submitter": { "id": 1, "username": "Rulezet Creator \ud83d\udee1\ufe0f\u200b", "level": 100, "total_points": 1973923 } }, "community": { "votes": { "up": 1, "down": 0, "total": 1, "ratio_percent": 100 }, "favorites": { "count": 0, "is_favorited": false }, "comments": { "count": 0, "latest": [] } }, "relations": { "tags": [ { "id": 65732, "uuid": "8370e495-dc91-4714-aa43-ac4226103e36", "rule_id": 195235, "tag_id": 21, "user_id": 1, "tag_name": "PAP:CLEAR", "added_at": "2026-05-05 07:19" }, { "id": 65733, "uuid": "3591c52b-6d8f-4151-9d2e-8dee3fe73e23", "rule_id": 195235, "tag_id": 6, "user_id": 1, "tag_name": "tlp:clear", "added_at": "2026-05-05 07:19" }, { "id": 21, "uuid": "b0ed2843-1166-4dcd-b191-dcd6fc5a2575", "rule_id": 195235, "tag_id": 23, "user_id": 1, "tag_name": "CIRCL", "added_at": "2026-04-28 06:34" } ], "bundles": [], "similar_rules": [ { "id": 223557, "title": "http-favicon", "format": "nse", "score": 52 } ] }, "vulnerability": { "cve_ids": "[]" }, "history": { "edit_proposals": { "count": 0, "latest": [] }, "update_history": [ { "id": 9888, "rule_id": 195235, "rule_title": "http-mm-sha-favicon", "success": true, "message": "accepted", "new_content": "local http = require \"http\"\nlocal nmap = require \"nmap\"\nlocal openssl = require \"openssl\"\nlocal shortport = require \"shortport\"\nlocal stdnse = require \"stdnse\"\nlocal string = require \"string\"\nlocal url = require \"url\"\nlocal base64 = require \"base64\"\n\ndescription = [[\nGets the favicon from a web page then hash it using md5, sha256 and the method\n\"http.favicon.hash\" used by shodan.io murmur3_32(base64(favicon))\nThe results is displayed as a signed integer.\n\nIf the script argument favicon.uri is given, that relative URI is\nalways used to find the favicon. Otherwise, first the page at the root of the\nweb server is retrieved and parsed for a \nelement. If that fails, the icon is looked for in /favicon.ico. If\na favicon points to a different host or port, it is ignored.\n]]\nauthor = \"CIRCL/Paul JUNG (Thanat0s)\"\nlicense = \"GNU Affero General Public Licence https://www.gnu.org/licenses/agpl-3.0.en.html\"\n\n---\n-- @args favicon.uri URI that will be requested for favicon.\n-- @args favicon.root Web server path to search for favicon.\n--\n-- @usage\n-- nmap --script=http-favicon.nse \\\n-- --script-args favicon.root=,favicon.uri=\n-- @output\n-- |_ http-mmfavicon: signed integer\n\n-- HTTP default favicon murmur32 (shodan like) / md5 / sha256 hash\n-- rev 1.0 (2025-10-10)\n-- Original NASL script inspiration by Javier Fernandez-Sanguino Pena\n-- NSE http-favicon.nse by Vlatko Kosturjak\n-- SHA256 Implementation by OGabrieLima https://github.com/OGabrieLima (2024-04-08)\n\ncategories = {\"default\", \"discovery\", \"safe\"}\nportrule = shortport.http\n\n--[[\nFor thoses who wonder, in NMAP v7.94, LUA NSE is bundled with the following Openssl module:\n - bignum_dec2bn\n - bignum_pseudo_rand\n - supported_ciphers\n - supported_digests\n - ripemd160\n - DES_string_to_key\n - bignum_num_bytes\n - bignum_bn2hex\n - decrypt\n - bignum_bn2mpi\n - bignum_mod_exp\n - bignum_set_bit\n - bignum_rand\n - encrypt\n - hmac\n - digest\n - bignum_div\n - bignum_bn2dec\n - bignum_bin2bn\n - bignum_clear_bit\n - md5\n - bignum_bn2bin\n - bignum_num_bits\n - md4\n - rand_pseudo_bytes\n - bignum_is_safe_prime\n - bignum_add\n - rand_bytes\n - bignum_hex2bn\n - sha1\n - bignum_is_bit_set\n - bignum_is_prime\n]]--\n\n-- Auxiliary