SpiderFoot Tutorial: OSINT Information Gathering in Kali Linux

In cybersecurity, collecting information about a target is a crucial first step before starting security analysis or penetration testing. Traditionally, this process can be time-consuming, requiring analysts to manually search through multiple sources to find details such as domains, IP addresses, email addresses, usernames, and other publicly available data.

Instead of searching everywhere one by one, what if a single tool could automate the process?

This is where SpiderFoot becomes useful.

SPIDERFOOT

SpiderFoot is a free and open-source OSINT (Open Source Intelligence) tool used for reconnaissance and information gathering. It helps security professionals collect data about a target from many different sources, such as DNS records, Whois information, IP addresses, email addresses, social media, data breaches, open ports, and vulnerabilities. By automating these searches, SpiderFoot can quickly build a detailed profile of a target with less manual work.

In this blog, we will learn how to use the SpiderFoot tool in Kali Linux step by step

**Step 1:** Open the terminal in Kali Linux and run the following command as shown in the image below:

Let’s understand what each part of this command means:

• sudo - Stands for “Super User Do.” It runs the command with administrator (root) privileges.
• spiderfoot - The name of the tool we are launching.
• -l -This option tells SpiderFoot to listen on a specific IP address and port.
• 127.0.0.1- It is a special, reserved IPv4 network address used by computers to communicate with themselves
• 800 - This is the port number used to access the SpiderFoot web interface through a browser.

Step 2: After running the command, SpiderFoot will start successfully, and the terminal output will appear as shown in the image below. You will see a browser link displayed in the terminal. Open or click on this link to access the SpiderFoot web interface in your browser.

When you click the browser link, it will redirect you to the SpiderFoot webpage, as shown in the image below.

From this page, click on the Settings option to open the configuration page.

Step 3: Once the Settings page is opened, you will see multiple third-party API options, as shown in the image below.

SpiderFoot uses these APIs to collect more detailed information during scans. Instructions for configuring each API key are provided within the settings page itself.

Follow the instructions shown for each API, generate or copy the required API key, and paste it into the corresponding field in SpiderFoot. After adding each API key, make sure to click Save to store the changes. Some APIs are free, while others require a paid subscription. For this setup, you only need to configure the free API keys.

For example, in the next step, we will see how to add an API key using AbstractAPI.

Step 4: First, open your browser and search for “AbstractAPI” on Google. Open the official website and click Start for Free. You can create an account or sign in using your Google account. After signing in, you will be redirected to the dashboard.

From the dashboard, we need to collect three API keys for SpiderFoot:

i. AbstractAPI Company Enrichment API Key Go to Other Products → Company Enrichment. Copy the API key and paste it into the corresponding field in SpiderFoot.

ii. AbstractAPI IP Geolocation API Key Go to IP Intelligence. Copy the IP Geolocation API Key and paste it into SpiderFoot.

iii. AbstractAPI Phone Validation API Key Go to Phone Intelligence. Copy the Phone Validation API Key and paste it into the appropriate field in SpiderFoot.

After adding the required API keys, click Save to apply the changes. Similarly, configure the remaining API keys by following the instructions provided for each one.

Step 5: Once the setup is complete, go to the New Scan section. Enter a Scan Name of your choice and provide the Scan Target you want to investigate, such as a domain name, IP address, email address, or username. After filling in the details, click “Run Scan” Now to start the scan.

After clicking Run Scan Now, SpiderFoot will begin the scanning process, as shown in the image above. Depending on the target and selected modules, the scan may take a few minutes to complete. Once the scan is finished, the results will be displayed on the dashboard, similar to the image shown below.

Once the scan is finished, SpiderFoot will display the results on the dashboard, similar to the images shown below. You can explore different sections such as Summary, Correlations, Browse, Graph, and Logs to analyze the collected information. The results may include details related to domains, IP addresses, email addresses, DNS records, vulnerabilities, and other OSINT data discovered during the scan.

This is all about SpiderFoot and how to use it in Kali Linux for OSINT reconnaissance and information gathering. SpiderFoot makes the process easier by automating data collection from multiple sources in one place.

Thank you for reading, and I hope you learned something useful from this blog!