Features • Installation • Usage • Commands • Examples • Workflow • License
___ ___ ___ ___ _____ __ __ _ ___
/ __/ __/ __| __|_ _| \/ | /_\ | _ \
| (_ \__ \__ \ _| | | | |\/| |/ _ \| _/
\___|___/___/___| |_| |_| |_/_/ \_\_|
favicon + cert fingerprint + vuln recon v2.0
Most recon tools are written in Python/Go and pull in dozens of dependencies. Assetmap is a single compiled C binary — fast startup, tiny footprint, no runtime dependencies beyond libcurl and openssl (which are already on every pentest box).
It combines 6 essential recon techniques that map out an organization's attack surface:
- 🔍 Favicon fingerprinting — find hidden assets via Shodan
- 📜 Certificate transparency — discover subdomains & sibling domains
- 🔐 Live TLS certificate analysis — fingerprint any server's cert
- 🛡️ Security header auditing — grade a target's HTTP hardening
- 🔬 TLS/SSL vulnerability scanning — weak ciphers, expired certs, missing HSTS
| Feature | Description |
|---|---|
| Favicon Hash | Compute Shodan-compatible MurmurHash3 of any favicon — find all servers using the same icon |
| crt.sh Domain Lookup | Pull every hostname from certificate transparency logs for *.domain.com |
| crt.sh Org Lookup | Find domains by certificate issuer organization — catches acquisitions & subsidiaries |
| SSL Fingerprint | SHA-256 fingerprint, SANs, chain depth, key info, validity — all from a live TLS handshake |
| Security Headers | Audit 10 security headers (HSTS, CSP, X-Frame-Options, etc.) with A+ to F grading |
| Vuln Scanner | Test TLS versions, weak ciphers, cert issues, HTTPS redirect, HSTS, cookie flags |
# Debian/Ubuntu/Kali
sudo apt install build-essential libcurl4-openssl-dev libssl-dev
# Fedora/RHEL
sudo dnf install gcc make libcurl-devel openssl-devel
# Arch
sudo pacman -S curl openssl base-develgit clone https://github.com/Venu-exe/assetmap.git
cd assetmap
makeThat's it. Single binary ./assetmap, no pip, no npm, no cargo.
./assetmap --version
# assetmap v2.0./assetmap <command> <target> [options]
Compute the Shodan-compatible mmh3 hash of any favicon.ico file. Use this to find all servers running the same software — even if they're on different domains or IPs.
./assetmap favicon https://target.com/favicon.ico[*] Favicon hash: 708578229
[*] Shodan dork: http.favicon.hash:708578229
Bug bounty use: Paste that hash into Shodan to find staging servers, forgotten dev instances, and internal tools sharing the same favicon.
Query crt.sh for every hostname that appears on a certificate covering *.domain.com.
./assetmap crt target.comadmin.target.com
api.target.com
dev.target.com
staging.target.com
[*] 47 unique hostnames found
Bug bounty use: Feeds directly into your subdomain wordlist. Pipe to httpx or dnsx for live filtering.
./assetmap crt target.com | httpx -silent -mc 200Find domains by certificate organization name — catches acquisitions, subsidiaries, and brands that don't share a base domain.
./assetmap crt-org "Target Corporation"Bug bounty use: Expands scope beyond *.target.com. Find acquired-brand.io, target-internal.net, etc.
Connect to any host:port, perform a TLS handshake, and extract the full certificate details.
./assetmap ssl target.com
./assetmap ssl target.com 8443 # custom port[*] TLS Version: TLSv1.3
[*] Cipher: TLS_AES_256_GCM_SHA384
[*] Certificate Chain Depth: 3
[*] SHA-256 Fingerprint: EA:E2:2D:87:EC:9C:D6:...
[*] Serial: 02B0C199B5F2FF96095E3C861AF42BEE
[*] Subject CN: *.target.com
[*] Issuer Org: DigiCert Inc
[*] Subject Alternative Names (12):
DNS: *.target.com
DNS: target.com
DNS: *.api.target.com
...
[*] Not After: Sep 21 08:37:24 2026 GMT
[*] Certificate valid for 52 more day(s)
[*] Public Key: EC 256 bits
Bug bounty use: SANs reveal internal hostnames, API endpoints, and related domains. Expired or self-signed certs are immediate findings.
Fetch response headers and grade the target's security posture.
./assetmap headers https://target.com[*] Server: nginx/1.18.0
[!] Info Leak: X-Powered-By: Express
[+] Strict-Transport-Security: max-age=31536000; includeSubDomains ✓
[+] Content-Security-Policy: default-src 'self' ...
[+] X-Content-Type-Options: nosniff
[+] X-Frame-Options: deny
[-] Permissions-Policy: MISSING
[-] Cross-Origin-Opener-Policy: MISSING
[*] Security Headers Score: 6/10
[*] Grade: C
Headers checked:
| Header | What it prevents |
|---|---|
Strict-Transport-Security |
SSL stripping attacks |
Content-Security-Policy |
XSS, data injection |
X-Content-Type-Options |
MIME-type sniffing |
X-Frame-Options |
Clickjacking |
X-XSS-Protection |
Reflected XSS (legacy) |
Referrer-Policy |
Referrer information leakage |
Permissions-Policy |
Browser feature abuse |
Cross-Origin-*-Policy |
Cross-origin attacks (Spectre, etc.) |
Bug bounty use: Missing security headers are valid bug bounty findings on most programs. Info-leakage headers (X-Powered-By, Server version) help fingerprint the tech stack.
Full security audit with severity-rated findings.
