otinstaller · Frameworks

Install SpiderFoot on Linux in one command

SpiderFoot runs two hundred-odd modules against a domain, IP, email, or username and links what they return into one graph. The CLI mode writes results to the terminal or a file; the web UI is optional.

SpiderFoot in three lines

pipx install otinstaller
ot install spiderfoot
ot run spiderfoot -- d:example.com

Runs smicallef/spiderfoot (MIT, ★ 22k, otinstaller v0.0.4, registry updated Oct 13, 2026). otinstaller installs and runs it; it does not change or verify it.

What SpiderFoot is for

Attack-surface mapping of a domain you are authorised to assess.
Pivoting from one seed into related hosts, emails, and names.
Passive-only runs (-u passive) when you must not touch the target.

Typed inputs for SpiderFoot

otinstaller translates these prefixes into SpiderFoot's own flags. Anything else after -- is passed through unchanged, so every original flag still works.

d:: domain · ot run spiderfoot -- d:example.com
u:: username · ot run spiderfoot -- u:jane_doe
e:: email · ot run spiderfoot -- e:jane@example.com

It also takes ip input through its own flags; there is no typed prefix for those yet.

Run every installed tool that takes the same input at once: ot run --all d:example.com

Where the results go

Every run lands under ./results/spiderfoot/<target>/ as a timestamped output file plus a .meta.json sidecar: the exact command, start and end time, exit code, and the SHA-256 of the output. Group runs with --case, compare the last two with ot diff spiderfoot <target>, and pull indicators out with ot extract.

Before you run it

Installed from git rather than PyPI, so the first install takes longer.
Many modules need their own API keys; without them SpiderFoot still runs but with fewer sources.
A full scan can run for hours. Start with a passive scan and a module subset.

Update, remove, inspect

ot info spiderfoot      # inputs, flags, keys
ot example spiderfoot   # sample output
ot update spiderfoot    # move to the next tested version
ot remove spiderfoot    # delete its virtualenv

Full reference for this tool: docs for spiderfoot.

Pairs with

BBOT

BBOT is a recursive scanner that starts from a domain or IP, discovers subdomains, hosts, and services, and feeds each finding back in as a new target.

FinalRecon

FinalRecon runs a set of web recon checks against a URL in one go: headers, SSL certificate, WHOIS, crawler, DNS, subdomains, directory search, and a port scan.

secator

secator wraps dozens of recon and scanning tools behind one command with a shared output format, and runs them as tasks, workflows, or full scans.

FAQ

SpiderFoot with otinstaller, answered

How do I install SpiderFoot on Kali or Ubuntu?

Install otinstaller once with pipx install otinstaller, run ot init, then ot install spiderfoot. The tool lands in its own virtualenv under ~/.otinstaller/, pinned to a version that was tested on Ubuntu, so nothing touches your system Python. ot doctor flags a missing git or venv module.

Which inputs does SpiderFoot take through otinstaller?

d: (domain), u: (username), e: (email). otinstaller maps each prefix to SpiderFoot's own flag. Everything after -- that is not a typed input is passed through unchanged, so the original flags still work.

Where does otinstaller save SpiderFoot results?

Under ./results/spiderfoot/<target>/ in the folder you run from, as a timestamped output file plus a .meta.json sidecar with the exact command, timing, exit code, and SHA-256. Add --case <name> to group runs, and ot diff spiderfoot <target> to compare the last two.

Does SpiderFoot need an API key or a login?

No key is required for the basic run. Many modules need their own API keys; without them SpiderFoot still runs but with fewer sources.

Can I run SpiderFoot together with other tools?

Yes. ot run --all d:example.com runs every installed tool that accepts domain input, in parallel, including SpiderFoot. Save the combination as a playbook to repeat it.