Package: bbot
BEE·botA Recursive Internet Scanner for Hackers.BBOT (Bighuge BLS OSINT Tool) is a recursive internet scanner inspired bySpiderfoot, but designed to be faster, more reliable, and friendlier to pentesters, bug bounty hunters, and developers.Special features include:Support for Multiple TargetsWeb ScreenshotsSuite of Offensive Web ModulesAI-powered Subdomain MutationsNative Output to Neo4j (and more)Python API + Developer Documentationhttps://github.com/blacklanternsecurity/bbot/assets/20261699/742df3fe-5d1f-4aea-83f6-f990657bf695A BBOT scan in real-time - visualization withVivaGraphJSQuick Start GuideBelow are some short help sections to get you up and running.Installation ( Pip )Note: BBOT'sPyPi packagerequires Linux and Python 3.9+.# stable versionpipxinstallbbot# bleeding edge (dev branch)pipxinstall--pip-args'\--pre'bbot

bbot--helpInstallation ( Docker )Docker imagesare provided, along with helper scriptbbot-docker.shto persist your scan data.# bleeding edge (dev)dockerrun-itblacklanternsecurity/bbot--help# stabledockerrun-itblacklanternsecurity/bbot:stable--help# helper scriptgitclonehttps://github.com/blacklanternsecurity/bbot&&cdbbot
./bbot-docker.sh--helpExample UsageExample CommandsScan output, logs, etc. are saved to~/.bbot. For more detailed examples and explanations, seeScanning.Subdomains:# Perform a full subdomain enumeration on evilcorp.combbot-tevilcorp.com-fsubdomain-enumSubdomains (passive only):# Perform a passive-only subdomain enumeration on evilcorp.combbot-tevilcorp.com-fsubdomain-enum-rfpassiveSubdomains + port scan + web screenshots:# Port-scan every subdomain, screenshot every webpage, output to current directorybbot-tevilcorp.com-fsubdomain-enum-mnmapgowitness-nmy_scan-o.Subdomains + basic web scan:# A basic web scan includes wappalyzer, robots.txt, and other non-intrusive web modulesbbot-tevilcorp.com-fsubdomain-enumweb-basicWeb spider:# Crawl www.evilcorp.com up to a max depth of 2, automatically extracting emails, secrets, etc.bbot-twww.evilcorp.com-mhttpxrobotsbadsecretssecretsdb-cweb_spider_distance=2web_spider_depth=2Everything everywhere all at once:# Subdomains, emails, cloud buckets, port scan, basic web, web screenshots, nucleibbot-tevilcorp.com-fsubdomain-enumemail-enumcloud-enumweb-basic-mnmapgowitnessnuclei--allow-deadlyTargetsBBOT accepts an unlimited number of targets via-t. You can specify targets either directly on the command line or in files (or both!):bbot-tevilcorp.comevilcorp.org1.2.3.0/24-fsubdomain-enumTargets can be any of the following:DNS_NAME(evilcorp.com)IP_ADDRESS(1.2.3.4)IP_RANGE(1.2.3.0/24)OPEN_TCP_PORT(192.168.0.1:80)URL(https://www.evilcorp.com)For more information, seeTargets. To learn how BBOT handles scope, seeScope.API KeysSimilar to Amass or Subfinder, BBOT supports API keys for various third-party services such as SecurityTrails, etc.The standard way to do this is to enter your API keys in~/.config/bbot/secrets.yml:modules:shodan_dns:api_key:4f41243847da693a4f356c0486114bc6c99:api_key:21a270d5f59c9b05813a72bb41707266virustotal:api_key:dd5f0eee2e4a99b71a939bded450b246securitytrails:api_key:d9a05c3fd9a514497713c54b4455d0b0If you like, you can also specify them on the command line:bbot-cmodules.virustotal.api_key=dd5f0eee2e4a99b71a939bded450b246For details, seeConfigurationBBOT as a Python LibraryBBOT exposes a Python API that allows it to be used for all kinds of fun and nefarious purposes, like aDiscord Botthat responds to the/scancommand.Synchronousfrombbot.scannerimportScanner# any number of targets can be specifiedscan=Scanner("example.com","scanme.nmap.org",modules=["nmap","sslcert"])foreventinscan.start():print(event.json())Asynchronousfrombbot.scannerimportScannerasyncdefmain():scan=Scanner("example.com","scanme.nmap.org",modules=["nmap","sslcert"])asyncforeventinscan.async_start():print(event.json())importasyncioasyncio.run(main())Documentation - Table of ContentsUser ManualBasicsGetting StartedHow it WorksComparison to Other ToolsScanningScanning OverviewEventsOutputTips and TricksAdvanced UsageConfigurationModulesList of ModulesNucleiMiscRelease HistoryTroubleshootingDeveloper ManualHow to Write a ModuleDevelopment OverviewScannerEventTargetBaseModuleHelpersOverviewCommandDNSInteractshMiscellaneousWebWord CloudContributionBBOT is constantly being improved by the community. Every day it grows more powerful!We welcome contributions. Not just code, but ideas too! If you have an idea for a new feature, please let us know inDiscussions. If you want to get your hands dirty, seeContribution. There you can find setup instructions and a simple tutorial on how to write a BBOT module. We also have extensiveDeveloper Documentation.Thanks to these amazing people for contributing to BBOT! :heart:Special thanks to the following people who made BBOT possible:@TheTechromancer for creatingBBOT@liquidsec for his extensive work on BBOT's web hacking features, includingbadsecretsSteve Micallef (@smicallef) for creating Spiderfoot@kerrymilan for his Neo4j and Ansible expertiseAleksei Kornev (@alekseiko) for allowing us ownership of the bbot Pypi repository <3Comparison to Other ToolsBBOT consistently finds 20-50% more subdomains than other tools. The bigger the domain, the bigger the difference. To learn how this is possible, seeHow It Works.BBOT Modules By FlagFor a full list of modules, including the data types consumed and emitted by each one, seeList of Modules.Flag# ModulesDescriptionModulessafe76Non-intrusive, safe to runaffiliates, aggregate, ajaxpro, anubisdb, asn, azure_realm, azure_tenant, badsecrets, bevigil, binaryedge, bucket_amazon, bucket_azure, bucket_digitalocean, bucket_file_enum, bucket_firebase, bucket_google, builtwith, c99, censys, certspotter, chaos, columbus, credshed, crobat, crt, dehashed, digitorus, dnscommonsrv, dnsdumpster, dnszonetransfer, emailformat, filedownload, fingerprintx, fullhunt, git, github_codesearch, github_org, gowitness, hackertarget, httpx, hunt, hunterio, iis_shortnames, internetdb, ip2location, ipstack, leakix, myssl, newsletters, nsec, ntlm, oauth, otx, passivetotal, pgp, postman, rapiddns, riddler, robots, secretsdb, securitytrails, shodan_dns, sitedossier, skymem, social, sslcert, subdomain_hijack, subdomaincenter, sublist3r, threatminer, urlscan, viewdns, virustotal, wappalyzer, wayback, zoomeyepassive57Never connects to target systemsaffiliates, aggregate, anubisdb, asn, azure_realm, azure_tenant, bevigil, binaryedge, bucket_file_enum, builtwith, c99, censys, certspotter, chaos, columbus, credshed, crobat, crt, dehashed, digitorus, dnscommonsrv, dnsdumpster, emailformat, excavate, fullhunt, github_codesearch, github_org, hackertarget, hunterio, internetdb, ip2location, ipneighbor, ipstack, leakix, massdns, myssl, nsec, otx, passivetotal, pgp, postman, rapiddns, riddler, securitytrails, shodan_dns, sitedossier, skymem, social, speculate, subdomaincenter, sublist3r, threatminer, urlscan, viewdns, virustotal, wayback, zoomeyesubdomain-enum47Enumerates subdomainsanubisdb, asn, azure_realm, azure_tenant, bevigil, binaryedge, builtwith, c99, censys, certspotter, chaos, columbus, crt, digitorus, dnscommonsrv, dnsdumpster, dnszonetransfer, fullhunt, github_codesearch, github_org, hackertarget, httpx, hunterio, internetdb, ipneighbor, leakix, massdns, myssl, nsec, oauth, otx, passivetotal, postman, rapiddns, riddler, securitytrails, shodan_dns, sitedossier, sslcert, subdomain_hijack, subdomaincenter, subdomains, threatminer, urlscan, virustotal, wayback, zoomeyeactive40Makes active connections to target