./assetmap scan target.com
./assetmap scan target.com 8443═══════════════════════════════════════════════════════
Security Audit: target.com:443
═══════════════════════════════════════════════════════
───── TLS Version Support ─────
[HIGH] TLS 1.0 is supported (deprecated/insecure)
[INFO] TLS 1.2 is supported
[INFO] TLS 1.3 is supported
───── Weak Cipher Check ─────
[HIGH] RC4 ciphers accepted (cipher: RC4-SHA)
[+] No other weak ciphers accepted
───── Certificate Security ─────
[CRITICAL] Certificate is EXPIRED
[HIGH] Certificate uses weak signature algorithm: SHA-1
───── HTTP → HTTPS Redirect ─────
[MEDIUM] HTTP port 80 serves content without redirecting to HTTPS
───── HSTS & Cookie Security ─────
[MEDIUM] HSTS header is MISSING
[MEDIUM] Cookie 'session' missing Secure flag
[LOW] Cookie 'session' missing SameSite attribute
═══════════════════════════════════════════════════════
Scan Summary
═══════════════════════════════════════════════════════
[*] 7 total finding(s): 1 critical, 2 high, 3 medium, 1 low
[!] CRITICAL issues found — immediate remediation needed!
What it checks:
| Check | Severity | Description |
|---|---|---|
| TLS 1.0/1.1 support | HIGH | Deprecated protocols vulnerable to BEAST, POODLE |
| NULL/EXPORT ciphers | CRITICAL | No encryption or trivially breakable |
| RC4/DES ciphers | HIGH | Known-broken ciphers |
| 3DES/MD5 ciphers | MEDIUM | Weak but not immediately exploitable |
| Expired certificate | CRITICAL | Users see browser warnings |
| Self-signed certificate | HIGH | No chain of trust |
| SHA-1 signature | HIGH | Collision attacks proven feasible |
| RSA key < 2048 bits | HIGH | Factorable with modern hardware |
| Hostname mismatch | HIGH | Certificate doesn't match the domain |
| No HTTPS redirect | MEDIUM | Users can be MITM'd on HTTP |
| Missing HSTS | MEDIUM | Browsers don't enforce HTTPS |
| Cookie without Secure | MEDIUM | Cookies sent over HTTP |
| Cookie without HttpOnly | LOW | Accessible via JavaScript (XSS risk) |
| Cookie without SameSite | LOW | CSRF risk |
# 1. Discover subdomains via cert transparency
./assetmap crt target.com > subdomains.txt
# 2. Find more domains via org name
./assetmap crt-org "Target Inc" >> subdomains.txt
# 3. Deduplicate
sort -u subdomains.txt -o subdomains.txt
# 4. Find the favicon hash and search Shodan for related assets
./assetmap favicon https://target.com/favicon.ico
# 5. Fingerprint certs on all subdomains
while read host; do
echo "=== $host ==="
./assetmap ssl "$host" 2>/dev/null
done < subdomains.txt
# 6. Audit headers on live hosts
cat subdomains.txt | while read host; do
./assetmap headers "https://$host" 2>/dev/null
done
# 7. Full vuln scan
while read host; do
./assetmap scan "$host" 2>/dev/null
done < subdomains.txt# Full recon on one target
./assetmap ssl target.com
./assetmap headers https://target.com
./assetmap scan target.com┌─────────────┐ ┌──────────────┐ ┌─────────────────┐
│ crt / crt-org │────▶│ Subdomain │────▶│ ssl fingerprint │
│ (discovery) │ │ List │ │ (per host) │
└─────────────┘ └──────────────┘ └─────────────────┘
│
┌─────────────┐ ┌──────▼──────────┐
│ favicon │─── Shodan Dork ────▶ │ headers audit │
│ (hash) │ │ (per URL) │
└─────────────┘ └──────┬──────────┘
│
┌──────▼──────────┐
│ scan (vuln) │
│ TLS + certs │
└─────────────────┘
assetmap/
├── Makefile # GNU Make build system
├── LICENSE # MIT License
├── README.md
├── .gitignore
├── include/
│ ├── b64.h # Base64 (Python-compatible line wrapping)
│ ├── crtsh.h # crt.sh CT log queries
│ ├── favicon.h # Favicon mmh3 hash computation
│ ├── headers.h # HTTP security header audit
│ ├── http.h # HTTP client (libcurl wrapper)
│ ├── mmh3.h # MurmurHash3 x86-32
│ ├── sslfp.h # SSL/TLS certificate fingerprinting
│ └── vulnscan.h # TLS/cert vulnerability scanner
└── src/
├── b64.c # Base64 encoder matching Python encodebytes()
├── crtsh.c # crt.sh JSON parsing & dedup
├── favicon.c # Fetch → base64 → mmh3 pipeline
├── headers.c # 10-header audit with grading
├── http.c # libcurl GET with redirect/timeout/UA
├── main.c # CLI dispatcher & banner
├── mmh3.c # MurmurHash3 (Austin Appleby's algorithm)
├── sslfp.c # OpenSSL direct TLS connect & cert parsing
└── vulnscan.c # 5-stage security audit engine
Pull requests are welcome. For major changes, open an issue first.
Ideas for future modules:
- JARM TLS fingerprinting
- DNS record enumeration (A, AAAA, MX, TXT, NS, CNAME)
- HTTP method enumeration (OPTIONS, TRACE, PUT, DELETE)
- Subdomain takeover detection
- JSON output mode (
--json) - Multi-threaded scanning
- Wayback Machine URL enumeration
- Port scanning (top 100 ports)
This tool is intended for authorized security testing only. Use it only against targets you have explicit permission to test (your own infrastructure, or targets within a bug bounty program's scope). Unauthorized scanning is illegal. The author takes no responsibility for misuse.
MIT License — use it, fork it, hack with it.
Venu (@Venu-exe)
If this tool helped you find a bug, consider giving it a ⭐