function: right rotation (bitwise)\nlocal function bit_ror(x, y)\n return ((x >> y) | (x << (32 - y))) & 0xFFFFFFFF\nend\n\n-- helpers since lib int seems not available in nmap\nlocal function toUint32(x) return x % 0x100000000 end\nlocal function toInt32(x)\n x = x % 0x100000000\n if x >= 0x80000000 then x = x - 0x100000000 end\n return x\nend\nlocal function rshift(x,n) return math.floor(toUint32(x) / 2^n) end\nlocal function lshift(x,n) return toUint32(toUint32(x) * 2^n) end\nlocal function rol(x,n) return toUint32(lshift(x,n) + rshift(x,32-n)) end\nlocal function bxor(a,b)\n local r, bitval = 0,1\n for i=1,32 do\n if (a % 2 + b % 2) % 2 == 1 then r = r + bitval end\n a = math.floor(a/2); b = math.floor(b/2); bitval = bitval * 2\n end\n return toUint32(r)\nend\nlocal function imul32(a,b)\n local a_lo, a_hi = a % 0x10000, math.floor(a / 0x10000)\n local b_lo, b_hi = b % 0x10000, math.floor(b / 0x10000)\n local low = a_lo * b_lo\n local mid = a_lo * b_hi + a_hi * b_lo\n return toUint32(low + mid * 0x10000)\nend\n\n-- Main function: MurmurHash3 32-bits\nlocal function murmur3_32(data, seed)\n local h1 = seed or 0\n local c1, c2 = 0xcc9e2d51, 0x1b873593\n local len = #data\n local nblocks = math.floor(len/4)\n\n -- body\n for i=0,nblocks-1 do\n local j = i*4 + 1\n local k1 = data:byte(j) + lshift(data:byte(j+1),8) + lshift(data:byte(j+2),16) + lshift(data:byte(j+3),24)\n k1 = imul32(k1, c1)\n k1 = rol(k1,15)\n k1 = imul32(k1, c2)\n h1 = bxor(h1, k1)\n h1 = rol(h1,13)\n h1 = toUint32(imul32(h1,5) + 0xe6546b64)\n end\n\n -- tail\n local tail_index = nblocks*4 + 1\n local k1 = 0\n local rem = len % 4\n if rem == 3 then k1 = lshift(data:byte(tail_index+2),16) end\n if rem >= 2 then k1 = bxor(k1, lshift(data:byte(tail_index+1),8)) end\n if rem >= 1 then\n k1 = bxor(k1, data:byte(tail_index))\n k1 = imul32(k1, c1)\n k1 = rol(k1,15)\n k1 = imul32(k1, c2)\n h1 = bxor(h1,k1)\n end\n\n -- finalization\n h1 = bxor(h1, len)\n h1 = bxor(h1, rshift(h1,16))\n h1 = imul32(h1,0x85ebca6b)\n h1 = bxor(h1,rshift(h1,13))\n h1 = imul32(h1,0xc2b2ae35)\n h1 = bxor(h1,rshift(h1,16))\n\n return toInt32(h1)\nend\n\n-- Main function: SHA256\nsha256 = function(message)\n local k = {\n 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,\n 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,\n 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,\n 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,\n 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,\n 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,\n 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,\n 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2\n }\n\n local function preprocess(message)\n local len = #message\n local bitLen = len * 8\n message = message .. \"\\128\" -- append single '1' bit\n\n local zeroPad = 64 - ((len + 9) % 64)\n if zeroPad ~= 64 then\n message = message .. string.rep(\"\\0\", zeroPad)\n end\n\n -- append length\n message = message .. string.char(\n bitLen >> 56 & 0xFF,\n bitLen >> 48 & 0xFF,\n bitLen >> 40 & 0xFF,\n bitLen >> 32 & 0xFF,\n bitLen >> 24 & 0xFF,\n bitLen >> 16 & 0xFF,\n bitLen >> 8 & 0xFF,\n bitLen & 0xFF\n )\n\n return message\n end\n\n local function chunkify(message)\n local chunks = {}\n for i = 1, #message, 64 do\n table.insert(chunks, message:sub(i, i + 63))\n end\n return chunks\n end\n\n local function processChunk(chunk, hash)\n local w = {}\n\n for i = 1, 64 do\n if i <= 16 then\n