# BBOT

> Recursive internet scanner for recon, bug bounties and ASM: subdomain enumeration, web spidering, email gathering and web scanning via presets.

Stars: 10.9k · Language: Python · License: AGPL-3.0 · Categories: Network

- Repository: https://github.com/blacklanternsecurity/bbot
- Website: https://www.blacklanternsecurity.com/bbot/
- Page: https://www.trmn.sh/tools/bbot

## Install

- pipx: `pipx install bbot`
- pipx (dev branch): `pipx install --pip-args '\--pre' bbot`

## Overview

BBOT (BEE·bot) is a Python-based multipurpose scanner inspired by Spiderfoot. It automates reconnaissance, bug bounty work, and attack surface management. Scans are run from the command line with `-t` for targets and `-p` for presets, for example `bbot -t evilcorp.com -p subdomain-enum`.

Behavior is controlled through YAML presets that enable groups of modules by flag. Documented presets include `subdomain-enum` (passive API sources plus recursive DNS brute-force with target-specific mutations), `spider` (recursive web crawler with configurable depth and links per page), `email-enum`, `web` and `web-heavy` (light and aggressive web scans), and `kitchen-sink`, which combines subdomain, cloud, code, email, spider, web, paramminer, webbrute and screenshot presets. Presets can be combined in one command. Targets can be DNS names, IPs, CIDR ranges, open ports, URLs, emails, organizations (`ORG:`), usernames (`USER:`), filesystem paths, and mobile apps. The README states it finds 20-50% more subdomains than other tools.

Other capabilities include web screenshots, NLP-powered subdomain mutations, searching the attack surface with custom YARA rules, and automatic dependency installation with Ansible. DNS resolution uses blastdns, which benefits from more resolvers in `/etc/resolv.conf`. API keys for services such as SecurityTrails, Shodan, and VirusTotal go in `~/.config/bbot/secrets.yml` or are passed with `-c`. Output modules cover Neo4j, Postgres, MySQL, SQLite, Splunk, Elasticsearch, CSV, JSON, HTTP, Websocket, and Slack, Discord and Teams notifications.

BBOT can also be used as a Python library with synchronous (`scan.start()`) and asynchronous (`scan.async_start()`) APIs through `bbot.scanner.Scanner`. It targets penetration testers, bug bounty hunters, and security teams doing recon or ASM. Version 3.0 has breaking changes from 2.x.

### Installation

```bash
# via pipx
pipx install bbot
```

```bash
# via pipx (dev branch)
pipx install --pip-args '\--pre' bbot
```

![BBOT scan in real time](https://media.trmn.sh/cached/bf7822dc6aeb09f1737ff4c2a7726c93c4cedc6ffc6467e669df4838a25d0b50.mp4)

![BBOT Discord bot](https://media.trmn.sh/cached/ca593dc51327aa403f654d288abfb3b63038b13f1584793f561bdb0a416d0e8d.gif)

## Alternatives

- [Streamlink](https://www.trmn.sh/tools/streamlink.md): Python CLI and library that pipes video streams from services like Twitch and YouTube into a video player such as VLC, or writes them to disk. (Python, 11.9k stars)
- [posting](https://www.trmn.sh/tools/posting.md): Terminal-based HTTP client with keyboard navigation, local YAML storage, and syntax highlighting (Python, 12.6k stars)
- [sshuttle](https://www.trmn.sh/tools/sshuttle.md): Transparent proxy that tunnels traffic to a remote network over ssh, acting as a VPN substitute without requiring admin access on the remote side. (Python, 13.6k stars)
- [httpstat](https://www.trmn.sh/tools/httpstat.md): Visualizes curl statistics with timing breakdowns of DNS, TCP, TLS, server processing, and content transfer. (Python, 6.2k stars)
- [gallery-dl](https://www.trmn.sh/tools/gallery-dl.md): Cross-platform command-line program that downloads image galleries and collections from many image hosting sites, with configurable file naming. (Python, 20.3k stars)

---

Canonical: https://www.trmn.sh/tools/bbot