BBOT CLI
BBOT is an external-infrastructure CLI scanner whose findings feed tables or graphs through JSON, CSV and Neo4j output.
- 10,989 ★ on the repository
- Last commit
- AGPL-3.0
Broad access
Why this level
- Active modules automatically probe many external resources and can create load or reach services outside the agreed scope.
Install
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/bbotDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Active modules automatically probe many external resources and can create load or reach services outside the agreed scope.
This is third-party code. Review the repository files before installing.
What it does
BBOT is a modular CLI scanner that gathers external infrastructure evidence using targets and module presets. It discovers subdomains, crawls web pages and relates found assets. Selected workflows combine passive sources and active probes. Multiple targets can include domains and IP ranges. Output includes JSON, CSV and Neo4j for examining asset relationships. An agent can prepare configuration and analyze findings within the owner-approved assessment scope.
Who it is for. Attack-surface specialists inventorying owned domains and authorized web assets.
Good fit when
- An audit needs organization subdomains collected from several sources.
- A team wants to inspect exposed pages and related assets on its own sites.
- An authorized assessment covers multiple domains and address ranges.
- Discovered entities need exporting to a graph or structured report.
Not a fit when
- No scope authorization exists for the external systems involved.
- Active requests are prohibited but an intensive preset is selected.
- You expect every finding to constitute a confirmed exploitable issue.
Example request
Prepare a passive BBOT inventory plan for our authorized domains. Show sources and enabled modules before running.Limitations
Python 3.10 or newer is required, and some modules have additional dependencies installed through Ansible. Certain data sources require personal API keys stored in a local secrets file. Network behavior and intensity depend on the preset, so review enabled modules and traversal boundaries before running. Moving from version 2 to 3 changes the CLI, presets and event format; migrate existing configurations using the project guide.
How to disable. Stop the scan and inspect module child processes. Preserve needed reports when uninstalling and revoke unused source credentials separately.
FAQ
Can I use passive sources only?
Yes. The subdomain example’s `-rf passive` filter selects passive modules. The run configuration defines enabled sources and traversal boundaries.
Can I supply multiple targets?
Yes. `-t` accepts multiple targets or list files. Include only addresses within the approved scope.
Where do source keys go?
In `~/.config/bbot/secrets.yml`. Add them outside chat and exclude the file from reports.
Where can results be sent?
Options include JSON, CSV and Neo4j. Select the output module for your analysis workflow.
Why did an old preset break after updating?
Version 3 changes the CLI and preset fields. Migrate the old configuration using the [2.x migration guide](https://www.blacklanternsecurity.com/bbot/Stable/migration/3.0_breaking_changes/) before running it again.
Discussion
No questions or reviews yet.
Related
CLI toolsAn agentic web scanner: terminal workspace, six stages from recon to report, browser validation of findings, REST and MCP
uncover is a network-asset search CLI that queries external indexes; discovered hosts still need separate availability checks.
Katana is a CLI crawler that saves form and request details as JSONL so crawl results can be processed by other tools.
An OSINT AI agent with an interactive mode, an MCP server and a CLI: about twenty tools to check domains, addresses, hashes and breaches
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
A cyber threat intelligence and OSINT skill: structured investigations, domain and breach recon, analyst-grade reports
README in short
Alongside terminal execution, a Python API exposes scan events for processing in your own Python code.