Package: bbrf
IntroductionThe Bug Bounty Reconnaissance Framework (BBRF) can be used to coordinate your reconnaissance workflows across multiple devices. For more background, readthe original blog post.If you are new to BBRF, you will need to deploy aBBRF serverbefore you can make use of the client.Get started# install the clientpipinstallbbrf# create the .bbrf foldermkdir-p~/.bbrf# ensure you have the required configuration in ~/.bbrf/config.jsoncat>~/.bbrf/config.json<< EOF{"username": "bbrf","password": "<your secure password>","couchdb": "https://<your-bbrf-server>/bbrf","slack_token": "<a slack token to receive notifications>","discord_webhook": "<your discord webhook if you want one>","ignore_ssl_errors": false}EOF# other optional settings are {"debug":true, "slack_channel": "channel-name", "slack_webhook":"https://..."}# create a new programbbrfnewtest# or continue with a program you have created beforebbrfusetest# define a scope for your programbbrfinscopeadd'*.example.com''*.sub.example.com''example.com'bbrfoutscopeadd'blog.example.com''*.dev.example.com'# view the program in/out scopebbrfscopeinbbrfscopeout# start a background listener to listen for changes and send alerts to Slack# in production, you probably want this continuously running on a VPS somewherebbrflisten&# add some domains manuallybbrfdomainaddwww.example.comexample.comsome.dev.example.comwww.example.comwww.example.comthisisnotadomain.example# note that bbrf automatically safeguards the data quality, e.g.# it checks the program's in and out scope to see if entries# should be processed or not, prevents duplicate entries in the database,# and rejects all input that is not a valid domainbbrfdomains# add a list of ips from a file by piping into bbrfcatips.txt|bbrfipadd-# run a tool based on the program scope, store results in bbrf,# and display a list of domains that have been addedbbrfscopein--wildcard--top|subfinder|bbrfdomainadd---show-new# retrieve a raw document from the bbrf server and format with jqbbrfshowwww.example.com|jq# update the outscopebbrfoutscopeaddwww.example.com# note that this does not automatically remove outscoped domains that# were already in the database, so you will manually need to fix that!bbrfdomains|bbrfscopefilterout|bbrfdomainremove-# discover all features of bbrf on the help pagebbrf-h# Use dnsx to resolve unresolved domains across all your programs# and store the results in bbrf, either by updating existing ips and domains,# or by adding them if they are newforpin$(bbrfprograms);dobbrfdomains--viewunresolved-p$p|\dnsx-silent-a-resp|tr-d'[]'|tee\>(awk'{print $1":"$2}'|bbrfdomainupdate--p$p-sdnsx)\>(awk'{print $1":"$2}'|bbrfdomainadd--p$p-sdnsx)\>(awk'{print $2":"$1}'|bbrfipadd--p$p-sdnsx)\>(awk'{print $2":"$1}'|bbrfipupdate--p$p-sdnsx)done# view all resolved domainsbbrfdomains--viewresolvedPython moduleTo use BBRF in your Python projects, use the interface as follows:frombbrfimportBBRFClientasbbrf# this will use the system's default ~/.bbrf/config.json file:programs=bbrf('programs').run()# to specify a custom configuration, provide a second argument:conf={"username":"bbrf","password":"<your secure password>","couchdb":"https://<your-instance>/bbrf","slack_token":"<a slack token to receive notifications>","discord_webhook":"<your discord webhook>","ignore_ssl_errors":false}domains=bbrf('domains --view resolved',conf).run()DashboardIf you like browsing through your recon data with a GUI, you can make use of theBBRF dashboardonhttps://bbrf.me. Just plug in your server URL, username and password, and the dashboard will pull your data and make it searchable. Note that all communication to the server happens via your browser, so your data remains safe!AdvancedDomainsBBRF will accept and store domains in any of the following input formats:<domain>
<domain>:<ip>
<domain>:<ip>,<ip>,...Note that adding the DNS resolutions of a domain in this way doesnotautomatically store the IP in the IPs table,
but that domains and ips are logically seperated in the client, which requires you to write your scripts so that they
handle this distinction appropriately.bbrfdomainaddwww.example.com:1.1.1.1
bbrfdomainupdatewww.example.com:2.2.2.2,3.3.3.3
