SpiderFoot is an open source intelligence automation tool that gathers and correlates data from hundreds of sources to map attack surfaces and support threat intelligence operations.
The tool solves the problem of manually collecting and correlating intelligence from disparate sources by automating reconnaissance across a wide range of data providers. A YAML-configurable correlation engine with pre-defined rules identifies relationships and patterns in the collected data. The tool accepts multiple entity types as scan targets including IP addresses, domains, email addresses, phone numbers, usernames, and others, making it flexible for different reconnaissance scenarios.
SpiderFoot suits both offensive and defensive use cases. Red teams and penetration testers use it for target reconnaissance, while defenders use it to discover what their organization has exposed online. The tool offers both a web-based interface and command-line operation, accommodating different workflows. It can integrate with external tools like DNSTwist, Whatweb, Nmap, and CMSeeK, and supports TOR integration for dark web searching. Data can be exported in multiple formats including CSV, JSON, and GEXF. For teams needing cloud-based deployment, continuous monitoring, multi-user collaboration, and managed infrastructure, a commercial variant called SpiderFoot HX is available with additional features like attack surface monitoring with change notifications and REST API access.
The project has maintained active development over an extended period, with regular updates to its module collection and core functionality. The codebase is written in Python 3 and distributed under the MIT license, with comprehensive documentation and a SQLite backend supporting custom queries. The tool is highly configurable, allowing users to tailor module behavior and data sources to their specific intelligence requirements.
