Performing OSINT with SpiderFoot
Overview
SpiderFoot is an open-source OSINT automation tool with 200+ modules that integrates with data sources for threat intelligence and attack surface mapping. This skill uses the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) to create and manage scans, select modules by use case (footprint, investigate, passive), parse structured results for domains, IPs, email addresses, leaked credentials, and DNS records, and generate target intelligence profiles.
When to Use
- When conducting security assessments that involve performing osint with spiderfoot
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Prerequisites
- SpiderFoot 4.0+ installed or SpiderFoot HX cloud account
- Python 3.8+ with requests library
- SpiderFoot server running on default port 5001
- Optional: API keys for VirusTotal, Shodan, HaveIBeenPwned modules
Steps
- Connect to SpiderFoot REST API or use CLI interface
- Create a new scan with target specification (domain, IP, email, name)
- Select scan modules by use case (all, footprint, investigate, passive)
- Monitor scan progress via API polling
- Retrieve and parse scan results by data element type
- Extract key findings: subdomains, IPs, emails, leaked credentials
- Generate structured OSINT intelligence report
Expected Output
JSON report containing OSINT findings organized by data type (domains, IPs, emails, credentials, DNS records), module source attribution, and target profile summary with risk indicators.
1---
2name: performing-osint-with-spiderfoot
3description: Automate OSINT collection using SpiderFoot REST API and CLI for target profiling, module-based reconnaissance,
4 and structured result analysis across 200+ data sources
5domain: cybersecurity
6subdomain: threat-intelligence
7tags:
8- osint
9- spiderfoot
10- reconnaissance
11- threat-intelligence
12- attack-surface
13- target-profiling
14version: '1.0'
15author: mahipal
16license: Apache-2.0
17nist_csf:
18- ID.RA-01
19- ID.RA-05
20- DE.CM-01
21- DE.AE-02
22---
23
24# Performing OSINT with SpiderFoot
25
26## Overview
27
28SpiderFoot is an open-source OSINT automation tool with 200+ modules that integrates with data sources for threat intelligence and attack surface mapping. This skill uses the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) to create and manage scans, select modules by use case (footprint, investigate, passive), parse structured results for domains, IPs, email addresses, leaked credentials, and DNS records, and generate target intelligence profiles.
29
30
31## When to Use
32
33- When conducting security assessments that involve performing osint with spiderfoot
34- When following incident response procedures for related security events
35- When performing scheduled security testing or auditing activities
36- When validating security controls through hands-on testing
37
38## Prerequisites
39
40- SpiderFoot 4.0+ installed or SpiderFoot HX cloud account
41- Python 3.8+ with requests library
42- SpiderFoot server running on default port 5001
43- Optional: API keys for VirusTotal, Shodan, HaveIBeenPwned modules
44
45## Steps
46
471. Connect to SpiderFoot REST API or use CLI interface
482. Create a new scan with target specification (domain, IP, email, name)
493. Select scan modules by use case (all, footprint, investigate, passive)
504. Monitor scan progress via API polling
515. Retrieve and parse scan results by data element type
526. Extract key findings: subdomains, IPs, emails, leaked credentials
537. Generate structured OSINT intelligence report
54
55## Expected Output
56
57JSON report containing OSINT findings organized by data type (domains, IPs, emails, credentials, DNS records), module source attribution, and target profile summary with risk indicators.
theheavenlyd3mon