bbrfshowwww.example.com|jqIPsSimilarly, you can store hostnames of an IP address by appending one or more domains with a colon:<ip>
<ip>:<domain>
<ip>:<domain>,<domain>,...Again, BBRF will make sure the provided hostnames are valid domain names before storing them, but will not add them to your list of domains for the program, nor does it validate these domains against the defined program scope. Instead, these domains are stored in adomainsproperty on the IP document:bbrfipadd1.1.1.1:www.example.com,sub.example.com
bbrfipupdate1.1.1.1:www.google.com,www.apple.com
bbrfshow1.1.1.1|jqURLsBBRF will help you manage your URLs, and store their hostname, port, status code and content length for you:bbrfurladd'https://www.example.com:8443/a''http://www.example.com/b''http://www.example.com/c 200 1234'Two formats are accepted:<url>or<url> <statuscode> <contentlength>delimited by spaces.The<url>can be absolute or relative. A relative URL will require the-d <hostname>flag to be specified or will be skipped. Whenever the-dflag is set, it will compare that with the hostname parsed from the URL, and skip the URL if they do not match.Relative URLs and URLs that do not specify a scheme (http://orhttps://) will always be interpreted with schemehttp://. If no port is found, ports 80 and 443 will be used as a default depending on the scheme.The flag--show-newwill print a list of new and updated URLs if they were added, or if their status code and/or content length were updated respectively:caturls.txt|bbrfurladd---show-new[UPDATED]https://sub.example.com:8443/b[NEW]http://www.example.com/a[NEW]http://www.example.com/cTo view a list of stored URLs of your active program, simply use:bbrfurlsOr, to return URLs belonging to a specific host:bbrfurls-dwww.example.comTo list URLs across all programs, run:bbrfurls--allTo print full URLs with the saved query strings:bbrfurls--all--with-queryServicesTo store services (i.e. open ports) in BBRF, provide the input formatted asip:portorip:port:service, and manually specify other properties by means of the tagging system (see below for more info about tags), e.g.:bbrfserviceadd127.0.0.1:8443127.0.0.1:8888-thostname:localhost-tprotocol:tcp
bbrfserviceadd127.0.0.1:80:http127.0.0.1:21:ftp-thostname:localhost-tprotocol:tcp
bbrfserviceadd127.0.0.1:22:ssh127.0.0.1:53:domain127.0.0.1:80-tscanned:$(date+%s)Note that services can only be stored for an IP address, andnotasdomain:portfor example. This avoids the complexity of mapping domains to IPs (especially when an IP address maps to more than one domain), while still allowing search operations supported by a mix of default properties and tags:# get all known services on port 8443bbrfserviceswhereportis8443# return services for which a tag has been manually providedbbrfserviceswherehostnameislocalhostTagging and queryingBy setting custom properties for the different document types (programs, domains, ips, urls and services), you can specify e.g. the platform a program belongs to or the name of a team member that added a bunch of new domains.To add tags to documents, specify a-t key:valuewhen creating a new domain, ip, url or service, or leave empty to remove the tag:# add a custom tag to all domainscatdomains.txt|bbrfdomainadd--tadded_by:pieter-tfrom:domains.txt# create an IP with a custom tagbbrfipadd1.2.3.4-tadded_by:pieter# remove the tagbbrfipupdate1.2.3.4-tadded_by:Note that you can specify the same tag multiple times to store the tags as arrays. BBRF will follow the following rules to determine how to store tags:if a single-t tag:valueis found, treat as a normal value;if the same tag name is provided more than once, default to an array:-t cname:one -t cname:twoby default, overwrite existing values for the tags when updating, unless--append-tagsis specified, in which case append new values to existing values:bbrfdomainupdatewww.example.tld-tname:value
bbrfshowwww.example.tld|jq.tags# { "name": "value" }bbrfdomainupdatewww.example.tld-tname:value2-tname:value3
bbrfshowwww.example.tld|jq.tags# { "name": ["value2", "value3"] }bbrfdomainupdatewww.example.tld-tname:value4--append-tags
bbrfshowwww.example.tld|jq.tags# { "name": ["value2", "value3", "value4"] }bbrfdomainupdatewww.example.tld-tname:
