WEBVTT 00:00:00.440 --> 00:00:03.950 SpiderFoot is an open‑source project and freely available. 00:00:04.440 --> 00:00:09.060 There's also a commercial service based on SpiderFoot called SpiderFoot HX. 00:00:09.440 --> 00:00:12.760 It is cloud‑hosted, so no local installation is needed. 00:00:13.240 --> 00:00:15.880 It includes modules that are not available in the open‑source 00:00:15.880 --> 00:00:18.760 version. Scans are faster than the open‑source version. 00:00:19.240 --> 00:00:21.850 You can get notifications in email or through Slack. 00:00:22.340 --> 00:00:26.260 If you have a team, you can collaborate with them on scans and investigations. 00:00:26.640 --> 00:00:31.050 SpiderFoot HX also utilizes Tor for access to the dark web. 00:00:32.009 --> 00:00:34.560 The various levels include a hobby level, 00:00:34.570 --> 00:00:39.450 which is free, freelancer, business, and an enterprise level, which 00:00:39.450 --> 00:00:42.760 has access to all SpiderFoot HX capabilities. 00:00:44.280 --> 00:00:48.020 SpiderFoot's official documentation is available on the SpiderFoot 00:00:48.020 --> 00:00:52.530 website and the GitHub site. You'll also find various demonstrations 00:00:52.530 --> 00:00:55.160 from the SpiderFoot team on ASCII Cinema. 00:00:56.140 --> 00:01:00.680 Other capabilities include the easy creation of a Docker container to 00:01:00.680 --> 00:01:05.830 run SpiderFoot, integration with Tor for anonymized searches, you can 00:01:05.830 --> 00:01:09.480 add username and password authentication to SpiderFoot, you can also 00:01:09.480 --> 00:01:14.110 utilize Transport Layer Security, or TLS, to secure your communications 00:01:14.110 --> 00:01:15.450 to your SpiderFoot system. 00:01:15.840 --> 00:01:19.120 SpiderFoot can also export data in several formats 00:01:19.120 --> 00:01:21.150 for processing in other systems. 00:01:22.640 --> 00:01:25.380 There are several information sources that SpiderFoot 00:01:25.380 --> 00:01:27.460 can interact with through API calls. 00:01:27.880 --> 00:01:31.260 These services provide additional details to SpiderFoot reports. 00:01:31.640 --> 00:01:33.860 In most cases, you can sign up for a free account. 00:01:34.340 --> 00:01:41.350 These include Shodan, AbuseIPDB, VirusTotal, GreyNoise, and PhishTank. 00:01:41.740 --> 00:01:43.150 And there are many others as well. 00:01:44.140 --> 00:01:47.550 If you're an organization concerned about data exposures that 00:01:47.550 --> 00:01:50.390 SpiderFoot can discover on your organization, 00:01:50.620 --> 00:01:51.550 what should you do? 00:01:51.940 --> 00:01:56.220 Well, start with reducing your attack surface, remove anything on the 00:01:56.220 --> 00:01:59.750 perimeter that isn't needed, and do a better job of managing your 00:01:59.750 --> 00:02:03.710 organization's social media accounts and content, and do a close 00:02:03.710 --> 00:02:06.360 analysis of any identified exposures. 00:02:06.840 --> 00:02:10.650 You may find opportunities to reduce the available information and lower the 00:02:10.650 --> 00:02:13.950 risk of an attacker utilizing it against your organization. 00:02:15.440 --> 00:02:19.810 Here are some key points I want you to consider for SpiderFoot. First, let's 00:02:19.810 --> 00:02:22.760 look at the reconnaissance capabilities that SpiderFoot has. 00:02:23.140 --> 00:02:26.560 There isn't a lot of setup needed to get started gathering information. 00:02:26.940 --> 00:02:30.860 We provide SpiderFoot with a simple starting point, that seed target. 00:02:31.240 --> 00:02:34.660 It could be a domain name, an email address, or an IP address. 00:02:35.140 --> 00:02:38.520 From that simple starting point, SpiderFoot starts gathering 00:02:38.520 --> 00:02:40.560 data and expands out from there. 00:02:40.940 --> 00:02:44.940 An email address leads to an account name, which leads to social media 00:02:44.940 --> 00:02:48.160 accounts, which leads to an organization, and so on. 00:02:48.540 --> 00:02:53.780 SpiderFoot can actively gather data from a target website or probe some TCP 00:02:53.780 --> 00:02:58.370 ports on that target, or we can just rely on data gathered from third‑party 00:02:58.370 --> 00:03:01.450 sources without directly interacting with the target. 00:03:01.840 --> 00:03:03.240 When we start our search, 00:03:03.250 --> 00:03:07.290 we can select our approach to data gathering through a defined use case. 00:03:07.740 --> 00:03:09.720 This allows us to gather everything, 00:03:10.020 --> 00:03:13.350 look at a subset of data, or just take a passive approach. 00:03:13.740 --> 00:03:18.090 We can also be more granular and use specific modules or look for 00:03:18.090 --> 00:03:22.910 specific data types. From an operational perspective, SpiderFoot 00:03:22.920 --> 00:03:24.960 is a well‑thought‑out InDesign tool. 00:03:25.440 --> 00:03:28.650 It gathers data from a variety of data sources on the internet, 00:03:29.040 --> 00:03:32.440 it takes advantage of what other services have already gathered 00:03:32.440 --> 00:03:33.960 about our targets of interest. 00:03:34.840 --> 00:03:37.940 Some of those services limit access to that data, 00:03:38.050 --> 00:03:42.660 but we can get access to it through SpiderFoot's built‑in API capabilities. 00:03:43.090 --> 00:03:46.070 SpiderFoot is an open‑source tool, and the Python code 00:03:46.070 --> 00:03:47.870 it's written in is very readable, 00:03:47.880 --> 00:03:51.350 which is helpful if you want to understand what is going on under the hood. 00:03:52.140 --> 00:03:55.480 It has a modular design, which makes it easier to build new 00:03:55.480 --> 00:03:59.010 capabilities through the creation of additional modules. And 00:03:59.010 --> 00:04:03.050 finally, you can deploy SpiderFoot in a variety of ways from using 00:04:03.050 --> 00:04:06.190 what's provided in Kali Linux, to grabbing the latest version of 00:04:06.190 --> 00:04:07.760 building a Docker container for it. 00:04:08.240 --> 00:04:10.830 You can also add credentials and utilize TLS if you 00:04:10.830 --> 00:04:13.130 need. And if all of that is too much, 00:04:13.160 --> 00:04:15.350 there's a hosted commercial version available. 00:04:16.839 --> 00:04:19.930 That's all for this course, but remember that SpiderFoot has a 00:04:19.930 --> 00:04:22.560 wealth of capabilities waiting to be explored. 00:04:22.940 --> 00:04:26.020 I hope you enjoyed the demonstrations of SpiderFoot and can put 00:04:26.020 --> 00:04:28.160 that information to good use in your work. 00:04:28.640 --> 00:04:29.660 Thank you for watching. 00:04:30.140 --> 00:04:33.560 I'm Keith Watson, and I look forward to learning with you on the next course. 00:04:33.940 --> 00:04:35.950 Please leave me some feedback on this course. 00:04:36.440 --> 00:04:37.660 I'd love to hear your thoughts.