w[i] = string.byte(chunk, (i - 1) * 4 + 1) << 24 |\n string.byte(chunk, (i - 1) * 4 + 2) << 16 |\n string.byte(chunk, (i - 1) * 4 + 3) << 8 |\n string.byte(chunk, (i - 1) * 4 + 4)\n else\n local s0 = bit_ror(w[i - 15], 7) ~ bit_ror(w[i - 15], 18) ~ (w[i - 15] >> 3)\n local s1 = bit_ror(w[i - 2], 17) ~ bit_ror(w[i - 2], 19) ~ (w[i - 2] >> 10)\n w[i] = (w[i - 16] + s0 + w[i - 7] + s1) & 0xFFFFFFFF\n end\n end\n\n local a, b, c, d, e, f, g, h = table.unpack(hash)\n\n for i = 1, 64 do\n local s1 = bit_ror(e, 6) ~ bit_ror(e, 11) ~ bit_ror(e, 25)\n local ch = (e & f) ~ ((~e) & g)\n local temp1 = (h + s1 + ch + k[i] + w[i]) & 0xFFFFFFFF\n local s0 = bit_ror(a, 2) ~ bit_ror(a, 13) ~ bit_ror(a, 22)\n local maj = (a & b) ~ (a & c) ~ (b & c)\n local temp2 = (s0 + maj) & 0xFFFFFFFF\n\n h = g\n g = f\n f = e\n e = (d + temp1) & 0xFFFFFFFF\n d = c\n c = b\n b = a\n a = (temp1 + temp2) & 0xFFFFFFFF\n end\n\n return (hash[1] + a) & 0xFFFFFFFF,\n (hash[2] + b) & 0xFFFFFFFF,\n (hash[3] + c) & 0xFFFFFFFF,\n (hash[4] + d) & 0xFFFFFFFF,\n (hash[5] + e) & 0xFFFFFFFF,\n (hash[6] + f) & 0xFFFFFFFF,\n (hash[7] + g) & 0xFFFFFFFF,\n (hash[8] + h) & 0xFFFFFFFF\n end\n\n message = preprocess(message)\n local chunks = chunkify(message)\n\n local hash = {0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19}\n for _, chunk in ipairs(chunks) do\n hash = {processChunk(chunk, hash)}\n end\n\n local result = \"\"\n for _, h in ipairs(hash) do\n result = result .. string.format(\"%08x\", h)\n end\n\n return result\nend\n\nlocal function add_crlf(str, width)\n width = width or 76\n local t = {}\n for i = 1, #str, width do\n table.insert(t, str:sub(i, i + width - 1))\n end\n local s = table.concat(t, \"\\n\")\n return s .. \"\\n\"\nend\n\naction = function(host, port)\n local md5sum,answer\n local match\n local status, favicondb\n local results = stdnse.output_table()\n -- local results = {}\n local index, icon\n local favicon_file\n local root = \"\"\n\n if(stdnse.get_script_args('favicon.root')) then\n root = stdnse.get_script_args('favicon.root')\n end\n\n -- If parameter favicon.uri is given, we fetch it, always and only this.\n local favicon_uri = stdnse.get_script_args(\"favicon.uri\")\n if(favicon_uri) then\n favicon_file = root .. \"/\" .. favicon_uri\n answer = http.get( host, port, favicon_file)\n stdnse.debug4(\"Using URI %s\", favicon_uri)\n else\n -- Otherwise, first try parsing the home page \"/\" for favicon reference.\n index = http.get( host, port, root .. \"/\" )\n if index.status == 200 or index.status == 503 then\n -- find the favicon pattern\n icon = parseIcon( index.body )\n -- if we find a pattern, we fetch it.\n if icon then\n local hostname = host.targetname or (host.name ~= \"\" and host.name) or host.ip\n stdnse.debug1(\"Got icon URL %s.\", icon)\n local icon_host, icon_port, icon_path = parse_url_relative(icon, hostname, port.number, root)\n if (icon_host == host.ip or\n icon_host == host.targetname or\n icon_host == (host.name ~= '' and host.name)) and\n icon_port == port.number then\n -- request the favicon\n answer = http.get( icon_host, icon_port, icon_path )\n favicon_file = icon_path\n else\n answer = nil\n end\n else\n answer = nil\n end\n end\n\n -- If that didn't work, try /favicon.ico.\n if not answer or answer.status ~= 200 then\n favicon_file = root .. \"/favicon.ico\"\n answer = http.get( host, port, favicon_file )\n stdnse.debug4(\"Using default URI.\")\n end\n end\n\n-- Finaly if we have a favicon, we hash it.