SpiderFoot packs more than 200 modules into a Python-based OSINT tool that you can run from a built-in web server or straight at the command line. It pulls data from sources like SHODAN, HaveIBeenPwned, GreyNoise and AlienVault OTX, and it’ll export results as CSV, JSON or GEXF. Under the hood sits a YAML-driven correlation engine with 37 pre-built rules that link findings—say a leaked email address to a related domain or vulnerable subdomain. If you need dark-web sweeps, Tor integration is ready; if you want buckets, it’ll crack open S3, Azure or DigitalOcean for you. Install needs Python 3.7+, pip-installable dependencies and a quick wget or git clone. Point sf.py at localhost:5001 and you’re live. Results land in a SQLite backend, ready for custom SQL queries or visualizations out of the box. You can chain SpiderFoot to Nmap, CMSeeK or DNSTwist for port scans, banner grabs or typo-domain checks without leaving the interface. Everything’s MIT-licensed and fully documented, with Docker support if you prefer containerized deployments. On the enterprise side, SpiderFoot HX lives in the cloud and drops in extra tools—Splunk, ElasticSearch, Slack alerts, screenshots, multi-user and 2FA support. You’ll get attack-surface monitoring, change notifications by email or REST hooks, and a fully RESTful API to drive scans. HX even preloads third-party modules and offers customer support. Targets range from IPs, subnets and ASNs to email addresses, phone numbers or even Bitcoin wallets. Behind the scenes, modules publish and subscribe data to extract subdomains, parse metadata from binaries and images, scrape social profiles, hunt for breaches, test DNS zone transfers, and more. Most modules work free; those that need API keys often have a no-cost tier.