Spiderfoot

0f815a2

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

Verified 24 Sept 2026
git 0f815a2
MIT
22k stars

Source on GitHub · Pinned commit · Markdown

Install and run

DomainIP address

otlite install spiderfoot
Installs github.com/smicallef/spiderfoot at 0f815a2 into its own virtualenv. otlite lists what it will install and asks before it starts.
otlite run spiderfoot -- d:example.com
python sf.py receives python sf.py -u passive -s example.com
otlite run spiderfoot -- ip:192.0.2.1
python sf.py receives python sf.py -u passive -s 192.0.2.1

No otlite yet? Install it in one line

curl -fsSL https://get.otinstaller.com/otlite | sh

Linux and macOS, no Docker. It uses your Python and pipx when both are there, and otherwise brings its own Python. About otlite · otlite docs

Before you run it

Needs Python older than 3.13. Its pinned lxml and cryptography have no wheels for 3.13 or newer. otlite checks your Python before installing and says which version to use; otlite doctor lists the tools your Python can't run.

What it takes

Typed inputs after -- become Spiderfoot's own arguments. Anything else after -- passes through unchanged, so every option of the tool still works.

Input	With otlite	`python sf.py` receives
Domain`d:`	`otlite run spiderfoot -- d:example.com`	`python sf.py -u passive -s example.com`
IP address`ip:`	`otlite run spiderfoot -- ip:192.0.2.1`	`python sf.py -u passive -s 192.0.2.1`

otlite always passes -u passive first.

What a run leaves

Every run is saved under results/ where you run otlite (or --output, or OTLITE_RESULTS_DIR): what the tool printed, a sidecar with how it ran, and an envelope.

results/spiderfoot/example.com/<time>_spiderfoot_example.com_<run id>.txt
results/spiderfoot/example.com/<time>_spiderfoot_example.com_<run id>.meta.json
results/spiderfoot/example.com/<time>_spiderfoot_example.com_<run id>.envelope.json

{
  "envelope": 1,
  "tool": "spiderfoot@0f815a2",
  "runtime": "otlite",
  "input": { "target": "example.com" },
  "case": null,
  "started_at": "…", "ended_at": "…", "duration_ms": …,
  "exit_code": 0,
  "status": "complete",
  "entities": [{ "type": "url", "value": "…" }, …],
  "warnings": [],
  "output": { "path": "results/spiderfoot/example.com/<time>_spiderfoot_example.com_<run id>.txt", "sha256": "…", "bytes": … }
}

The envelope's shape, the same for every tool; values elided. Its entities are the emails, domains, IP addresses and URLs found in the output, or the tool's own when it prints them.

otlite results --tool spiderfoot

otlite extract spiderfoot

otlite diff spiderfoot example.com

List the saved runs, pull out every indicator, or compare the two latest runs against the same target.

With other tools

These run it with every other installed tool that takes the same input, a few at a time, and save each run:

otlite run --all d:example.com

otlite auto example.com

Related tools

All 47 tools →