id = "bbot"
name = "BBOT"
homepage = "https://github.com/blacklanternsecurity/bbot"
description = "The recursive internet scanner for hackers."
executables = ["bbot"]
[dotfiles]
paths = ["~/.config/bbot/bbot.yml"]
secret = ["~/.config/bbot/secrets.yml"]
[commands]
format = 1
label = "Run a scan"
description = "Scan one target with BBOT presets, flags and modules. Multiple targets, custom config values and output module settings are left out; add them at the prompt."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = false, short_bundles = false }
[[commands.source]]
id = "docs"
kind = "manual"
url = "https://www.blacklanternsecurity.com/bbot/Stable/scanning/"
revision = "stable 2026-10-27"
evidence = """
bbot -t evilcorp.com -p subdomain-enum
bbot -t evilcorp.com -p subdomain-enum -rf passive
bbot -t evilcorp.com -p subdomain-enum -m portscan gowitness -n my_scan -o .
bbot -t evilcorp.com -f subdomain-enum -ef loud
bbot -t evilcorp.com -f subdomain-enum -em ipneighbor
bbot -t evilcorp.com -b internal.evilcorp.com -f subdomain-enum -m portscan nuclei
bbot -t evilcorp.com -f subdomain-enum -eom csv txt
bbot -f subdomain-enum -l
bbot -lp
-f Enable these flags (e.g. -f subdomain-enum)
-rf Require modules to have this flag (e.g. -rf passive)
-ef Exclude these flags (e.g. -ef slow)
-em Exclude these individual modules (e.g. -em ipneighbor)
"""
[[commands.field]]
id = "target"
label = "Target"
description = "Domain, IP, CIDR range or file of targets."
type = "string"
option = ["-t"]
sources = ["docs"]
[[commands.field]]
id = "preset"
label = "Preset"
type = "string"
option = ["-p"]
suggestions = [
{ value = "subdomain-enum", label = "Subdomain enumeration" },
{ value = "spider", label = "Spider" },
{ value = "email-enum", label = "Email enumeration" },
{ value = "web", label = "Web" },
{ value = "kitchen-sink", label = "Kitchen sink" },
]
sources = ["docs"]
[[commands.field]]
id = "flags"
label = "Enable flags"
type = "string"
option = ["-f"]
suggestions = [{ value = "subdomain-enum", label = "subdomain-enum" }]
sources = ["docs"]
[[commands.field]]
id = "require_flags"
label = "Require flag"
type = "string"
option = ["-rf"]
suggestions = [{ value = "passive", label = "passive" }]
sources = ["docs"]
[[commands.field]]
id = "exclude_flags"
label = "Exclude flag"
type = "string"
option = ["-ef"]
suggestions = [{ value = "loud", label = "loud" }, { value = "slow", label = "slow" }]
sources = ["docs"]
[[commands.field]]
id = "modules"
label = "Enable module"
type = "string"
option = ["-m"]
sources = ["docs"]
[[commands.field]]
id = "exclude_modules"
label = "Exclude module"
type = "string"
option = ["-em"]
sources = ["docs"]
[[commands.field]]
id = "blacklist"
label = "Blacklist"
description = "Excluded from the scan even if otherwise in scope."
type = "string"
option = ["-b"]
sources = ["docs"]
[[commands.field]]
id = "name"
label = "Scan name"
type = "string"
option = ["-n"]
sources = ["docs"]
[[commands.field]]
id = "output_dir"
label = "Output directory"
type = "path"
option = ["-o"]
path = { kind = "directory", role = "output" }
sources = ["docs"]
[[commands.field]]
id = "list_modules"
label = "List modules only"
type = "boolean"
option = ["-l"]
sources = ["docs"]
[[commands.task]]
id = "subdomains"
label = "Enumerate subdomains"
fields = ["target", "preset", "require_flags"]
required = ["target"]
set = { preset = ["subdomain-enum"] }
[[commands.task]]
id = "flag_scan"
label = "Scan with module flags"
fields = ["target", "flags", "exclude_flags", "modules"]
required = ["target", "flags"]
[[commands.group]]
id = "basic"
label = "Basic"
fields = ["target", "preset", "flags", "modules"]
[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["require_flags", "exclude_flags", "exclude_modules", "blacklist", "name", "output_dir", "list_modules"]