\nif answer and answer.status == 200 then\n stdnse.debug1(\"Favicon found.\")\n local debugs = \"\"\n --\u00a0MurmurHash3 32 bits should be done on a B64 CLRF\u00a0enabled dump.\n local rb64 = add_crlf(base64.enc(answer.body)) \n results.favicon_file = favicon_file\n results.favicon_mmhash = murmur3_32(rb64)\n md5sum = stdnse.tohex(openssl.md5(answer.body))\n results.favicon_md5 = md5sum\n local sha256sum=sha256(answer.body)\n results.favicon_sha256 = sha256sum\n \n if nmap.verbosity() > 1 then\n local hex_debug = {}\n for i = 1, 128 do \n hex_debug[#hex_debug+1] = string.format(\"%02X\", rb64:byte(i))\n end\n -- In debug mode, shows the first bytes of favicon file.\n local hex_string = table.concat(hex_debug, \"\")\n results.debug = sha256sum .. \" \" .. \"->\" .. hex_string .. \"<-\"\n end\nelse\n stdnse.debug1(\"No favicon found.\")\n return\nend\nreturn results\nend\n\nlocal function dirname(path)\n local dir\n dir = string.match(path, \"^(.*)/\")\n return dir or \"\"\nend\n\n-- Return a URL's host, port, and path, filling in the results with the given\n-- host, port, and path if the URL is relative. Return nil if the scheme is not\n-- \"http\" or \"https\".\nfunction parse_url_relative(u, host, port, path)\n local scheme, abspath\n u = url.parse(u)\n scheme = u.scheme or \"http\"\n if not (scheme == \"http\" or scheme == \"https\") then\n return nil\n end\n abspath = u.path or \"\"\n if not string.find(abspath, \"^/\") then\n abspath = dirname(path) .. \"/\" .. abspath\n end\n return u.host or host, u.port or url.get_default_port(scheme), abspath\nend\n\nfunction parseIcon( body )\n local _, i, j\n local rel, href, word\n\n -- Loop through link elements.\n i = 0\n while i do\n _, i = string.find(body, \"<%s*[Ll][Ii][Nn][Kk]%s\", i + 1)\n if not i then\n return nil\n end\n -- Loop through attributes.\n j = i\n while true do\n local name, quote, value\n _, j, name, quote, value = string.find(body, \"^%s*(%w+)%s*=%s*([\\\"'])(.-)%2\", j + 1)\n if not j then\n break\n end\n if string.lower(name) == \"rel\" then\n rel = value\n elseif string.lower(name) == \"href\" then\n href = value\n end\n end\n for word in string.gmatch(rel or \"\", \"%S+\") do\n if string.lower(word) == \"icon\" then\n return href\n end\n end\n end\nend\n", "old_content": "local http = require \"http\"\nlocal nmap = require \"nmap\"\nlocal shortport = require \"shortport\"\nlocal stdnse = require \"stdnse\"\nlocal string = require \"string\"\nlocal url = require \"url\"\nlocal base64 = require \"base64\"\n\ndescription = [[\nGets the favicon from a web page then hash it using sha256 and the method\n\"http.favicon.hash\" used by shodan.io murmur3_32(base64(favicon))\nThe results is displayed as a signed integer.\n\nIf the script argument favicon.uri is given, that relative URI is\nalways used to find the favicon. Otherwise, first the page at the root of the\nweb server is retrieved and parsed for a \nelement. If that fails, the icon is looked for in /favicon.ico. If\na favicon points to a different host or port, it is ignored.\n]]\nauthor = \"CIRCL/Paul JUNG (Thanat0s)\"\nlicense = \"GNU Affero General Public Licence https://www.gnu.org/licenses/agpl-3.0.en.html\"\n\n---\n-- @args favicon.uri URI that will be requested for favicon.\n-- @args favicon.root Web server path to search for favicon.