Ultimate SpiderFoot Cheat Sheet

Samir KC

September 08, 2026 September 08, 2026

Ultimate SpiderFoot Cheat Sheet

Automated OSINT and threat intelligence platform. 200+ modules for reconnaissance, attack surface mapping, and vulnerability discovery.

1. Basic Usage

Launch SpiderFoot and start scanning targets.

Launch Web Interface

spiderfoot -l 127.0.0.1:5001

Access via browser at http://127.0.0.1:5001

Command Line Scan

spiderfoot -s example.com

Show Version

spiderfoot -V

List All Modules

spiderfoot -M

Launch Options

-l <host:port> : Web server
-s <target> : CLI scan
-M : List modules
-V : Show version
-h : Help menu

Quick Examples

spiderfoot -l 0.0.0.0:8080
spiderfoot -s tesla.com
spiderfoot -M | grep shodan
spiderfoot -V

2. CLI Scanning

Basic Scan

spiderfoot -s example.com

Scan with Specific Modules

spiderfoot -s example.com -m sfp_shodan,sfp_crt,sfp_dns

Scan with Output File

spiderfoot -s example.com -o results.json

Scan with Multiple Output Formats

spiderfoot -s example.com -o results.json -o results.csv -o results.html

Quiet Mode

spiderfoot -s example.com -q

Debug Mode

spiderfoot -s example.com -d

Flag	Description	Example
`-s <target>`	Target to scan	`-s example.com`
`-m <modules>`	Specific modules	`-m sfp_dns,sfp_crt`
`-o <file>`	Output file	`-o results.json`
`-q`	Quiet mode	`-q`
`-d`	Debug mode	`-d`
`-n`	No module threading	`-n`

3. Module Selection

List Modules by Category

spiderfoot -M | grep "DNS"

List Module Details

spiderfoot -M sfp_shodan

Use All Modules

spiderfoot -s example.com -m all

Use Modules by Category

spiderfoot -s example.com -m recon,dns,ssl

Exclude Modules

spiderfoot -s example.com -m all -x sfp_tor,sfp_cybercrimetracker

Module Category	Description	Example Modules
`DNS`	DNS enumeration	`sfp_dns, sfp_dnsbrute`
`SSL/TLS`	Certificate analysis	`sfp_crt, sfp_sslcert`
`Search Engines`	Search engine queries	`sfp_google, sfp_bing`
`Threat Intel`	Threat intelligence	`sfp_virustotal, sfp_alienvault`
`Social Media`	Social media recon	`sfp_linkedin, sfp_twitter`
`Network`	Network scanning	`sfp_portscan, sfp_nmap`
`Email`	Email discovery	`sfp_email, sfp_hunter`
`Leaks`	Data leak search	`sfp_pastebin, sfp_github`

Pro Tip: Module Configuration
Configure API keys in ~/.spiderfoot/spiderfoot.db or via web interface:
Settings → Modules → Shodan → API Key
Settings → Modules → VirusTotal → API Key
Settings → Modules → AlienVault → API Key
Settings → Modules → GitHub → Token

4. Target Types

Domain Name

spiderfoot -s example.com

IP Address

spiderfoot -s 192.168.1.10

Subnet

spiderfoot -s 192.168.1.0/24

Email Address

spiderfoot -s user@example.com

Phone Number

spiderfoot -s "+1234567890"

Person Name

spiderfoot -s "John Smith"

URL

spiderfoot -s https://example.com/page

Target Types

DOMAIN_NAME : example.com
IP_ADDRESS : 192.168.1.10
NETBLOCK : 192.168.1.0/24
EMAILADDR : user@example.com
PHONE_NUMBER : +1234567890

Special Targets

HUMAN_NAME : John Smith
USERNAME : jsmith
BITCOIN_ADDRESS : 1A1zP1...
URL : https://example.com

5. Web Interface

Start Web Server

spiderfoot -l 127.0.0.1:5001

Start on All Interfaces

spiderfoot -l 0.0.0.0:8080

With SSL

spiderfoot -l 0.0.0.0:443 --ssl --ssl-cert /path/to/cert.pem --ssl-key /path/to/key.pem

With Authentication

spiderfoot -l 0.0.0.0:8080 --username admin --password strongpass

Run as Daemon

nohup spiderfoot -l 0.0.0.0:8080 &

Web Interface Features

Interactive scan control
Real-time results viewer
Graph visualization
Report generation
Module configuration

Browser Access

http://localhost:5001
http://server:8080
https://server/
http://server/scan

Pro Tip: Web API
SpiderFoot provides a REST API:
curl http://localhost:5001/scan/new -d "target=example.com"
curl http://localhost:5001/scan/list
curl http://localhost:5001/scan/results/<scan-id>

6. Automation & API

Basic Automation Script

#!/bin/bash # spiderfoot-scan.sh - Automated scanning TARGET=$1 OUTPUT_DIR="spiderfoot-results" mkdir -p $OUTPUT_DIR echo "[+] Starting SpiderFoot scan..." spiderfoot -s $TARGET -m all -o $OUTPUT_DIR/results.json -o $OUTPUT_DIR/results.html echo "[+] Scan complete. Results in $OUTPUT_DIR/"

Multi-Target Script

#!/bin/bash # multi-scan.sh - Scan multiple targets while read -r target; do echo "[+] Scanning $target..." spiderfoot -s "$target" -m recon,dns,ssl -o "results-${target}.json" done < targets.txt

Python API Script

#!/usr/bin/env python3 # spiderfoot-api.py - Python API integration import requests import json BASE_URL = "http://localhost:5001" # Start scan response = requests.post(f"{BASE_URL}/scan/new", data={"target": "example.com", "modules": "sfp_dns,sfp_crt"}) scan_id = response.json()["scanId"] # Check status status = requests.get(f"{BASE_URL}/scan/status/{scan_id}") # Get results results = requests.get(f"{BASE_URL}/scan/results/{scan_id}") data = results.json() # Process results for item in data: if item["type"] == "DOMAIN_NAME": print(f"Found: {item['data']}")

Docker Automation

# Run SpiderFoot in Docker docker run -d -p 5001:5001 -v spiderfoot-data:/var/lib/spiderfoot spiderfoot/spiderfoot # Run one-off scan docker run --rm spiderfoot/spiderfoot -s example.com # With custom modules docker run --rm spiderfoot/spiderfoot -s example.com -m sfp_dns,sfp_crt

Cron Job Setup

# Daily scan at midnight 0 0 * * * /usr/local/bin/spiderfoot -s example.com -m all -o /var/log/spiderfoot/daily-$(date +\%Y\%m\%d).json # Weekly comprehensive scan 0 0 * * 0 /usr/local/bin/spiderfoot -s example.com -m all -o /var/log/spiderfoot/weekly-$(date +\%Y\%m\%d).json

Pro Tip: Docker Setup

Run SpiderFoot in Docker for isolation:
docker pull spiderfoot/spiderfoot
docker run -d -p 5001:5001 spiderfoot/spiderfoot
Access at http://localhost:5001

⇧

Reconnaissance & OSINT