SpiderFoot
SpiderFoot is an open-source intelligence (OSINT) automation platform that integrates with 309+ data sources for threat intelligence and attack surface mapping.
What is SpiderFoot?
SpiderFoot is an open-source intelligence (OSINT) automation platform that automates the collection and analysis of data from over 309 sources for threat intelligence and attack surface mapping. It helps security teams discover exposed assets, identify threats, and gather intelligence on targets like domains, IPs, emails, and usernames. The platform supports both passive data gathering and active reconnaissance with integrated external tools.
Security professionals, including red teams, blue teams, penetration testers, and threat intelligence analysts, who need to automate OSINT collection, map organizational attack surfaces, and conduct reconnaissance.
Developers choose SpiderFoot for its extensive module library, modern microservices architecture, and comprehensive feature set including AI analysis, vector search, and robust APIs. Its self-hostable, Docker-based deployment and strong security hardening make it a reliable and scalable alternative to commercial OSINT tools.
Overview
SpiderFoot automates OSINT for threat intelligence and mapping your attack surface. Codename Mirage
Use Cases
Best For
- Automating reconnaissance and attack surface mapping for penetration testing
- Monitoring organizational assets and detecting shadow IT for defensive security teams
- Enriching threat intelligence with data from hundreds of OSINT sources
- Conducting subdomain discovery and credential exposure checks
- Generating automated cyber threat intelligence (CTI) reports with AI analysis
- Self-hosting a full-featured OSINT platform with observability and scalability
Not Ideal For
- Teams performing quick, ad-hoc OSINT checks without automation needs
- Organizations with limited infrastructure or budget for running 23+ Docker containers
- Use cases requiring strict data sovereignty and minimal external API dependencies
- Projects needing a simple, monolithic application without microservices complexity
Pros & Cons
Pros
Integrates with 309+ modules for passive and active intelligence gathering, covering DNS, social media, threat intel, and more, as listed in the module categories.
Deployable via Docker Compose or Kubernetes with 23+ optional services, enabling scalability, modularity, and observability, as shown in the architecture diagram.
Includes six LLM-powered agents for automated validation, summarization, and threat intelligence reporting, enhancing analysis efficiency without manual intervention.
Implements JWT authentication, input validation, Docker security opts, and frontend protections like CSP, with a 9.5+ composite security score mentioned in the README.
Cons
The full stack deployment involves 23+ Docker containers, which can be resource-intensive and complex to manage, especially for smaller teams or low-budget environments.
Requires configuring environment variables, Docker profiles, and multiple services, which might be daunting for new users, as indicated in the Quick Start section with detailed steps.
Many modules require API keys for premium data sources, and the active scan worker depends on 33+ external tools, adding operational overhead and potential cost.
Frequently Asked Questions
Related Projects
SecListsSecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
PhoneInfogaInformation gathering framework for phone numbers
Awesome Threat IntelligenceA curated list of Awesome Threat Intelligence resources
MISP taxonomies and classificationTags to organize information on “threat intelligence including cyber security indicators, financial fraud or counter-terrorism information.”
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.