Run any Skill in Manus with one click

performing-osint-with-spiderfoot

Stars29

Forks5

UpdatedJuly 3, 2026 at 16:58

Automate OSINT collection using SpiderFoot REST API and CLI for target profiling, module-based reconnaissance, and structured result analysis across 200+ data sources

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

26zl

26zl/cybersec-toolkit

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

File Explorer

4 files

SKILL.md

readonly

name	performing-osint-with-spiderfoot
description	Automate OSINT collection using SpiderFoot REST API and CLI for target profiling, module-based reconnaissance, and structured result analysis across 200+ data sources
domain	cybersecurity
subdomain	threat-intelligence
tags	["osint","spiderfoot","reconnaissance","threat-intelligence","attack-surface","target-profiling"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]
mitre_attack	["T1591","T1592","T1593","T1589","T1595"]

Performing OSINT with SpiderFoot

Overview

SpiderFoot is an open-source OSINT automation tool with 200+ modules that integrates with data sources for threat intelligence and attack surface mapping. This skill uses the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) to create and manage scans, select modules by use case (footprint, investigate, passive), parse structured results for domains, IPs, email addresses, leaked credentials, and DNS records, and generate target intelligence profiles.

When to Use

When conducting security assessments that involve performing osint with spiderfoot
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

SpiderFoot 4.0+ installed or SpiderFoot HX cloud account
Python 3.8+ with requests library
SpiderFoot server running on default port 5001
Optional: API keys for VirusTotal, Shodan, HaveIBeenPwned modules

Steps

Connect to SpiderFoot REST API or use CLI interface
Create a new scan with target specification (domain, IP, email, name)
Select scan modules by use case (all, footprint, investigate, passive)
Monitor scan progress via API polling
Retrieve and parse scan results by data element type
Extract key findings: subdomains, IPs, emails, leaked credentials
Generate structured OSINT intelligence report

Expected Output

JSON report containing OSINT findings organized by data type (domains, IPs, emails, credentials, DNS records), module source attribution, and target profile summary with risk indicators.

More from this repository

same repository

building-incident-response-dashboard

26zl/cybersec-toolkit

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.

2026-07-0329

configuring-suricata-for-network-monitoring

26zl/cybersec-toolkit

Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms for centralized security monitoring.

2026-07-0329

detecting-credential-dumping-techniques

26zl/cybersec-toolkit

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules

2026-07-0329

implementing-cloud-security-posture-management

26zl/cybersec-toolkit

Implementing Cloud Security Posture Management (CSPM) to continuously monitor multi-cloud environments for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, AWS Security Hub, Azure Defender, and GCP Security Command Center.

2026-07-0329

performing-memory-forensics-with-volatility3

26zl/cybersec-toolkit

Analyze volatile memory dumps using Volatility 3 to extract running processes, network connections, loaded modules, and evidence of malicious activity.

2026-07-0329

analyzing-android-malware-with-apktool

26zl/cybersec-toolkit

Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source recovery, and androguard for permission analysis, manifest inspection, and suspicious API call detection.

2026-06-1429

name	performing-osint-with-spiderfoot
description	Automate OSINT collection using SpiderFoot REST API and CLI for target profiling, module-based reconnaissance, and structured result analysis across 200+ data sources
domain	cybersecurity
subdomain	threat-intelligence
tags	["osint","spiderfoot","reconnaissance","threat-intelligence","attack-surface","target-profiling"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]
mitre_attack	["T1591","T1592","T1593","T1589","T1595"]

Performing OSINT with SpiderFoot

Overview

When to Use

When conducting security assessments that involve performing osint with spiderfoot
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

SpiderFoot 4.0+ installed or SpiderFoot HX cloud account
Python 3.8+ with requests library
SpiderFoot server running on default port 5001
Optional: API keys for VirusTotal, Shodan, HaveIBeenPwned modules

Steps

Connect to SpiderFoot REST API or use CLI interface
Create a new scan with target specification (domain, IP, email, name)
Select scan modules by use case (all, footprint, investigate, passive)
Monitor scan progress via API polling
Retrieve and parse scan results by data element type
Extract key findings: subdomains, IPs, emails, leaked credentials
Generate structured OSINT intelligence report

Expected Output

JSON report containing OSINT findings organized by data type (domains, IPs, emails, credentials, DNS records), module source attribution, and target profile summary with risk indicators.