What it’s for

Building a wide intel graph fast: domains, subdomains, IPs, ports (from public sources), leaked creds mentions, social links, DNS records, tech fingerprints, etc.

Great for pivoting: you start with example.com, then SpiderFoot finds related domains, hosts, emails, and sometimes exposed metadata you didn’t think to search manually.

Best used as an early recon mapper, then you verify findings with targeted tools.

How to use it (practical)
Install

Kali/Ubuntu/Debian-ish:

sudo apt update
sudo apt install spiderfoot


If your repo doesn’t have it, you can run it from source (common approach):

git clone https://github.com/smicallef/spiderfoot.git
cd spiderfoot
python3 -m pip install -r requirements.txt
python3 sf.py -l 127.0.0.1:5001

Start the web UI
spiderfoot -l 127.0.0.1:5001


Then open your browser to:
http://127.0.0.1:5001

Run a scan (web UI way)

Click New Scan

Target: example.com (or IP/email/name/etc.)

Pick scan type:

All (noisy but thorough)

Footprint (good “first pass” for domains)

Passive (safer / less aggressive)

Start scan and watch results populate.

CLI scan (if you prefer terminal)

From the SpiderFoot folder:

python3 sf.py -s example.com -m all -o json > results.json


-s target

-m all modules

-o json output format

(Exact flags can vary slightly by version, but that’s the common pattern.)

What to look for in the output

New domains / subdomains you didn’t know existed (especially dev, stage, old, beta, admin).

DNS + infrastructure links: shared hosting, shared IPs, ASN, name servers.

Email / username hits: patterns that help identify real staff vs. junk data.

Leaky breadcrumbs: paste mentions, document metadata, code repo references, third-party services.

Best practice: “Trust but verify”

SpiderFoot is awesome, but it can produce false positives.

Treat results as leads, not truth.

Verify critical findings with direct checks (DNS resolve, HTTP probe, manual search, etc.).

Common problems + quick fixes

API keys: some modules are much better with keys (Shodan, HaveIBeenPwned, etc.). Without keys, scans still work, just with fewer hits.

Too much noise: don’t run “All” every time. Start with “Footprint” or “Passive.”

Scan feels slow: reduce modules, reduce target scope, or run fewer concurrent requests in settings.