Performing OSINT with SpiderFoot
Overview
SpiderFoot is an open-source OSINT automation tool with 200+ modules that integrates with data sources for threat intelligence and attack surface mapping. This skill uses the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) to create and manage scans, select modules by use case (footprint, investigate, passive), parse structured results for domains, IPs, email addresses, leaked credentials, and DNS records, and generate target intelligence profiles.
Prerequisites
- SpiderFoot 4.0+ installed or SpiderFoot HX cloud account
- Python 3.8+ with requests library
- SpiderFoot server running on default port 5001
- Optional: API keys for VirusTotal, Shodan, HaveIBeenPwned modules
Steps
- Connect to SpiderFoot REST API or use CLI interface
- Create a new scan with target specification (domain, IP, email, name)
- Select scan modules by use case (all, footprint, investigate, passive)
- Monitor scan progress via API polling
- Retrieve and parse scan results by data element type
- Extract key findings: subdomains, IPs, emails, leaked credentials
- Generate structured OSINT intelligence report
Expected Output
JSON report containing OSINT findings organized by data type (domains, IPs, emails, credentials, DNS records), module source attribution, and target profile summary with risk indicators.
1---2name: performing-osint-with-spiderfoot3description: Automate OSINT collection using SpiderFoot REST API and CLI for target profiling, module-based reconnaissance, and structured result analysis across 200+ data sources4domain: cybersecurity5subdomain: threat-intelligence6tags:7 - osint8 - spiderfoot9 - reconnaissance10 - threat-intelligence11 - attack-surface12 - target-profiling13version: "1.0"14author: mahipal15license: Apache-2.016---1718# Performing OSINT with SpiderFoot1920## Overview2122SpiderFoot is an open-source OSINT automation tool with 200+ modules that integrates with data sources for threat intelligence and attack surface mapping. This skill uses the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) to create and manage scans, select modules by use case (footprint, investigate, passive), parse structured results for domains, IPs, email addresses, leaked credentials, and DNS records, and generate target intelligence profiles.2324## Prerequisites2526- SpiderFoot 4.0+ installed or SpiderFoot HX cloud account27- Python 3.8+ with requests library28- SpiderFoot server running on default port 500129- Optional: API keys for VirusTotal, Shodan, HaveIBeenPwned modules3031## Steps32331. Connect to SpiderFoot REST API or use CLI interface342. Create a new scan with target specification (domain, IP, email, name)353. Select scan modules by use case (all, footprint, investigate, passive)364. Monitor scan progress via API polling375. Retrieve and parse scan results by data element type386. Extract key findings: subdomains, IPs, emails, leaked credentials397. Generate structured OSINT intelligence report4041## Expected Output4243JSON report containing OSINT findings organized by data type (domains, IPs, emails, credentials, DNS records), module source attribution, and target profile summary with risk indicators.
autohandai