bbrfshowwww.example.tld|jq.tags# { }To facilitate basic data querying, the BBRF server provides an indexed search based on all custom tags, as well as some default properties of all document types:# search domains based on custom tags:bbrfdomainswhereadded_byispieter--all
bbrfdomainswherelast_updatedisbefore1610698911bbrfdomainswherelast_scanisafter2021-01-01-pmyprogram# or search the properties that are available by design:bbrfdomainswhereipis1.1.1.1
bbrfipswheredomainiswww.example.com
bbrfurlswhereportis443bbrfserviceswhereportis22This works on domains, ips, urls and services and will search based on text-based comparisons as is defined in theUnicode Collation Algorithmasimplemented by Couchdb.Since all values are stored as text, this allows date comparison if you store dates as unix timestamps or in a ISO-8601 format e.g.2021-01-15T09:02:40.628Z.That also means, however, that for example"20"comes after"1000", which makes this less suitable for integer comparison. So if you want to store integers, you may want to use padded zeros at the front to ensure that0020comes before1000.Dynamic program inferenceUse the dynamic program name-p @INFERto infer the program name based on other properties if you're unable to specify the program flag yourself for some reason; this is currently supported for the following operations:bbrf ip add 1.1.1.1:example.tld -p @INFERwill set the IP's program name to the same as the domain example.tld if it already exists;bbrf domain add some.example.tld:1.2.3.4 -p @INFERwill set the domain's program name to the same as 1.2.3.4 if it already exists - note that this will bypass the scope validation of the program, because the program name is inferred just before writing to the database.bbrf domain add some.example.tld some.other.tld -p @INFERwill add the domains to whatever program scope matches the input;bbrf url add http://this.example.tld https://that.some.tld/robots.txt -p @INFERwill add the URLs to whatever program has the domain in scope;BBRF ListenerIn order to process changes and alerts as they are pushed to the data store, you need to have an active listener running somewhere:bbrflistenThis will start listening for changes on the BBRF server and push notifications to your configured Slack instance. Note that this will fail e.g. when the BBRF server is temporarily unavailable or in case of certificate errors, so you may want to loop this to auto-start in case of issues.Custom execution hooksThe BBRF listener will also execute custom local scripts when it sees new or updated ips, domains, urls and/or services. It will automatically look for executable.shfiles in the following locations:~/.bbrf/hooks/ip/new/,~/.bbrf/hooks/ip/update/,~/.bbrf/hooks/domain/new/,~/.bbrf/hooks/domain/update/,~/.bbrf/hooks/url/new/,~/.bbrf/hooks/url/update/,~/.bbrf/hooks/service/new/,~/.bbrf/hooks/service/update/,For example, here is a custom execution hook that will resolve newly added domains and store the results back in BBRF. Find more examples indocs/hooks.#!/bin/bash## BBRF hook - save to ~/.bbrf/hooks/domain/new/resolve.sh# and make sure it is executable: chmod +x resolve.sh#domains=$@printf'%s\n'${domains[@]}|dnsx-silent-a-resp|tr-d'[]'|tee\>(awk'{print $1":"$2}'|bbrfdomainupdate-)\>(awk'{print $2":"$1}'|bbrfipadd--p@INFER)\>(awk'{print $2":"$1}'|bbrfipupdate-);Proxy configurationSince version 1.2, BBRF allows you to store and retrieve proxy configurations per program. This feature was designed to integrate with myOpenVPN via SOCKS5 proxysetup, but can be used with other proxy setups independently.For example, configure your proxy settings in BBRF as follows:# add a proxy with name 'hackerone' and a valid proxy URLbbrfproxysethackeronesocks5://user:pass@yourserver.com:1080Update a program's proxy settings with the custom tagproxyas follows:# use the same name as the name of the configured proxybbrfprogramupdatemy_hackerone_program-tproxy:hackeroneGet the proxy settings of a program withbbrf proxy -p my_hackerone_program. For example, you can update your automation scripts to always send traffic through the right proxy as follows:# note that the use of double quotes will allow this to work even if no proxy is configured for the current programcurl-x"$(bbrfproxy)"ifconfig.co