README

BEE·bot is a multipurpose scanner inspired by Spiderfoot, built to automate your Recon, Bug Bounties, and ASM!

https://github.com/blacklanternsecurity/bbot/assets/20261699/e539e89b-92ea-46fa-b893-9cde94eebf81

_A BBOT scan in real-time - visualization with VivaGraphJS_

 Installation

bash
 stable version
pipx install bbot

 bleeding edge (dev branch)
pipx install --pip-args '\--pre' bbot


_For more installation methods, including Docker, see Getting Started_

 Upgrading from 2.x? BBOT 3.0 contains breaking changes to the CLI, presets, modules, events, and Python API. See the 2.x → 3.0 Migration Guide (source) before upgrading.

 Speed tip: BBOT's DNS resolver (blastdns) spins up multiple threads per resolver in /etc/resolv.conf. Adding more unfiltered resolvers dramatically speeds up scans. See the sample resolv.conf and Tips and Tricks for details.

 Example Commands

 1) Subdomain Finder

Passive API sources plus a recursive DNS brute-force with target-specific subdomain mutations.

bash
 find subdomains of evilcorp.com
bbot -t evilcorp.com -p subdomain-enum

 passive sources only
bbot -t evilcorp.com -p subdomain-enum -rf passive





subdomain-enum.yml

yaml
description: Enumerate subdomains via APIs, brute-force

flags:
   enable every module with the subdomain-enum flag
  - subdomain-enum

output_modules:
   output unique subdomains to TXT file
  - subdomains

config:
  dns:
    threads: 25
    brute_threads: 1000
   put your API keys here
   modules:
     github:
       api_key: ""
     chaos:
       api_key: ""
     securitytrails:
       api_key: ""







BBOT consistently finds 20-50% more subdomains than other tools. The bigger the domain, the bigger the difference. To learn how this is possible, see How It Works.

!subdomain-stats-ebay

 2) Web Spider

bash
 crawl evilcorp.com, extracting emails and other goodies
bbot -t evilcorp.com -p spider





spider.yml

yaml
description: Recursive web spider

modules:
  - http

blacklist:
   Prevent spider from invalidating sessions by logging out
  - "RE:/.(sign|log)[_-]?out"

config:
  web:
     how many links to follow in a row
    spider_distance: 2
     don't follow links whose directory depth is higher than 4
    spider_depth: 4
     maximum number of links to follow per page
    spider_links_per_page: 25







 3) Email Gatherer

bash
 quick email enum with free APIs + scraping
bbot -t evilcorp.com -p email-enum

 pair with subdomain enum + web spider for maximum yield
bbot -t evilcorp.com -p email-enum subdomain-enum spider





email-enum.yml

yaml
description: Enumerate email addresses from APIs, web crawling, etc.

flags:
  - email-enum

output_modules:
  - emails







 4) Web Scanner

bash
 run a light web scan against www.evilcorp.com
bbot -t www.evilcorp.com -p web

 run a heavy web scan against www.evilcorp.com
bbot -t www.evilcorp.com -p web-heavy





web.yml

yaml
description: Quick web scan

include:
  - iis-shortnames

flags:
  - web










web-heavy.yml

yaml
desc