\n--\n-- @usage\n-- nmap --script=http-favicon.nse \\\n-- --script-args favicon.root=,favicon.uri=\n-- @output\n-- |_ http-mmfavicon: signed integer\n\n-- HTTP default favicon murmur32 (shodan like) / sha256 hash\n-- rev 1.0 (2025-10-10)\n-- Original NASL script inspiration by Javier Fernandez-Sanguino Pena\n-- NSE http-favicon.nse by Vlatko Kosturjak\n-- SHA256 Implementation by OGabrieLima https://github.com/OGabrieLima (2024-04-08)\n\ncategories = {\"default\", \"discovery\", \"safe\"}\nportrule = shortport.http\n\n--[[\nFor thoses who wonder, in NMAP v7.94, LUA NSE is bundled with the following Openssl module:\n - bignum_dec2bn\n - bignum_pseudo_rand\n - supported_ciphers\n - supported_digests\n - ripemd160\n - DES_string_to_key\n - bignum_num_bytes\n - bignum_bn2hex\n - decrypt\n - bignum_bn2mpi\n - bignum_mod_exp\n - bignum_set_bit\n - bignum_rand\n - encrypt\n - hmac\n - digest\n - bignum_div\n - bignum_bn2dec\n - bignum_bin2bn\n - bignum_clear_bit\n - md5\n - bignum_bn2bin\n - bignum_num_bits\n - md4\n - rand_pseudo_bytes\n - bignum_is_safe_prime\n - bignum_add\n - rand_bytes\n - bignum_hex2bn\n - sha1\n - bignum_is_bit_set\n - bignum_is_prime\n]]--\n\n-- Auxiliary function: right rotation (bitwise)\nlocal function bit_ror(x, y)\n return ((x >> y) | (x << (32 - y))) & 0xFFFFFFFF\nend\n\n-- helpers since lib int seems not available in nmap\nlocal function toUint32(x) return x % 0x100000000 end\nlocal function toInt32(x)\n x = x % 0x100000000\n if x >= 0x80000000 then x = x - 0x100000000 end\n return x\nend\nlocal function rshift(x,n) return math.floor(toUint32(x) / 2^n) end\nlocal function lshift(x,n) return toUint32(toUint32(x) * 2^n) end\nlocal function rol(x,n) return toUint32(lshift(x,n) + rshift(x,32-n)) end\nlocal function bxor(a,b)\n local r, bitval = 0,1\n for i=1,32 do\n if (a % 2 + b % 2) % 2 == 1 then r = r + bitval end\n a = math.floor(a/2); b = math.floor(b/2); bitval = bitval * 2\n end\n return toUint32(r)\nend\nlocal function imul32(a,b)\n local a_lo, a_hi = a % 0x10000, math.floor(a / 0x10000)\n local b_lo, b_hi = b % 0x10000, math.floor(b / 0x10000)\n local low = a_lo * b_lo\n local mid = a_lo * b_hi + a_hi * b_lo\n return toUint32(low + mid * 0x10000)\nend\n\n-- Main function: MurmurHash3 32-bits\nlocal function murmur3_32(data, seed)\n local h1 = seed or 0\n local c1, c2 = 0xcc9e2d51, 0x1b873593\n local len = #data\n local nblocks = math.floor(len/4)\n\n -- body\n for i=0,nblocks-1 do\n local j = i*4 + 1\n local k1 = data:byte(j) + lshift(data:byte(j+1),8) + lshift(data:byte(j+2),16) + lshift(data:byte(j+3),24)\n k1 = imul32(k1, c1)\n k1 = rol(k1,15)\n k1 = imul32(k1, c2)\n h1 = bxor(h1, k1)\n h1 = rol(h1,13)\n h1 = toUint32(imul32(h1,5) + 0xe6546b64)\n end\n\n -- tail\n local tail_index = nblocks*4 + 1\n local k1 = 0\n local rem = len % 4\n if rem == 3 then k1 = lshift(data:byte(tail_index+2),16) end\n if rem >= 2 then k1 = bxor(k1, lshift(data:byte(tail_index+1),8)) end\n if rem >= 1 then\n k1 = bxor(k1, data:byte(tail_index))\n k1 = imul32(k1, c1)\n k1 = rol(k1,15)\n k1 = imul32(k1, c2)\n h1 = bxor(h1,k1)\n end\n\n -- finalization\n h1 = bxor(h1, len)\n h1 = bxor(h1, rshift(h1,16))\n h1 = imul32(h1,0x85ebca6b)\n h1 = bxor(h1,rshift(h1,13))\n h1 = imul32(h1,0xc2b2ae35)\n h1 = bxor(h1,rshift(h1,16))\n\n return toInt32(h1)\nend\n\n-- Main function: SHA256\nsha256 = function(message)\n local k = {\n 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,\n 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,\n 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,\n 