How to Install and Use SpiderFoot on Kali Linux (2026 Guide)

Quick answer: SpiderFoot is in the official Kali Linux repositories. Run sudo apt update && sudo apt install spiderfoot, start the web UI with spiderfoot -l 127.0.0.1:5001, and open http://127.0.0.1:5001 in Firefox. That is all you need for a working install in 2026.

SpiderFoot is an open-source OSINT (open-source intelligence) automation framework. You give it a target such as a domain, IP address, email address or username, and it runs 200+ modules to collect public data about it: subdomains, DNS records, leaked credentials, social profiles, hosting details, threat-intel hits and much more. It then links everything together so you can see how each finding connects.

Kali Linux is the most popular home for SpiderFoot because the tool is packaged, tested and ready to go. This guide shows you three ways to install it on Kali, how to run your first scan, the most useful commands, how to add API keys, and how to fix common problems.

Key Takeaways

• Easiest install: sudo apt install spiderfoot from the Kali repositories.
• Latest code: clone the GitHub repo and install it in a Python virtual environment.
• Isolated install: run SpiderFoot in Docker if you want no changes to your system Python.
• Default web UI: port 5001. The Kali package also includes spiderfoot-cli for terminal use.
• Start passive. Passive scans never touch the target directly and are the safest first step.

What Is SpiderFoot in Kali Linux?

SpiderFoot was created by Steve Micallef and is released under the MIT licence. The current open-source release is version 4.0. It is written in Python 3, stores results in a local SQLite database and gives you both a web interface and a command-line mode. A commercial cloud edition, SpiderFoot HX, was acquired by Intel 471 in 2022; this guide covers the free, open-source version that ships with Kali.

New to the tool? Read what SpiderFoot is and how it automates OSINT first, then come back here. For a full review with pros, cons and alternatives, see our SpiderFoot OSINT tool guide.

Main features

• 200+ modules covering DNS, WHOIS, search engines, certificate transparency, breach data, dark web (via Tor), social media and threat intelligence.
• Scan by use case: All, Footprint, Investigate and Passive profiles.
• Correlation engine with 37 built-in YAML rules that highlight risky findings automatically.
• Visual graph that maps relationships between data points.
• Exports to CSV, JSON and GEXF (for Gephi).
• Web UI and CLI, so it works on desktops, servers and headless boxes.

Before You Install: Requirements

Method 1 – Install SpiderFoot from the Kali Repository (Recommended)

This is the fastest and most stable option. Kali maintains the package, so dependencies are handled for you.

Step 1: Update Kali

sudo apt update && sudo apt full-upgrade -y

Step 2: Install SpiderFoot

sudo apt install -y spiderfoot

Some Kali images (for example those using the larger tool metapackages) already include it. Check with which spiderfoot.

Step 3: Start the web interface

spiderfoot -l 127.0.0.1:5001

Open http://127.0.0.1:5001 in Firefox. You will see the SpiderFoot dashboard with New Scan, Scans and Settings tabs.

Tip: To reach the UI from another machine on your lab network, bind to all interfaces with spiderfoot -l 0.0.0.0:5001. Only do this on a trusted network, and add authentication (see the security section below).

Method 2 – Install the Latest Version from GitHub

Use this if you want the newest code from the official SpiderFoot GitHub repository. On current Kali, pip refuses to install packages system-wide (the externally-managed-environment error), so always use a virtual environment.

sudo apt install -y git python3-venv python3-dev build-essential libxml2-dev libxslt1-dev
git clone https://github.com/smicallef/spiderfoot.git
cd spiderfoot
python3 -m venv venv
source venv/bin/activate
pip install --upgrade pip wheel setuptools
pip install -r requirements.txt
python3 sf.py -l 127.0.0.1:5001

If pip fails to build an old pinned library on a very new Python version, the repo package from Method 1 or Docker from Method 3 is the quickest way around it. Our SpiderFoot errors and fixes guide covers these build problems in detail.

Method 3 – Run SpiderFoot with Docker on Kali

Docker keeps SpiderFoot and its Python libraries isolated from the rest of Kali.

sudo apt install -y docker.io
sudo systemctl enable --now docker
git clone https://github.com/smicallef/spiderfoot.git
cd spiderfoot
sudo docker build -t spiderfoot .
sudo docker run -d -p 5001:5001 --name spiderfoot spiderfoot

Now open http://127.0.0.1:5001. Stop it with sudo docker stop spiderfoot and start it again with sudo docker start spiderfoot. For Windows and macOS Docker setups, see our SpiderFoot install guide for every platform.

Which Install Method Should You Pick?

How to Use SpiderFoot on Kali: Your First Scan

1. Go to New Scan.
2. Enter a scan name and a target (domain, IP, subnet, ASN, email, phone number, username, person name or Bitcoin address).
3. Choose By Use Case:
   • All – every module; slow and noisy.
   • Footprint – maps the target’s network perimeter and identity.
   • Investigate – looks for malicious indicators; good for threat checks.
   • Passive – no direct contact with the target; the safest start.
4. Click Run Scan Now.
5. Review results in the Summary, Browse, Correlations and Graph tabs, then export as CSV or JSON.

Not sure what to enter as a target? Our guide to the target types SpiderFoot can analyze explains each one with examples.

Essential SpiderFoot Kali Linux Commands

If you installed from GitHub, replace spiderfoot with python3 sf.py and spiderfoot-cli with python3 sfcli.py. For a deeper walkthrough with real examples, read Master SpiderFoot commands step by step.

Add API Keys for Better Results

Many modules work without keys, but free API keys add far more data. In the web UI, open Settings, pick a module, paste your key and click Save Changes. Good free-tier keys to start with:

• VirusTotal – malware and domain reputation
• Shodan – exposed services and open ports
• Hunter.io – email addresses linked to a domain
• SecurityTrails – historical DNS and subdomains
• AbuseIPDB – IP abuse reports
• Have I Been Pwned (paid key) – breach exposure

See the full list of SpiderFoot modules and data sources.

Troubleshooting SpiderFoot on Kali

Secure Your SpiderFoot Instance

• Keep the UI bound to 127.0.0.1 unless you really need remote access.
• For remote access, put it behind an SSH tunnel or a reverse proxy with HTTPS. SpiderFoot also supports basic web authentication through a passwd file in its data folder.
• Scan results may contain personal data. Store and delete them according to your client agreement and local law. Learn more in how secure SpiderFoot scan data is.

Where SpiderFoot Fits in a Kali Workflow

SpiderFoot is a reconnaissance tool. It is usually the first step before tools like Nmap, theHarvester, Amass or Burp Suite. Use it to build a map of the target’s public footprint, then move on to active testing only if you are authorised. Read our penetration testing methodology guide to see where OSINT fits, and how SpiderFoot helps both red teams and blue teams.

Frequently Asked Questions

Conclusion

Getting SpiderFoot running on Kali Linux takes one command: sudo apt install spiderfoot. Use the GitHub method when you need the newest code, and Docker when you want a clean, isolated setup. Start with Passive scans, add a few free API keys, and let the correlation engine point you to the findings that matter.

Want to run it on your phone too? Follow our SpiderFoot Termux install guide, or start from the basics with our SpiderFoot tutorial for beginners.