Automated reconnaissance tool that leverages FOFA and favicon hash (mmh3) fingerprinting to discover exposed assets across bug bounty targets.

• FOFA API integration
• Favicon hash matching (icon_hash)
• Bug bounty domain automation
• Subdomain targeting (vpn, remote, secure)
• Multithreaded scanning
• JSON output

git clone https://github.com/733nw0lf/fofa-favicon-hunter.git
cd fofa-favicon-hunter
pip install -r requirements.txt

Edit config.py:

FOFA_EMAIL = "your_email"
FOFA_KEY = "your_key"
TARGET_HASH = "-800551065"
MAX_DOMAINS = 500

python3 main.py

Saved as:

fofa## 🧠 How It Works

1. Loads bug bounty domains from public datasets  
2. Queries FOFA using favicon hash (`icon_hash`)  
3. Applies domain and subdomain filters  
4. Collects matching assets  
5. Outputs structured JSON results  _results.json

1. Loads bug bounty domains from public datasets
2. Queries FOFA using favicon hash (icon_hash)
3. Applies domain and subdomain filters
4. Collects matching assets
5. Outputs structured JSON results