01 · Product name
SpiderFoot
Automated OSINT from a local web UI and hundreds of modules.
Published by Steve Micallef.
In short
SpiderFoot automates OSINT collection. You give it a domain, email, name, or address, and modules query public sources, then correlate the results in a local web interface. The open-source edition is free and self-hosted. SpiderFoot HX is the commercial hosted product. It is a framework, not a single-purpose search box.
Product pricing strategy
02
Free and paid
SpiderFoot is free to start and paid when you need more. The free tier is the on-ramp. Volume, locked filters, private scans, or an API are what paid plans usually add. Confirm the current split on the vendor site. This listing does not invent a dollar amount.
The open-source edition is free and self-hosted. SpiderFoot HX is a paid product. Third-party modules may need their own API keys.
Utility and features
03
Steve Micallef’s SpiderFoot is the practical answer to “I do not want to open forty tabs.” You start a scan, pick modules, and come back to a correlated set: usernames, emails, hosts, leaked credentials mentioned by other sources, and co-hosted sites. The correlation is the point. A raw module hit is still just a hit.
- Modules. Hundreds of modules, many of which call external APIs. A scan with every module enabled is slow and noisy. Enable the ones that match the question.
- Correlation. SpiderFoot links results that share an indicator. Use that to see clusters, then verify anything you plan to repeat in a report.
- Editions. Open source is self-hosted and free. HX is the commercial offering. API keys for data sources are your accounts either way.
The open-source server runs on your machine. That keeps queries off a vendor’s multi-tenant history, and it means you are responsible for keys, updates, and what the modules send. HX is the paid path if you want it hosted and supported. Recon-ng occupies the same shelf with a console instead of a web UI. Maltego is the better next step when the output should be a graph you will present.
- 1
Run the open-source build locally and open the web UI it serves.
- 2
Start with a domain or email you are allowed to investigate and a short module list.
- 3
Read correlations after the scan, and open the underlying source before you cite a row.
- 4
Export what you keep. A scan database on a laptop is still case material.
Caveats
04
SpiderFoot automates collection. It does not confirm it. Modules break, keys expire, and a free scan can be noisy. There is a free edition and paid hosted options. This listing does not invent the current price split. Check the project site.
Correlated data still has a source. Open that source before you treat a row as a fact. A scan of a domain you do not administer can violate the terms of the upstream APIs and your own rules of engagement. Pick modules on purpose.
Screenshots
05
Potential use cases
06
- You need a first pass on a domain without driving every source by hand. Start a SpiderFoot scan with a module set you can name, aimed at a target you are allowed to examine. The output is a correlated list of emails, names, and hosts, each tied to the module that found it. Pivot anything you will rely on into the single-purpose tool: Amass or Subfinder for names, Sherlock for a username, Have I Been Pwned for a breach. A module hit is only as current as that module’s source.
- After a module update, re-run the same narrow scan and diff the export. You learn what the new module added, not a new truth about the company. Keep the scan configuration with the export. SpiderFoot can call many sources, including ones that need API keys. A keyless module that returns nothing is an empty source, not a negative finding.
- Use the result to decide which specialist tool you still have to open. If the graph is mostly search-engine emails, go to theHarvester or Hunter and read those pages. If it is mostly hostnames, go to Amass. Do not brief the SpiderFoot summary as if every row were confirmed.
Hard cases
The case where the first result is easy to over-read.
The correlation looks like a person
SpiderFoot attaches an email, a username, and a phone number to one company because separate modules returned them. They may not belong to one human. Open each module’s raw result, keep the rows you can verify, and throw out the ones that only share a brand string. Then run the surviving username through Sherlock or Maigret and the email through Holehe, and write which tool produced which fact.
Questions
Is SpiderFoot free?
The open-source edition is free and self-hosted. SpiderFoot HX is a paid product. Third-party modules may need their own API keys.
Does SpiderFoot phone home with your scans?
The open-source app runs on your host. Modules you enable will query the external services they wrap. Read the module if the data is sensitive.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
SpiderFoot
https://www.spiderfoot.net/Documentation
SpiderFoot README
https://github.com/smicallef/spiderfoot/blob/master/README.md