BBOT

BBOT (BEE·bot) is a Python-based multipurpose scanner inspired by Spiderfoot. It automates reconnaissance, bug bounty work, and attack surface management. Scans are run from the command line with -t for targets and -p for presets, for example bbot -t evilcorp.com -p subdomain-enum.

Behavior is controlled through YAML presets that enable groups of modules by flag. Documented presets include subdomain-enum (passive API sources plus recursive DNS brute-force with target-specific mutations), spider (recursive web crawler with configurable depth and links per page), email-enum, web and web-heavy (light and aggressive web scans), and kitchen-sink, which combines subdomain, cloud, code, email, spider, web, paramminer, webbrute and screenshot presets. Presets can be combined in one command. Targets can be DNS names, IPs, CIDR ranges, open ports, URLs, emails, organizations (ORG:), usernames (USER:), filesystem paths, and mobile apps. The README states it finds 20-50% more subdomains than other tools.

Other capabilities include web screenshots, NLP-powered subdomain mutations, searching the attack surface with custom YARA rules, and automatic dependency installation with Ansible. DNS resolution uses blastdns, which benefits from more resolvers in /etc/resolv.conf. API keys for services such as SecurityTrails, Shodan, and VirusTotal go in ~/.config/bbot/secrets.yml or are passed with -c. Output modules cover Neo4j, Postgres, MySQL, SQLite, Splunk, Elasticsearch, CSV, JSON, HTTP, Websocket, and Slack, Discord and Teams notifications.

BBOT can also be used as a Python library with synchronous (scan.start()) and asynchronous (scan.async_start()) APIs through bbot.scanner.Scanner. It targets penetration testers, bug bounty hunters, and security teams doing recon or ASM. Version 3.0 has breaking changes from 2.x.

Installation

# via pipx
pipx install bbot

# via pipx (dev branch)
pipx install --pip-args '\--pre' bbot