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,\n 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,\n 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,\n 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,\n 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2\n }\n\n local function preprocess(message)\n local len = #message\n local bitLen = len * 8\n message = message .. \"\\128\" -- append single '1' bit\n\n local zeroPad = 64 - ((len + 9) % 64)\n if zeroPad ~= 64 then\n message = message .. string.rep(\"\\0\", zeroPad)\n end\n\n -- append length\n message = message .. string.char(\n bitLen >> 56 & 0xFF,\n bitLen >> 48 & 0xFF,\n bitLen >> 40 & 0xFF,\n bitLen >> 32 & 0xFF,\n bitLen >> 24 & 0xFF,\n bitLen >> 16 & 0xFF,\n bitLen >> 8 & 0xFF,\n bitLen & 0xFF\n )\n\n return message\n end\n\n local function chunkify(message)\n local chunks = {}\n for i = 1, #message, 64 do\n table.insert(chunks, message:sub(i, i + 63))\n end\n return chunks\n end\n\n local function processChunk(chunk, hash)\n local w = {}\n\n for i = 1, 64 do\n if i <= 16 then\n w[i] = string.byte(chunk, (i - 1) * 4 + 1) << 24 |\n string.byte(chunk, (i - 1) * 4 + 2) << 16 |\n string.byte(chunk, (i - 1) * 4 + 3) << 8 |\n string.byte(chunk, (i - 1) * 4 + 4)\n else\n local s0 = bit_ror(w[i - 15], 7) ~ bit_ror(w[i - 15], 18) ~ (w[i - 15] >> 3)\n local s1 = bit_ror(w[i - 2], 17) ~ bit_ror(w[i - 2], 19) ~ (w[i - 2] >> 10)\n w[i] = (w[i - 16] + s0 + w[i - 7] + s1) & 0xFFFFFFFF\n end\n end\n\n local a, b, c, d, e, f, g, h = table.unpack(hash)\n\n for i = 1, 64 do\n local s1 = bit_ror(e, 6) ~ bit_ror(e, 11) ~ bit_ror(e, 25)\n local ch = (e & f) ~ ((~e) & g)\n local temp1 = (h + s1 + ch + k[i] + w[i]) & 0xFFFFFFFF\n local s0 = bit_ror(a, 2) ~ bit_ror(a, 13) ~ bit_ror(a, 22)\n local maj = (a & b) ~ (a & c) ~ (b & c)\n local temp2 = (s0 + maj) & 0xFFFFFFFF\n\n h = g\n g = f\n f = e\n e = (d + temp1) & 0xFFFFFFFF\n d = c\n c = b\n b = a\n a = (temp1 + temp2) & 0xFFFFFFFF\n end\n\n return (hash[1] + a) & 0xFFFFFFFF,\n (hash[2] + b) & 0xFFFFFFFF,\n (hash[3] + c) & 0xFFFFFFFF,\n (hash[4] + d) & 0xFFFFFFFF,\n (hash[5] + e) & 0xFFFFFFFF,\n (hash[6] + f) & 0xFFFFFFFF,\n (hash[7] + g) & 0xFFFFFFFF,\n (hash[8] + h) & 0xFFFFFFFF\n end\n\n message = preprocess(message)\n local chunks = chunkify(message)\n\n local hash = {0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19}\n for _, chunk in ipairs(chunks) do\n hash = {processChunk(chunk, hash)}\n end\n\n local result = \"\"\n for _, h in ipairs(hash) do\n result = result .. string.format(\"%08x\", h)\n end\n\n return result\nend\n\nlocal function add_crlf(str, width)\n width = width or 76\n local t = {}\n for i = 1, #str, width do\n table.insert(t, str:sub(i, i + width - 1))\n end\n local s = table.concat(t, \"\\n\")\n return s .. \"\\n\"\nend\n\naction = function(host, port)\n local md5sum,answer\n local match\n local status, favicondb\n local results = stdnse.output_table()\n -- local results = {}\n local index, icon\n local root = \"\"\n\n if(stdnse.get_script_args('favicon.root')) then\n root = stdnse.get_script_args('favicon.root')\n end\n\n -- If parameter favicon.uri is given, we fetch it, always and only this.\n local favicon_uri = stdnse.get_script_args(\"favicon.uri\")\n if(favicon_uri) then\n answer = http.get( host, port, root .. \"/\" .. favicon_uri)\n stdnse.debug4(\"Using URI %s\", favicon_uri)\n else\n -- Otherwise, first try parsing the home page \"/\" for favicon reference.