bbot

BBOT (BEE·bot) is a multipurpose recursive internet scanner inspired by Spiderfoot, aimed at reconnaissance, bug bounty work and attack surface management (ASM). It is written in Python (3.10+) and released under AGPLv3. Core workflow: you give it targets and a preset, and it runs a chain of modules that emit events, which feed further modules. Presets bundle flags, modules and config. Examples include subdomain-enum (passive APIs plus recursive DNS brute-force with target-specific mutations), spider (recursive web crawling), email-enum, web and web-heavy, and kitchen-sink (combines subdomain, cloud, code and email enumeration, spidering, parameter mining, web brute-forcing and screenshots). Targets can be DNS names, IP addresses, IP ranges, open TCP ports, URLs, email addresses, organizations, usernames, filesystem paths and mobile app links, and multiple targets can be supplied on the command line or in files. Output modules cover Neo4j, Teams, Discord, Slack, Postgres, MySQL, SQLite, Splunk, Elasticsearch, CSV, JSON, HTTP and Websocket. API keys for third-party services (SecurityTrails, Shodan, VirusTotal, etc.) are configured in ~/.config/bbot/secrets.yml or on the command line. BBOT can also be used as a Python library, with synchronous and asynchronous scanner APIs, and there is a documented example of a Discord bot that responds to a /scan command. Feature highlights listed by the project include multiple targets, web screenshots, offensive web modules, NLP-powered subdomain mutations, native Neo4j output, automatic dependency installation with Ansible, custom YARA rule searching across the attack surface, and developer documentation. Installation is via pipx (stable or pre-release) or Docker. The project notes that BBOT 3.0 has breaking changes to CLI, presets, modules, events and the Python API compared with 2.x, and provides a migration guide. It also suggests adding more unfiltered DNS resolvers to speed up scans.