Base
Hardened build
minimal ports, security patches applied at build time
SpiderFoot on Ubuntu 24.04
Azure
Security
SpiderFoot, an OSINT automation platform that maps the attack surface of a target from public sources and correlates what it finds.
Overview
SpiderFoot is an open source OSINT automation and reconnaissance platform. You give it a target, a domain name, an IP address or range, a hostname, an email address, a username or a person's name, and it runs a large library of modules that gather what public sources already know about it: DNS and WHOIS records, certificate transparency logs, subdomains and netblocks, open ports and banners, breach and paste appearances, social and code repository mentions, malicious activity feeds and much more. Findings are stored as typed events, linked back to the source that produced them, and correlated into a picture of the target's exposed surface that you can browse, filter, visualise as a graph and export. It is used for attack surface discovery, external footprint reviews, red team reconnaissance, threat intelligence enrichment and due diligence, and it works entirely from your own instance so no third party sees the list of things you are looking into.
Why the cloudimg image
SpiderFoot with no password file of its own is genuinely an open scanning proxy: measured on the stock project, an anonymous request could start a real scan. cloudimg never runs it that way. Every instance is protected by two independent authentication layers, the cloudimg entrance gate and SpiderFoot's own sign in, and both credentials are generated on that machine at first boot and written to a root only file, so nothing usable is baked into the image and no two instances share a secret. The public listener stays shut until first boot has proved that an unauthenticated request is refused, and the application itself is bound to loopback behind a single hardened reverse proxy, so there is no route to it that skips the gate. No third party API keys are baked in, and the scan database is owned by a dedicated account with no login and a private data directory, so an instance's reconnaissance record is not readable by anything else on the machine. Every deployment ships fully patched with unattended security updates enabled, and comes with a paired deploy guide and 24/7 cloudimg support. You are responsible for only scanning systems you own or are explicitly authorised to test.
Common uses
- Map the external attack surface of a domain or netblock you own
- Enrich threat intelligence and check exposure from public sources
- Run authorised red team and due diligence reconnaissance in house
See it running
Real screenshots taken while testing this image against its deployment guide.
More in Security
AliasVault Self-Hosted Password Manager & Aliases
Security
The cloudimg image ships the free and open source, AGPL-3.0 licensed AliasVault, run the officially supported way as the...
Apache Directory Server LDAP - Managed Support
Security
This image runs Apache Directory Server (ApacheDS) 2.0, the Apache Software Foundation's extensible, embeddable director...
Apache SpamAssassin Anti-Spam Filter
Security
This image runs Apache SpamAssassin, the open source, Apache-2.0 licensed anti-spam platform.
Authentik - Self-Hosted Identity Provider and SSO Platform
Security
Authentik is an open source identity provider: single sign-on, multi-factor authentication, user management and access c...
Authgear - Open Source Identity Provider
Security
This image runs Authgear, the open source authentication server and identity provider.
Bl
Beelzebub Low-Code Honeypot Framework
Security
This image runs Beelzebub, the open source low code honeypot and deception framework.