# BBot | A Recursive Internet Scanner For Hackers **URL:** \ **Category:** Tools & Scripts\ **Tags:** programming, hacking, freebies, trading\ **Created:** [July 28, 2024, 8:06pm UTC](https://onehack.st/t/bbot-a-recursive-internet-scanner-for-hackers/287815 "2024-07-28T20:06:20Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\ **Post date:** [July 28, 2024, 8:06pm UTC](https://onehack.st/t/bbot-a-recursive-internet-scanner-for-hackers/287815/1 "2024-07-28T20:06:20Z")
[![bbot_banner](https://user-images.githubusercontent.com/20261699/158000235-6c1ace81-a267-4f8e-90a1-f4c16884ebac.png)](https://github.com/blacklanternsecurity/bbot) # BEE·bot ### A Recursive Internet Scanner for Hackers. [![Python Version](https://camo.githubusercontent.com/106661ac835c43e8de097a2a6c1565dbf2636f664ff60f00a511f9fe173c4022/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f707974686f6e2d332e392b2d464638343030)](https://www.python.org/) [![License](https://camo.githubusercontent.com/8657edd8912008c41a4b5a697c393f853d1ec8a46c5ef43a702cb6249253581c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d47504c76332d4646383430302e737667)](https://github.com/blacklanternsecurity/bbot/blob/dev/LICENSE) [![DEF CON Demo Labs 2023](https://camo.githubusercontent.com/f01b8be7c620785f1369a78b220cf999fa0a41cb010bd1cf76e428bdc1aa4462/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f444546253230434f4e25323044656d6f2532304c6162732d323032332d4646383430302e737667)](https://forum.defcon.org/node/246338) [![PyPi Downloads](https://camo.githubusercontent.com/c3426f364829d974804348b3f02217013857475010c0293e5194c5a1567cd5a2/68747470733a2f2f7374617469632e706570792e746563682f706572736f6e616c697a65642d62616467652f62626f743f72696768745f636f6c6f723d6f72616e6765266c6566745f636f6c6f723d67726579)](https://pepy.tech/project/bbot) [![Black](https://camo.githubusercontent.com/7d770c433d6198d89f8c1e2f187b904a9721d176259d0e97157337741cc8e837/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f636f64652532307374796c652d626c61636b2d3030303030302e737667)](https://github.com/psf/black) [![Tests](https://github.com/blacklanternsecurity/bbot/actions/workflows/tests.yml/badge.svg?branch=stable)](https://github.com/blacklanternsecurity/bbot/actions?query=workflow%3A%22tests%22) [![Codecov](https://camo.githubusercontent.com/3af4fb16cb2122c3e1ab67584cc6d97b3ddf9a5f20bd6babd9770f9105d8a287/68747470733a2f2f636f6465636f762e696f2f67682f626c61636b6c616e7465726e73656375726974792f62626f742f6272616e63682f6465762f67726170682f62616467652e7376673f746f6b656e3d495235415a42444d354b)](https://codecov.io/gh/blacklanternsecurity/bbot) [![Discord](https://camo.githubusercontent.com/5d8c22b97e0fcbadd784e6341bf234c164f93c82909ec5f036231e9eb35ca10b/68747470733a2f2f696d672e736869656c64732e696f2f646973636f72642f383539313634383639393730333632343339)](https://discord.com/invite/PZqkgxu5SA) BBOT (Bighuge BLS OSINT Tool) is a recursive internet scanner inspired by [Spiderfoot](https://github.com/smicallef/spiderfoot), but designed to be faster, more reliable, and friendlier to pentesters, bug bounty hunters, and developers. Special features include: - Support for Multiple Targets - Web Screenshots - Suite of Offensive Web Modules - AI-powered Subdomain Mutations - Native Output to Neo4j (and more) - Python API + Developer [Documentation](https://www.blacklanternsecurity.com/bbot/) first-bbot-scan.mp4 _A BBOT scan in real-time - visualization with [VivaGraphJS](https://github.com/blacklanternsecurity/bbot-vivagraphjs)_ ## Quick Start Guide Below are some short help sections to get you up and running. \*\*Installation ( Pip )\*\***Installation ( Docker )** `` **Example Usage** `` `` - ` ` - ` ` - ` ` - ` ` - ` ` **``** `` [![bbot-discord](https://private-user-images.githubusercontent.com/20261699/277527638-22b268a2-0dfd-4c2a-b7c5-548c0f2cc6f9.gif?