SpiderFoot Commands Cheat Sheet (2026): Step-by-Step CLI Tutorial

Quick answer: The core SpiderFoot command is python3 sf.py. Use -l 127.0.0.1:5001 to start the web UI, -s TARGET to scan from the terminal, -u passive|footprint|investigate|all to choose a use case, -m to pick modules, -t to collect specific data types, and -o csv|json|tab to set the output format. On Kali, replace python3 sf.py with spiderfoot.

The SpiderFoot web interface is great for exploring results, but the command line is where you get speed and automation. With a few flags you can run targeted scans, save results straight to a file, and plug SpiderFoot into scripts and pipelines. This tutorial explains every important SpiderFoot command with real, copy-and-paste examples.

Before You Start

• SpiderFoot must be installed. If not, follow our SpiderFoot install guide or the Kali Linux guide.
• Run commands from the SpiderFoot folder, with your virtual environment active (source venv/bin/activate).
• Only scan targets you own or have permission to test. Examples below use example.com.

SpiderFoot Commands Cheat Sheet

1. Start the Web Interface

python3 sf.py -l 127.0.0.1:5001

Open http://127.0.0.1:5001. To reach it from another machine on a trusted network, use -l 0.0.0.0:5001. Busy port? Use -l 127.0.0.1:5002.

2. Run a Scan From the Terminal

python3 sf.py -s example.com -u passive

This runs a passive scan and prints every result to the terminal. Swap passive for footprint, investigate or all. Not sure which to use? Our SpiderFoot beginner tutorial explains each use case.

3. Save Results to a File

# CSV for Excel or Google Sheets
python3 sf.py -s example.com -u passive -o csv -q > example.csv

# JSON for scripts and other tools
python3 sf.py -s example.com -u passive -o json -q > example.json

-q keeps log lines out of your file so the output stays clean.

4. Run Only Specific Modules

# List every module first
python3 sf.py -M

# Then run just the ones you need
python3 sf.py -s example.com -m sfp_dnsresolve,sfp_crt,sfp_whois

Hand-picking modules makes scans much faster. See what each one does in our SpiderFoot modules and data sources guide.

5. Collect Only the Data You Want

# List every event type
python3 sf.py -T

# Find email addresses for a domain, and show only emails
python3 sf.py -s example.com -t EMAILADDR -f

# Find subdomains only
python3 sf.py -s example.com -t INTERNET_NAME -f -o csv -q > subdomains.csv

When you use -t, SpiderFoot automatically enables the modules that can produce those data types. Add -x (strict mode) to limit it further.

6. Real-World Command Recipes

Check your email for breaches and exposure

python3 sf.py -s you@example.com -u passive -o csv -q > my-email.csv

Investigate a suspicious IP address

python3 sf.py -s 203.0.113.10 -u investigate -o json -q > ip-check.json

Map a company’s external footprint

python3 sf.py -s example.com -u footprint -max-threads 5 -o csv -q > footprint.csv

Look up a username across sites

python3 sf.py -s "johndoe123" -u passive -o tab

Tip: wrap usernames and human names in quotes so SpiderFoot reads them correctly. Learn every supported input in our SpiderFoot target types guide.

7. Use the Interactive CLI (sfcli.py)

SpiderFoot also includes an interactive shell that talks to a running SpiderFoot server. It is handy when SpiderFoot runs on a remote box.

# Terminal 1: start the server
python3 sf.py -l 127.0.0.1:5001

# Terminal 2: connect the CLI
python3 sfcli.py -s http://127.0.0.1:5001

Inside the shell, type help to see commands. Useful ones include ping, modules, types, scans, start, stop, summary, data, logs and export. On Kali the same tool is installed as spiderfoot-cli.

8. Automate SpiderFoot Scans

Because the CLI writes to standard output, you can schedule scans with cron (Linux/macOS) or Task Scheduler (Windows). A simple daily passive scan on Linux:

0 2 * * * cd /home/user/spiderfoot && ./venv/bin/python3 sf.py -s example.com -u passive -o csv -q > /home/user/reports/example-$(date +\%F).csv

Compare reports over time to spot new subdomains, IPs or leaks. For more workflows, read our SpiderFoot OSINT automation guide.

Web UI vs Command Line: When to Use Each

More detail in SpiderFoot web interface vs command-line mode.

Command Troubleshooting

• “No module named …” – activate your venv and reinstall requirements.
• Scan prints nothing – remove -q to see logs, or add -d for debug output.
• Too much output – use -t with -f, or -F to filter.
• Very slow – avoid -u all, pick modules with -m, and lower -max-threads.

For install and runtime errors, see fixing SpiderFoot errors.

Frequently Asked Questions

Conclusion

You only need a handful of SpiderFoot commands to work fast: -l for the web UI, -s with -u for quick scans, -m and -t to focus, and -o with -q to save clean reports. Add sfcli.py and a cron job, and SpiderFoot becomes an automated OSINT engine that runs while you sleep.