# Spiderfoot (otlite)

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

- Takes: Domain, IP address, Username, Email
- Install: `otlite install spiderfoot`, into its own virtualenv
- Pinned: [github.com/smicallef/spiderfoot at 0f815a2](https://github.com/smicallef/spiderfoot/tree/0f815a203afebf05c98b605dba5cf0475a0ee5fd)
- Command: `python sf.py`
- Python: older than 3.13
- Verified: 24 Sept 2026, version 0f815a2 on Ubuntu 26.04 LTS, Python 3.12.14
- Licence: MIT; 22,469 GitHub stars
- Source: https://github.com/smicallef/spiderfoot

otlite is the no-Docker edition of OTInstaller for Linux and macOS: [install it](https://otinstaller.com/otlite) with `curl -fsSL https://get.otinstaller.com/otlite | sh`.

## Run it

| Input | otlite command | Spiderfoot receives |
| --- | --- | --- |
| Domain | `otlite run spiderfoot -- d:example.com` | `python sf.py -u passive -s example.com` |
| IP address | `otlite run spiderfoot -- ip:192.0.2.1` | `python sf.py -u passive -s 192.0.2.1` |

Arguments after `--` that aren't typed inputs go to the tool unchanged.

## Before you run it

- **Needs Python older than 3.13.** Its pinned lxml and cryptography have no wheels for 3.13 or newer. otlite checks your Python before installing and says which version to use; `otlite doctor` lists the tools your Python can't run.

## What a run leaves

- `results/spiderfoot/example.com/<time>_spiderfoot_example.com_<run id>.txt`
- `results/spiderfoot/example.com/<time>_spiderfoot_example.com_<run id>.meta.json`
- `results/spiderfoot/example.com/<time>_spiderfoot_example.com_<run id>.envelope.json`

The envelope is the same shape for every tool: the tool and version, the input, timing, exit code and status, the emails, domains, IP addresses and URLs found in the output, and the output file's path, hash and size. `otlite results --tool spiderfoot` lists saved runs, `otlite extract spiderfoot` pulls out indicators and `otlite diff spiderfoot example.com` compares the two latest runs.

## With other tools

`otlite run --all d:example.com` and `otlite auto example.com` run it with every other installed tool that takes the same input.

## Related tools

- [Secator](https://otinstaller.com/otlite/tools/secator.md): secator - the pentester's swiss knife
- [Fsociety](https://otinstaller.com/otlite/tools/fsociety.md): A Modular Penetration Testing Framework
- [Openosint](https://otinstaller.com/otlite/tools/openosint.md): AI-powered OSINT agent with interactive REPL, MCP server, and direct CLI modes
- [Bbot](https://otinstaller.com/otlite/tools/bbot.md): The recursive internet scanner for hackers
- [Blackbird](https://otinstaller.com/otlite/tools/blackbird.md): OSINT tool to search for accounts by username and email across social networks
- [Dnstwist](https://otinstaller.com/otlite/tools/dnstwist.md): Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

[All 47 otlite tools](https://otinstaller.com/otlite/tools) · [otlite docs](https://otinstaller.com/docs/otlite.md)