Skip to content
Deepak Gupta markRecon Atlas

Recon frameworks

SpiderFoot

Python OSINT automation tool with 200+ modules, a web UI and CLI, correlating data about domains, IPs, emails, names and more.

Passive and active modesScope a pentestAudit your own exposure

24k stars · last push April 13, 2026 · v4.0 · MIT

GitHub repository

What it finds

SpiderFoot takes a seed such as a domain, IP, CIDR, ASN, email, phone number, username or person's name. Its 200+ modules feed each other in a publisher/subscriber model, pulling from threat-intel, DNS, breach and search sources. A YAML correlation engine with 37 built-in rules flags patterns, and results export to CSV, JSON or GEXF.

  • subdomains
  • hostnames
  • IP addresses
  • emails
  • phone numbers
  • names
  • social media accounts
  • cloud buckets
  • breach records
  • threat intel and blocklist hits
  • cryptocurrency addresses
  • open ports
  • document metadata

Does it touch the target?

Has a passive mode and active modes. The active modes need the owner's permission.

README lists third-party lookups alongside "Port scanning and banner grabbing", "DNS zone transfers" and a DNS brute-forcer module. The sf.py help text offers "-u {all,footprint,investigate,passive}" to "Select modules automatically by use case".

API keys: README: "SpiderFoot has over 200 modules, most of which don't require API keys, and many of those that do require API keys have a free tier."

Install

Install with source
wget https://github.com/smicallef/spiderfoot/archive/v4.0.tar.gz
tar zxvf v4.0.tar.gz
cd spiderfoot-4.0
pip3 install -r requirements.txt
python3 ./sf.py -l 127.0.0.1:5001

From the project's documentation

Install with source
git clone https://github.com/smicallef/spiderfoot.git
cd spiderfoot
pip3 install -r requirements.txt
python3 ./sf.py -l 127.0.0.1:5001

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Start the web UI on localhost
python3 ./sf.py -l 127.0.0.1:5001

From the project's documentation

Output formats: csv, json, gexf

Runs these tools under the hood: DNSTwist, WhatWeb, Nmap, CMSeeK, nbtscan, Nuclei, onesixtyone, Retire.js, snallygaster, testssl.sh, TruffleHog, WAFW00F, Wappalyzer

Limits the project documents

  • README recommends the packaged release because master "will often have bleeding edge features and modules that aren't fully tested."
  • Tool modules (Nmap, Nuclei, testssl.sh and others) wrap locally installed tools, for example "using a local DNSTwist installation".
  • Some features (managed monitoring, multi-target scans, multi-user, screenshotting) are listed only for the commercial SpiderFoot HX.

Deepak's take

Analysis, not documentation

Use it when
Use it for broad OSINT on your organisation's domains, IP ranges and email domains, with results you can browse and correlate in a web UI.
Skip it when
Skip it when you need current, maintained subdomain coverage; BBOT covers similar ground and is actively released.
What it will miss
Its last release was v4.0 in 2022, so a module whose upstream API has since changed may return nothing. An empty result is not proof of absence.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Licence: MIT. SpiderFoot is a trademark or project name of its owners; this library is not affiliated with it.