id = "bbot" name = "BBOT" homepage = "https://github.com/blacklanternsecurity/bbot" description = "The recursive internet scanner for hackers." executables = ["bbot"] [dotfiles] paths = ["~/.config/bbot/bbot.yml"] secret = ["~/.config/bbot/secrets.yml"] # BBOT's configuration guide names bbot.yml for global defaults and secrets.yml # for API keys and other sensitive values. # https://www.blacklanternsecurity.com/bbot/Stable/scanning/configuration/ [commands] format = 1 label = "Run a scan" description = "Scan one target with BBOT presets, flags and modules. Multiple targets, custom config values and output module settings are left out; add them at the prompt." quality = "ai-draft" parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = false, short_bundles = false } [[commands.source]] id = "docs" kind = "manual" url = "https://www.blacklanternsecurity.com/bbot/Stable/scanning/" revision = "stable 2026-10-27" evidence = """ bbot -t evilcorp.com -p subdomain-enum bbot -t evilcorp.com -p subdomain-enum -rf passive bbot -t evilcorp.com -p subdomain-enum -m portscan gowitness -n my_scan -o . bbot -t evilcorp.com -f subdomain-enum -ef loud bbot -t evilcorp.com -f subdomain-enum -em ipneighbor bbot -t evilcorp.com -b internal.evilcorp.com -f subdomain-enum -m portscan nuclei bbot -t evilcorp.com -f subdomain-enum -eom csv txt bbot -f subdomain-enum -l bbot -lp -f Enable these flags (e.g. -f subdomain-enum) -rf Require modules to have this flag (e.g. -rf passive) -ef Exclude these flags (e.g. -ef slow) -em Exclude these individual modules (e.g. -em ipneighbor) """ [[commands.field]] id = "target" label = "Target" description = "Domain, IP, CIDR range or file of targets." type = "string" option = ["-t"] sources = ["docs"] [[commands.field]] id = "preset" label = "Preset" type = "string" option = ["-p"] suggestions = [ { value = "subdomain-enum", label = "Subdomain enumeration" }, { value = "spider", label = "Spider" }, { value = "email-enum", label = "Email enumeration" }, { value = "web", label = "Web" }, { value = "kitchen-sink", label = "Kitchen sink" }, ] sources = ["docs"] [[commands.field]] id = "flags" label = "Enable flags" type = "string" option = ["-f"] suggestions = [{ value = "subdomain-enum", label = "subdomain-enum" }] sources = ["docs"] [[commands.field]] id = "require_flags" label = "Require flag" type = "string" option = ["-rf"] suggestions = [{ value = "passive", label = "passive" }] sources = ["docs"] [[commands.field]] id = "exclude_flags" label = "Exclude flag" type = "string" option = ["-ef"] suggestions = [{ value = "loud", label = "loud" }, { value = "slow", label = "slow" }] sources = ["docs"] [[commands.field]] id = "modules" label = "Enable module" type = "string" option = ["-m"] sources = ["docs"] [[commands.field]] id = "exclude_modules" label = "Exclude module" type = "string" option = ["-em"] sources = ["docs"] [[commands.field]] id = "blacklist" label = "Blacklist" description = "Excluded from the scan even if otherwise in scope." type = "string" option = ["-b"] sources = ["docs"] [[commands.field]] id = "name" label = "Scan name" type = "string" option = ["-n"] sources = ["docs"] [[commands.field]] id = "output_dir" label = "Output directory" type = "path" option = ["-o"] path = { kind = "directory", role = "output" } sources = ["docs"] [[commands.field]] id = "list_modules" label = "List modules only" type = "boolean" option = ["-l"] sources = ["docs"] [[commands.task]] id = "subdomains" label = "Enumerate subdomains" fields = ["target", "preset", "require_flags"] required = ["target"] set = { preset = ["subdomain-enum"] } [[commands.task]] id = "flag_scan" label = "Scan with module flags" fields = ["target", "flags", "exclude_flags", "modules"] required = ["target", "flags"] [[commands.group]] id = "basic" label = "Basic" fields = ["target", "preset", "flags", "modules"] [[commands.group]] id = "advanced" label = "Advanced" fields = ["require_flags", "exclude_flags", "exclude_modules", "blacklist", "name", "output_dir", "list_modules"]