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjIxOTcxMjUsIm5iZiI6MTcyMjE5NjgyNSwicGF0aCI6Ii8yMDI2MTY5OS8yNzc1Mjc2MzgtMjJiMjY4YTItMGRmZC00YzJhLWI3YzUtNTQ4YzBmMmNjNmY5LmdpZj9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA3MjglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNzI4VDIwMDAyNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTVmMTI4ZmYwZmQxZTFkODEyNmFhZTBlMzgwNzU2YmUyMzMzM2Y2Y2I2NTYwZDFlN2IwOWE3MWM1M2NlMWRiMjAmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.IqqxDrSR7f1aPcLUzN8Gp9rf0Wd3h2K5i63saDhEhcQ)](https://private-user-images.githubusercontent.com/20261699/277527638-22b268a2-0dfd-4c2a-b7c5-548c0f2cc6f9.gif?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjIxOTcxMjUsIm5iZiI6MTcyMjE5NjgyNSwicGF0aCI6Ii8yMDI2MTY5OS8yNzc1Mjc2MzgtMjJiMjY4YTItMGRmZC00YzJhLWI3YzUtNTQ4YzBmMmNjNmY5LmdpZj9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA3MjglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNzI4VDIwMDAyNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTVmMTI4ZmYwZmQxZTFkODEyNmFhZTBlMzgwNzU2YmUyMzMzM2Y2Y2I2NTYwZDFlN2IwOWE3MWM1M2NlMWRiMjAmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.IqqxDrSR7f1aPcLUzN8Gp9rf0Wd3h2K5i63saDhEhcQ) **Documentation - Table of Contents\*\*\*\*Contribution** [![](https://camo.githubusercontent.com/45fcec6d3463014c81445c89f68cb432294478c593770e8af5ae06b9d2d7910b/68747470733a2f2f636f6e747269622e726f636b732f696d6167653f7265706f3d626c61636b6c616e7465726e73656375726974792f62626f74266d61783d353030)](https://github.com/blacklanternsecurity/bbot/graphs/contributors) ## Comparison to Other Tools BBOT consistently finds 20-50% more subdomains than other tools. The bigger the domain, the bigger the difference. To learn how this is possible, see [How It Works](https://www.blacklanternsecurity.com/bbot/how_it_works/). [![subdomain-stats-ebay](https://private-user-images.githubusercontent.com/20261699/296080072-53e07e9f-50b6-4b70-9e83-297dbfbcb436.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjIxOTcxMjUsIm5iZiI6MTcyMjE5NjgyNSwicGF0aCI6Ii8yMDI2MTY5OS8yOTYwODAwNzItNTNlMDdlOWYtNTBiNi00YjcwLTllODMtMjk3ZGJmYmNiNDM2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA3MjglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNzI4VDIwMDAyNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTRhMzgxZjIyZjljY2I2ZTY5MWIzNzhhZDRmMTdhZGNiMjdkNTA1Nzk0NzQxNGU4MWVmODA2Y2NhMmUyZWEzZDImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.rZsZ48eJumlJQTUm7Rq1fe8KyfVk23z1OK1Z9X1xjgQ)](https://private-user-images.githubusercontent.com/20261699/296080072-53e07e9f-50b6-4b70-9e83-297dbfbcb436.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjIxOTcxMjUsIm5iZiI6MTcyMjE5NjgyNSwicGF0aCI6Ii8yMDI2MTY5OS8yOTYwODAwNzItNTNlMDdlOWYtNTBiNi00YjcwLTllODMtMjk3ZGJmYmNiNDM2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA3MjglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNzI4VDIwMDAyNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTRhMzgxZjIyZjljY2I2ZTY5MWIzNzhhZDRmMTdhZGNiMjdkNTA1Nzk0NzQxNGU4MWVmODA2Y2NhMmUyZWEzZDImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.rZsZ48eJumlJQTUm7Rq1fe8KyfVk23z1OK1Z9X1xjgQ) ## BBOT Modules By Flag For a full list of modules, including the data types consumed and emitted by each one, see [List of Modules](https://www.blacklanternsecurity.com/bbot/modules/list_of_modules/). | Flag | # Modules | Description | Modules | | --- | --- | --- | --- | | safe | 82 | Non-intrusive, safe to run | affiliates, aggregate, ajaxpro, anubisdb, asn, azure\_realm, azure\_tenant, baddns, baddns\_zone, badsecrets, bevigil, binaryedge, bucket\_amazon, bucket\_azure, bucket\_digitalocean, bucket\_file\_enum, bucket\_firebase, bucket\_google, builtwith, c99, censys, certspotter, chaos, code\_repository, columbus, credshed, crobat, crt, dehashed, digitorus, dnscommonsrv, dnsdumpster, docker\_pull, dockerhub, emailformat, filedownload, fingerprintx, fullhunt, git, git\_clone, github\_codesearch, github\_org, github\_workflows, gitlab, gowitness, hackertarget, httpx, hunt, hunterio, iis\_shortnames, internetdb, ip2location, ipstack, leakix, myssl, newsletters, ntlm, oauth, otx, passivetotal, pgp, postman, rapiddns, riddler, robots, secretsdb, securitytrails, shodan\_dns, sitedossier, skymem, social, sslcert, subdomaincenter, sublist3r, threatminer, trufflehog, urlscan, viewdns, virustotal, wappalyzer, wayback, zoomeye | | passive | 62 | Never connects to target systems | affiliates, aggregate, anubisdb, asn, azure\_realm, azure\_tenant, bevigil, binaryedge, bucket\_file\_enum, builtwith, c99, censys, certspotter, chaos, code\_repository, columbus, credshed, crobat, crt, dehashed, digitorus, dnscommonsrv, dnsdumpster, docker\_pull, dockerhub, emailformat, excavate, fullhunt, git\_clone, github\_codesearch, github\_org, github\_workflows, hackertarget, hunterio, internetdb, ip2location, ipneighbor, ipstack, leakix, massdns, myssl, otx, passivetotal, pgp, postman, rapiddns, riddler, securitytrails, shodan\_dns, sitedossier, skymem, social, speculate, subdomaincenter, sublist3r, threatminer, trufflehog, urlscan, viewdns, virustotal, wayback, zoomeye | | subdomain-enum | 45 | Enumerates subdomains | anubisdb, asn, azure\_realm, azure\_tenant, baddns\_zone, bevigil, binaryedge, builtwith, c99, censys, certspotter, chaos, columbus, crt, digitorus, dnscommonsrv, dnsdumpster, fullhunt, github\_codesearch, github\_org, hackertarget, httpx, hunterio, internetdb, ipneighbor, leakix, massdns, myssl, oauth, otx, passivetotal, postman, rapiddns, riddler, securitytrails, shodan\_dns, sitedossier, sslcert, subdomaincenter, subdomains, threatminer, urlscan, virustotal, wayback, zoomeye | | active | 42 | Makes active connections to target systems | ajaxpro, baddns, baddns\_zone, badsecrets, bucket\_amazon, bucket\_azure, bucket\_digitalocean, bucket\_firebase, bucket\_google, bypass403, dastardly, dotnetnuke, ffuf, ffuf\_shortnames, filedownload, fingerprintx, generic\_ssrf, git, gitlab, gowitness, host\_header, httpx, hunt, iis\_shortnames, masscan, newsletters, nmap, ntlm, nuclei, oauth, paramminer\_cookies, paramminer\_getparams, paramminer\_headers, robots, secretsdb, smuggler, sslcert, telerik, url\_manipulation, vhost, wafw00f, wappalyzer | | web-thorough | 29 | More advanced web scanning functionality | ajaxpro, azure\_realm, badsecrets, bucket\_amazon, bucket\_azure, bucket\_digitalocean, bucket\_firebase, bucket\_google, bypass403, dastardly, dotnetnuke, ffuf\_shortnames, filedownload, generic\_ssrf, git, host\_header, httpx, hunt, iis\_shortnames, nmap, ntlm, oauth, robots, secretsdb, smuggler, sslcert, telerik, url\_manipulation, wappalyzer | | aggressive | 20 | Generates a large amount of network traffic | bypass403, dastardly, dotnetnuke, ffuf, ffuf\_shortnames, generic\_ssrf, host\_header, ipneighbor, masscan, massdns, nmap, nuclei, paramminer\_cookies, paramminer\_getparams, paramminer\_headers, smuggler, telerik, url\_manipulation, vhost, wafw00f | | web-basic | 17 | Basic, non-intrusive web scan functionality | azure\_realm, baddns, badsecrets, bucket\_amazon, bucket\_azure, bucket\_firebase, bucket\_google, filedownload, git, httpx, iis\_shortnames, ntlm, oauth, robots, secretsdb, sslcert, wappalyzer | | cloud-enum | 12 | Enumerates cloud resources | azure\_realm, azure\_tenant, baddns, baddns\_zone, bucket\_amazon, bucket\_azure, bucket\_digitalocean, bucket\_file\_enum, bucket\_firebase, bucket\_google, httpx, oauth | | slow | 10 | May take a long time to complete | bucket\_digitalocean, dastardly, docker\_pull, fingerprintx, git\_clone, paramminer\_cookies, paramminer\_getparams, paramminer\_headers, smuggler, vhost | | affiliates | 8 | Discovers affiliated hostnames/domains | affiliates, azure\_realm, azure\_tenant, builtwith, oauth, sslcert, viewdns, zoomeye | | email-enum | 7 | Enumerates email addresses | dehashed, emailformat, emails, hunterio, pgp, skymem, sslcert | | deadly | 4 | Highly aggressive | dastardly, ffuf, nuclei, vhost | | portscan | 3 | Discovers open ports | internetdb, masscan, nmap | | web-paramminer | 3 | Discovers HTTP parameters through brute-force | paramminer\_cookies, paramminer\_getparams, paramminer\_headers | | baddns | 2 | Runs all modules from the DNS auditing tool BadDNS | baddns, baddns\_zone | | iis-shortnames | 2 | Scans for IIS Shortname vulnerability | ffuf\_shortnames, iis\_shortnames | | report | 2 | Generates a report at the end of the scan | affiliates, asn | | social-enum | 2 | Enumerates social media | httpx, social | | repo-enum | 1 | Enumerates code repositories | code\_repository | | service-enum | 1 | Identifies protocols running on open ports | fingerprintx | | subdomain-hijack | 1 | Detects hijackable subdomains | baddns | | web-screenshots | 1 | Takes screenshots of web pages | gowitness | ## BBOT Output Modules BBOT can save its data to TXT, CSV, JSON, and tons of other destinations including [Neo4j](https://www.blacklanternsecurity.com/bbot/scanning/output/#neo4j), [Splunk](https://www.blacklanternsecurity.com/bbot/scanning/output/#splunk), and [Discord](https://www.blacklanternsecurity.com/bbot/scanning/output/#discord-slack-teams). For instructions on how to use these, see [Output Modules](https://www.blacklanternsecurity.com/bbot/scanning/output). | Module | Type | Needs API Key | Description | Flags | Consumed Events | Produced Events | | --- | --- | --- | --- | --- | --- | --- | | asset\_inventory | output | No | Merge hosts, open ports, technologies, findings, etc. into a single asset inventory CSV | | DNS\_NAME, FINDING, HTTP\_RESPONSE, IP\_ADDRESS, OPEN\_TCP\_PORT, TECHNOLOGY, URL, VULNERABILITY, WAF | IP\_ADDRESS, OPEN\_TCP\_PORT | | csv | output | No | Output to CSV | | \* | | | discord | output | No | Message a Discord channel when certain events are encountered | | \* | | | emails | output | No | Output any email addresses found belonging to the target domain | email-enum | EMAIL\_ADDRESS | | | http | output | No | Send every event to a custom URL via a web request | | \* | | | human | output | No | Output to text | | \* | | | json | output | No | Output to Newline-Delimited JSON (NDJSON) | | \* | | | neo4j | output | No | Output to Neo4j | | \* | | | python | output | No | Output via Python API | | \* | | | slack | output | No | Message a Slack channel when certain events are encountered | | \* | | | splunk | output | No | Send every event to a splunk instance through HTTP Event Collector | | \* | | | subdomains | output | No | Output only resolved, in-scope subdomains | subdomain-enum | DNS\_NAME, DNS\_NAME\_UNRESOLVED | | | teams | output | No | Message a Teams channel when certain events are encountered | | \* | | | web\_report | output | No | Create a markdown report with web assets | | FINDING, TECHNOLOGY, URL, VHOST, VULNERABILITY | | | websocket | output | No | Output to websockets | | \* | | ## GitHub: [https://github.com/blacklanternsecurity/bbot](https://github.com/blacklanternsecurity/bbot)