Open-source intelligence automation tool that queries over 200 data sources for email, domain, IP, and web footprinting.
spiderfoot -s {target} 🌍 target → domain spiderfoot -s {target}Sandbox: execFile · Timeout: 3600s
security.intel.osint security.recon.passive security.intel.email network.discovery.subdomain security.intel.vulnerability security.intel.breach security.recon.framework | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
flag-s | string | No | - | Target for the scan | -s |
flag-t | string | No | - | Event types to collect (modules selected automatically) | -t |
flag-u | string | No | - | Select modules by use case (all, footprint, investigate, passive) | -u |
flag-o | string | No | tab | Output format (tab, csv, json) | -o |
flag-l | string | No | - | IP and port to listen on (web UI) | -l |
flag-d | boolean | No | - | Enable debug output | -d, --debug |
flag-m | string | No | - | Modules to enable (comma-separated) | -m |
flag-M | boolean | No | - | List available modules | -M, --modules |
flag-T | boolean | No | - | List available event types | -T, --types |
flag-x | boolean | No | - | Strict mode — only enable directly-consumable modules | -x |
flag-q | boolean | No | - | Disable logging | -q |
flag-C | string | No | - | Run correlation rules against a scan ID | -C, --correlate |
max-threads | integer | No | - | Max number of modules to run concurrently | -max-threads |
C | boolean | No | - | scanID Run correlation rules against a scan ID. | -C, --correlate |
D | boolean | No | - | DELIMITER Delimiter for CSV output. | -D |
F | boolean | No | - | type1,type2,... Show only a set of event types. | -F |
H | boolean | No | - | Don't print field headers. | -H |
M | boolean | No | - | List available modules. | -M, --modules |
V | boolean | No | - | Display the version. | -V, --version |
d | boolean | No | - | Enable debug output. | -d, --debug |
f | boolean | No | - | Filter out other event types. | -f |
h | boolean | No | - | show this help message and exit | -h, --help |
m | boolean | No | - | mod1,mod2,... Modules to enable. | -m |
n | boolean | No | - | Strip newlines from data. | -n |
r | boolean | No | - | Include the source data field. | -r |
| Type | Description | MIME | Schema | Trust |
|---|---|---|---|---|
security.recon.report | SpiderFoot scan report | text/html | - | verified |
security.recon.events | SpiderFoot event data | application/json | - | community |
Inputs
network.target.domain Target domain name
network.target.ip Target IP address
security.target.email Email address
network.target.url Target URL
Outputs
security.recon.report Scan report with OSINT findings
security.recon.events Event data as JSON
network_trafficnetwork_trafficnetwork_traffic Produces
security.recon.reportsecurity.recon.eventsConsumes
network.target.domainnetwork.target.ipsecurity.target.emailnetwork.target.url| Resource | Value |
|---|---|
| CPU | medium |
| Memory | 256 MB |
| Network | medium |
| Disk I/O | low |
Basic footprint scan on a domain
spiderfoot -s example.comFull scan with all modules
spiderfoot -s example.com -u allPassive only scan (no direct contact)
spiderfoot -s example.com -u passiveInvestigate an IP address
spiderfoot -s 8.8.8.8 -u investigateSpecific event types only
spiderfoot -s example.com -t "DOMAIN_NAME,IP_ADDRESS"JSON output for pipeline processing
spiderfoot -s example.com -o jsonLaunch web UI on custom port
spiderfoot -l 127.0.0.1:5001List all available modules
spiderfoot -MRun correlation rules against a completed scan
spiderfoot -C SCAN_IDSpiderFoot is an open-source intelligence automation tool that queries over 200 data sources to build comprehensive profiles of domains, IP addresses, email addresses, and URLs. It operates in both CLI and web UI modes.
| Use Case | Description |
|---|---|
passive |
No direct contact with target infrastructure |
footprint |
Broad information gathering |
investigate |
Deep investigation of target |
all |
All available modules |