Skip to main content Link Menu Expand (external link) Document Search Copy Copied

osint / spiderfoot

1. SpiderFoot Install

2. SFCLI \ Execution

#? memo osint spiderfoot
#
#? run docker spiderfoot
docker run -p 5002:5001 -d spiderfoot

#? list sfcli modules
cd /usr/share/spiderfoot
python3 ./sf.py -M |grep -i dns

#? run/connect sfcli with docker
cd /usr/share/spiderfoot
python3 ./sfcli.py -s http://localhost:5002

# check memo osint sfcli

3. SFCLI \ Getting Started

Watch the tutorial video HERE.

#? memo osint sfcli
#
# test connectivity
sf> ping

#? scan dns
sf> start jmvwork.xyz -m sfp_dnsgrep,sfp_dnsraw,sfp_dnsdumpster,sfp_dns_brute

#? scan crt and dns #!VERBOSE
sf> start jmvwork.xyz -m sfp_crt

# sfcli - scan - start example 2
sf> start jmvwork.xyz -m sfp_dns,sfp_spider,sfp_pwned -n "blabla"

#? check typosquatting
sf> start jmvwork.xyz -m sfp_similar

# sfcli - scan - progression watch - with the scan ID <sid>
sf> logs <sid> -w

# sfcli - scan - information status
sf> scaninfo <sid>

# sfcli - scan - get data collected
sf> data <sid> -t IP_ADDRESS

# sfcli - list all scans 
sf> scans

# sfcli - scan - delete by its <sid>
sf> delete <sid>

4. SFCLI \ Module Shodan

Watch the tutorial video HERE.

# sfcli shodan - checking the settings 
sf> set | str shodan

# sfcli shodan - set the API key <apikey>
sf> set module.sfp_shodan.api_key = <apikey>

# sfcli shodan - start a scan
sf> start 1.2.3.4 -m spf_shodan

5. SFCLI \ Module HaveIBeenPwned

Watch the tutorial video HERE.

# sfcli HIBP - start a scan
sf> start elon@testla.com -m sfp_pwned -w

# sfcli HIBP - scan - get data collected
sf> data <sid> -t EMAILADDR_COMPROMISED

6. SFCLI \ Module DNSrecon

Watch the tutorial video HERE.

# sfcli DNSRecon - start a scan
sf> start elon@testla.com -m sfp_dnsbrute,sfp_dnsresolve -r

7. SFCLI \ Module CRT

Watch the tutorial video HERE.

# sfcli crt - start a scan
sf> start tesla.com -m sfp_crt -q -F INTERNET_NAME

8. SFCLI \ Module whatcms

# sfcli whatcms - checking the settings 
sf> set | str whatcms

# sfcli whatcms - set the API key <apikey>
sf> set module.sfp_whatcms.api_key = <apikey>

# sfcli whatcms - start a scan
sf> start tesla.com -m sfp_whatcms