Repolode
Submit
smicallef

smicallef/spiderfoot

Open source OSINT automation tool that gathers data on IPs, domains, emails and more from 200+ sources for threat intelligence and attack surface mapping.

Open-source alternative to:Maltego

View on GitHubWebsite
Stars
23,612
Forks
3,782
Open issues
346
Last commit
6 months ago

What is it?

SpiderFoot automates open source intelligence (OSINT) collection. You give it a target such as an IP address, domain, subdomain, CIDR subnet, ASN, email address, phone number, username, person's name or Bitcoin address, and its modules query data sources, scrape content and feed results back to each other in a publisher/subscriber model.

The tool includes over 200 modules, most of which do not require API keys, and many that do offer a free tier. Coverage includes DNS enumeration, passive DNS, certificate transparency, breach lookups, blacklist and threat intelligence checks, cloud storage bucket discovery, and Tor search engines. A YAML-configurable correlation engine with 37 pre-defined rules links findings together. Results can be explored in a built-in web UI or driven from the command line, and exported as CSV, JSON or GEXF, with SQLite storage for custom queries.

SpiderFoot can call external tools such as Nmap, DNSTwist, WhatWeb, CMSeeK and Nuclei. It is used for both offensive reconnaissance in red team and penetration testing work and defensive review of what an organisation exposes on the Internet. It is written in Python 3.7+ and distributed under the MIT license.

Key features

  • 01Web UI or command-line operation
  • 02200+ modules covering DNS, breaches, threat intelligence and cloud buckets
  • 03YAML-configurable correlation engine with 37 pre-defined rules
  • 04Export to CSV, JSON and GEXF, with SQLite storage for custom queries
  • 05Integrates external tools such as Nmap, DNSTwist, WhatWeb and Nuclei
  • 06Optional Tor integration for dark web searches and a Dockerfile

Use cases

  • Mapping a company's external attack surface, including subdomains, cloud buckets and exposed services
  • Reconnaissance during red team exercises or penetration tests
  • Checking whether an organisation's emails or domains appear in known data breaches
  • Gathering threat intelligence on suspicious IPs, domains or Bitcoin addresses

Quick start

  1. 1

    Download the packaged release archive

    wget https://github.com/smicallef/spiderfoot/archive/v4.0.tar.gz
  2. 2

    Extract the archive and enter the folder

    tar zxvf v4.0.tar.gz && cd spiderfoot-4.0
  3. 3

    Install the Python dependencies

    pip3 install -r requirements.txt
  4. 4

    Start the web server on localhost port 5001

    python3 ./sf.py -l 127.0.0.1:5001

Things to know

  • Many modules need API keys, although many of those offer a free tier.
  • The README recommends the packaged release because master may contain untested features.
  • Some integrations are only available in the commercial SpiderFoot HX version.

Topics

#osint#threat-intelligence#reconnaissance#attack-surface#cybersecurity#penetration-testing#python#attacksurface#cti#footprinting

FAQ

What is spiderfoot?
Open source OSINT automation tool that gathers data on IPs, domains, emails and more from 200+ sources for threat intelligence and attack surface mapping. SpiderFoot automates open source intelligence (OSINT) collection. You give it a target such as an IP address, domain, subdomain, CIDR subnet, ASN, email address, phone number, username, person's name or Bitcoin address, and its modules query data sources, scrape content and feed results back to each other in a publisher/subscriber model.
Is spiderfoot free to use? What license does it have?
spiderfoot is open source under the MIT license. Check the license terms before using it in commercial products.
Is spiderfoot still maintained?
No commits for 6+ months. The last commit to spiderfoot was on Apr 13, 2026.
What can I use spiderfoot for?
Mapping a company's external attack surface, including subdomains, cloud buckets and exposed services Reconnaissance during red team exercises or penetration tests Checking whether an organisation's emails or domains appear in known data breaches Gathering threat intelligence on suspicious IPs, domains or Bitcoin addresses
How do I install spiderfoot?
Download the packaged release archive: wget https://github.com/smicallef/spiderfoot/archive/v4.0.tar.gz Extract the archive and enter the folder: tar zxvf v4.0.tar.gz && cd spiderfoot-4.0 Install the Python dependencies: pip3 install -r requirements.txt Start the web server on localhost port 5001: python3 ./sf.py -l 127.0.0.1:5001
Where can I get spiderfoot?
The source code and installation instructions are on GitHub: https://github.com/smicallef/spiderfoot

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects