blacklanternsecurity/bbot

What it does

BBOT is a recursive internet scanner aimed at security researchers, bug bounty hunters and attack surface management (ASM) teams. Inspired by Spiderfoot, it connects many recon modules so one target can flow through passive sources, DNS enumeration, web crawling and vulnerability checks. Output can go to Neo4j, Postgres, MySQL, SQLite, Elasticsearch, Splunk, CSV, JSON, Slack, Teams, Discord and HTTP/WebSocket, among other sinks Add source-backed details.

The scanner accepts many target types through -t: DNS names, IP addresses, CIDR ranges, open TCP ports, URLs, email addresses, organizations, usernames, filesystems and mobile app links Add source-backed details. It can also be imported as a Python library with synchronous or asynchronous scanning APIs.

Quick start

BBOT requires Python 3.10 or newer Add source-backed details. Install the stable CLI with pipx:

pipx install bbot

For the development branch, use pipx install --pip-args '\--pre' bbot Add source-backed details. Docker is another documented installation route Add source-backed details.

A first subdomain scan looks like this:

bbot -t example.com -p subdomain-enum

This preset combines passive API sources with recursive DNS brute-force and target-specific subdomain mutations, and writes unique subdomains to a text file Add source-backed details. To use passive sources only, add -rf passive Add source-backed details.

Other presets cover web crawling (-p spider), email gathering (-p email-enum), light or heavy web scanning (-p web / -p web-heavy), and the broad -p kitchen-sink preset Add source-backed details. Many modules use third-party APIs; API keys belong in ~/.config/bbot/secrets.yml or can be passed on the command line Add source-backed details.

Requirements and constraints

• Python 3.10+ is required for the pipx route Add source-backed details.
• API-backed modules such as SecurityTrails, Shodan, VirusTotal and C99 need API keys; without them those modules cannot contribute results.
• DNS-heavy scans benefit from more unfiltered resolvers in /etc/resolv.conf, because the bundled blastdns resolver scales threads per resolver Add source-backed details.
• BBOT 3.0 has breaking changes to the CLI, presets, modules, events and Python API; projects upgrading from 2.x should read the migration guide first Add source-backed details.
• The project is licensed under AGPL-3.0 Add source-backed details. Scans should only be run against systems you are authorized to test.

HotRepo's take

The repository is a substantial Python security tool with a full module ecosystem and developer documentation, including a guide for writing new BBOT modules Add source-backed details. Its most recent recorded appearance on HotRepo's Python daily list was on 2026-11-05, when it gained 28 stars and ranked 15th on that language list. That single snapshot does not establish a trend, but it shows the project was still being noticed by Python developers at that point.