SpiderFoot

SpiderFoot automates the boring middle of an investigation. You give it a target (a domain, IP, email, or name) and it runs 200+ modules against public sources, then links whatever came back. The open-source project is smicallef/spiderfoot. You run it locally. There is a web UI in front of the engine. A hosted commercial version has existed under the SpiderFoot HX name. This listing is the GitHub tool.

What it is good at

Attack-surface and threat-intel sweeps where the target is an organization, not a single handle. One scan can pull DNS, certificates, paste hits, breach mentions, social leftovers, and a lot of junk, then show you how those facts connect. That graph is the reason to use it instead of twenty cron jobs.

What it costs you anyway

Setup. API keys. Disk. Time. A first scan on a lively domain will produce more rows than you can read this afternoon. You will spend the second afternoon turning modules off. That is the free-tool tax, and it is why SpiderFoot is in the directory as a workshop, not a Gem.

If I need one email turned into a footprint by lunch, I use IntelBase. If I need a domain’s public attack surface mapped and I already have a box to run it on, I use SpiderFoot.

Read the current docs for the install path. People still publish tutorials against old branches.