Open source intelligence gathering tool
SpiderFoot is a Python tool that automates open source intelligence (OSINT) collection for threat intelligence and attack surface mapping processes. It enables detecting security vulnerabilities on digital assets by integrating various data sources.
Updates
- October 11, 2026: Stars 22,178 → 23,302, latest release v4.0 (April 7, 2022).
- September 16, 2026: Stars 21,076 → 22,178, latest release v4.0 (April 7, 2022).
- August 15, 2026: Stars 20,026 → 21,076, latest release v4.0 (April 7, 2022).
- August 2, 2026: Stars 18,921 → 20,026, latest release v4.0 (April 7, 2022).
What you get
- Automatic data collection with more than 200 modules
- Web-based interface or command line support
- Comprehensive attack surface mapping for digital assets
Installation
wget https://github.com/smicallef/spiderfoot/archive/v4.0.tar.gz
tar zxvf v4.0.tar.gz
cd spiderfoot-4.0
pip3 install -r requirements.txt
python3 ./sf.py -l 127.0.0.1:5001git clone https://github.com/smicallef/spiderfoot.git
cd spiderfoot
pip3 install -r requirements.txt
python3 ./sf.py -l 127.0.0.1:5001Running it
python3 ./sf.py -l 127.0.0.1:5001If you don't write code
I want to initiate an OSINT scan on a target using the SpiderFoot tool. My target is a domain/IP address. What steps should I follow to use this tool to analyze how visible my digital assets are on the internet and what vulnerabilities they may have? Please explain how the 200+ modules work and how I should interpret the results.
Repository: https://github.com/smicallef/spiderfoot. Follow the official instructions in the README of this repository for setup and execution.
Before starting, check which OS we are on and if the necessary tools (e.g., Python, Node.js, Git, Docker) are installed. Install any missing ones step-by-step according to this system.
Create a new, empty folder to work in. Do not touch any files outside this folder and do not delete anything. Tell me what you are going to do in one sentence before running each command.
Tell me what I should see on the screen at the end of each step. If an error occurs, I will paste the error message to you exactly as it is, and we will fix it together.
Related dictionary terms
Editorial note
Security and privacy note: Run domain, IP, email, phone, and social-media scans only against authorized targets. Follow third-party API terms, avoid unnecessary personal-data collection, and do not expose the WebUI publicly.
Links
TreScout did not build this tool · we found it in GitHub trends and wrote it up. This page describes the repository as of 2026-06-22: The star count and our text belong to that day, the repository may have changed since. Check the repository link for the current state. The introductory text was prepared with AI from the repository's own documentation, and this page was machine-translated from the Turkish original · the Turkish version prevails.