Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Recon

Correlate OSINT events from one seed target

Automated OSINT modules for attack surface mapping.

Agent
Map a target's full footprintRun targeted, stealthy collectionCollect specific event types

overview

What spiderfoot does

In a Trickest workflow, spiderfoot takes a -s seed (domain, IP, host, or email) and writes a file plus a folder of correlated events.

Reach for it when one seed should fan across many passive sources, not when you only need subdomain names.

Select modules with -m, use cases with -u, event types with -t, or strict -x so only consumers of the seed type run. Many modules need keys in --config.

source github.com/smicallef/spiderfoot

use cases

Where spiderfoot fits

Map a target's full footprint

Run a broad module set against a domain to collect subdomains, IPs, related hosts, leaked data, and infrastructure into one correlated dataset.

Run targeted, stealthy collection

Use -x strict mode so only modules that consume your target type directly fire, keeping the run quiet and the results focused.

Collect specific event types

Select the event types you care about with -t and let spiderfoot enable the modules that produce them, instead of running everything.

Feed enrichment and reporting

Emit JSON or CSV with -o and route spiderfoot events into a downstream pipeline that dedupes, enriches, and reports on the surface it found.

reference

spiderfoot inputs and flags

17 inputs
NameTypeFlagDescription
targetSTRING-sTarget for the scan, such as a domain, IP, host, or email.
modulesSTRING-mModules to enable (mod1,mod2,...).
use-caseSTRING-uSelect modules automatically by use case.
event-typesSTRING-tEvent types to collect; modules are selected automatically (type1,type2,...).
output-formatSTRING-oOutput format: tab (default), csv, or json.
strict-modeBOOLEAN-xOnly enable modules that can directly consume your target. Overrides -t and -m.
configFILE--configAPI config file for module credentials.
max-threadsSTRING-max-threadsMax number of modules to run concurrently.

Showing key inputs. spiderfoot exposes 17 inputs in total.

Full flag reference (17 inputs)
NameTypeFlagDescription
debugBOOLEAN--debugEnable debug output.
configFILE--configAPI config file
filterBOOLEAN-fFilter out other event types that weren't requested.
targetSTRING-sTarget for the scan.
modulesSTRING-mModules to enable (mod1,mod2,...).
use-caseSTRING-uSelect modules automatically by use case
delimiterSTRING-DDelimiter to use for CSV output. Default is ,.
max-lengthSTRING-SMaximum data length to display. By default, all data is shown.
no-headersBOOLEAN-HDon't print field headers, just data.
event-typesSTRING-tEvent types to collect; modules selected automatically (type1,type2,...).
max-threadsSTRING-max-threadsMax number of modules to run concurrently.
strict-modeBOOLEAN-xOnly enable modules that can directly consume your target, and if -t was specified only those events will be consumed by modules. This overrides -t and -m
output-formatSTRING-oOutput format. Tab is default. (tab,csv,json)
include-sourceBOOLEAN-rInclude the source data field in tab/csv output.
strip-newlinesBOOLEAN-nStrip newlines from data.
disable-loggingBOOLEAN-qDisable logging. This will also hide errors!
show-event-typesSTRING-FShow only a set of event types, comma-separated.

example

Run spiderfoot

spiderfoot · command
# spiderfoot: footprint use-case against example.com, JSON outspiderfoot -s example.com -u footprint -o json -x -max-threads 8
sample output
example.comwww.example.comapi.example.commail.example.comstaging.example.comdev.example.com198.51.100.10203.0.113.25

guidance

Choosing spiderfoot

Use spiderfoot when a single seed should gather correlated OSINT across many sources. For passive subdomain names alone, prefer subfinder. Expect heavier runs, and supply API keys via --config for modules that need them.

subfinder

Passive subdomain names only. spiderfoot covers more event types at higher cost.

amass

DNS and infrastructure mapping. spiderfoot reaches further into non-DNS OSINT sources.

faq

spiderfoot questions

Domains, IP addresses, hostnames, subnets, emails, and names, among others. Pass the seed with -s and modules pick up the target types they can consume.

related

More Recon tools

  1. amass

    Multi-source subdomain discovery; hand names to httpx.

  2. amass-intel

    OWASP Amass intel: map an organization's root domains and ranges.

  3. assetfinder

    Find domains and subdomains potentially related to a given domain.

  4. bbot

    Modular OSINT recon that chains modules from a seed target.

  5. bevigil

    CLI client for the BeVigil OSINT API, keyed by domain or app package.

  6. cloud-enum

    Multi-cloud public name enumeration for AWS, Azure, and GCP.

Run spiderfoot yourself

A target feeds spiderfoot, which runs its OSINT modules and writes the correlated findings as a queryable output.

Open spiderfoot in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.