\n index = http.get( host, port, root .. \"/\" )\n if index.status == 200 or index.status == 503 then\n -- find the favicon pattern\n icon = parseIcon( index.body )\n -- if we find a pattern, we fetch it.\n if icon then\n local hostname = host.targetname or (host.name ~= \"\" and host.name) or host.ip\n stdnse.debug1(\"Got icon URL %s.\", icon)\n local icon_host, icon_port, icon_path = parse_url_relative(icon, hostname, port.number, root)\n if (icon_host == host.ip or\n icon_host == host.targetname or\n icon_host == (host.name ~= '' and host.name)) and\n icon_port == port.number then\n -- request the favicon\n answer = http.get( icon_host, icon_port, icon_path )\n else\n answer = nil\n end\n else\n answer = nil\n end\n end\n\n -- If that didn't work, try /favicon.ico.\n if not answer or answer.status ~= 200 then\n answer = http.get( host, port, root .. \"/favicon.ico\" )\n stdnse.debug4(\"Using default URI.\")\n end\n end\n\n-- Finaly if we have a favicon, we hash it.\nif answer and answer.status == 200 then\n stdnse.debug1(\"Favicon found.\")\n local debugs = \"\"\n --\u00a0MurmurHash3 32 bits should be done on a B64 CLRF\u00a0enabled dump.\n local rb64 = add_crlf(base64.enc(answer.body)) \n results.faviconhash = murmur3_32(rb64)\n local sha256sum=sha256(answer.body)\n results.sha256 = sha256sum\n \n if nmap.verbosity() > 1 then\n local hex_debug = {}\n for i = 1, 128 do \n hex_debug[#hex_debug+1] = string.format(\"%02X\", rb64:byte(i))\n end\n -- In debug mode, shows the first bytes of favicon file.\n local hex_string = table.concat(hex_debug, \"\")\n results.debug = sha256sum .. \" \" .. \"->\" .. hex_string .. \"<-\"\n end\nelse\n stdnse.debug1(\"No favicon found.\")\n return\nend\nreturn results\nend\n\nlocal function dirname(path)\n local dir\n dir = string.match(path, \"^(.*)/\")\n return dir or \"\"\nend\n\n-- Return a URL's host, port, and path, filling in the results with the given\n-- host, port, and path if the URL is relative. Return nil if the scheme is not\n-- \"http\" or \"https\".\nfunction parse_url_relative(u, host, port, path)\n local scheme, abspath\n u = url.parse(u)\n scheme = u.scheme or \"http\"\n if not (scheme == \"http\" or scheme == \"https\") then\n return nil\n end\n abspath = u.path or \"\"\n if not string.find(abspath, \"^/\") then\n abspath = dirname(path) .. \"/\" .. abspath\n end\n return u.host or host, u.port or url.get_default_port(scheme), abspath\nend\n\nfunction parseIcon( body )\n local _, i, j\n local rel, href, word\n\n -- Loop through link elements.\n i = 0\n while i do\n _, i = string.find(body, \"<%s*[Ll][Ii][Nn][Kk]%s\", i + 1)\n if not i then\n return nil\n end\n -- Loop through attributes.\n j = i\n while true do\n local name, quote, value\n _, j, name, quote, value = string.find(body, \"^%s*(%w+)%s*=%s*([\\\"'])(.-)%2\", j + 1)\n if not j then\n break\n end\n if string.lower(name) == \"rel\" then\n rel = value\n elseif string.lower(name) == \"href\" then\n href = value\n end\n end\n for word in string.gmatch(rel or \"\", \"%S+\") do\n if string.lower(word) == \"icon\" then\n return href\n end\n end\n end\nend", "analyzed_by_user_id": 1, "analyzed_at": "2026-04-27 09:44", "analyzed_by_user_name": "Rulezet", "rule_format": "nse", "rule_source": "https://github.com/D4-project/Plum-Rules-NSE", "manuel_submit": false } ] } }

Search Rules

http-mm-sha-favicon

[[ currentRule.title ]]

[[ bundle.name ]]

Community Discussion