systemsajaxpro, badsecrets, bucket_amazon, bucket_azure, bucket_digitalocean, bucket_firebase, bucket_google, bypass403, dastardly, dnszonetransfer, ffuf, ffuf_shortnames, filedownload, fingerprintx, generic_ssrf, git, gowitness, host_header, httpx, hunt, iis_shortnames, masscan, newsletters, nmap, ntlm, nuclei, oauth, paramminer_cookies, paramminer_getparams, paramminer_headers, robots, secretsdb, smuggler, sslcert, subdomain_hijack, telerik, url_manipulation, vhost, wafw00f, wappalyzerweb-thorough29More advanced web scanning functionalityajaxpro, azure_realm, badsecrets, bucket_amazon, bucket_azure, bucket_digitalocean, bucket_firebase, bucket_google, bypass403, dastardly, ffuf_shortnames, filedownload, generic_ssrf, git, host_header, httpx, hunt, iis_shortnames, nmap, ntlm, oauth, robots, secretsdb, smuggler, sslcert, subdomain_hijack, telerik, url_manipulation, wappalyzeraggressive19Generates a large amount of network trafficbypass403, dastardly, ffuf, ffuf_shortnames, generic_ssrf, host_header, ipneighbor, masscan, massdns, nmap, nuclei, paramminer_cookies, paramminer_getparams, paramminer_headers, smuggler, telerik, url_manipulation, vhost, wafw00fweb-basic17Basic, non-intrusive web scan functionalityazure_realm, badsecrets, bucket_amazon, bucket_azure, bucket_firebase, bucket_google, filedownload, git, httpx, iis_shortnames, ntlm, oauth, robots, secretsdb, sslcert, subdomain_hijack, wappalyzercloud-enum11Enumerates cloud resourcesazure_realm, azure_tenant, bucket_amazon, bucket_azure, bucket_digitalocean, bucket_file_enum, bucket_firebase, bucket_google, httpx, oauth, subdomain_hijackaffiliates8Discovers affiliated hostnames/domainsaffiliates, azure_realm, azure_tenant, builtwith, oauth, sslcert, viewdns, zoomeyeslow8May take a long time to completebucket_digitalocean, dastardly, fingerprintx, paramminer_cookies, paramminer_getparams, paramminer_headers, smuggler, vhostemail-enum7Enumerates email addressesdehashed, emailformat, emails, hunterio, pgp, skymem, sslcertdeadly4Highly aggressivedastardly, ffuf, nuclei, vhostportscan3Discovers open portsinternetdb, masscan, nmapweb-paramminer3Discovers HTTP parameters through brute-forceparamminer_cookies, paramminer_getparams, paramminer_headersiis-shortnames2Scans for IIS Shortname vulnerabilityffuf_shortnames, iis_shortnamesreport2Generates a report at the end of the scanaffiliates, asnsocial-enum2Enumerates social mediahttpx, socialservice-enum1Identifies protocols running on open portsfingerprintxsubdomain-hijack1Detects hijackable subdomainssubdomain_hijackweb-screenshots1Takes screenshots of web pagesgowitnessBBOT Output ModulesBBOT can save its data to TXT, CSV, JSON, and tons of other destinations includingNeo4j,Splunk, andDiscord. For instructions on how to use these, seeOutput Modules.ModuleTypeNeeds API KeyDescriptionFlagsConsumed EventsProduced Eventsasset_inventoryoutputNoMerge hosts, open ports, technologies, findings, etc. into a single asset inventory CSVDNS_NAME, FINDING, HTTP_RESPONSE, IP_ADDRESS, OPEN_TCP_PORT, TECHNOLOGY, URL, VULNERABILITY, WAFIP_ADDRESS, OPEN_TCP_PORTcsvoutputNoOutput to CSV*discordoutputNoMessage a Discord channel when certain events are encountered*emailsoutputNoOutput any email addresses found belonging to the target domainemail-enumEMAIL_ADDRESShttpoutputNoSend every event to a custom URL via a web request*humanoutputNoOutput to text*jsonoutputNoOutput to Newline-Delimited JSON (NDJSON)*neo4joutputNoOutput to Neo4j*pythonoutputNoOutput via Python API*slackoutputNoMessage a Slack channel when certain events are encountered*splunkoutputNoSend every event to a splunk instance through HTTP Event Collector*subdomainsoutputNoOutput only resolved, in-scope subdomainssubdomain-enumDNS_NAME, DNS_NAME_UNRESOLVEDteamsoutputNoMessage a Teams channel when certain events are encountered*web_reportoutputNoCreate a markdown report with web assetsFINDING, TECHNOLOGY, URL, VHOST, VULNERABILITYwebsocketoutputNoOutput to websockets*