How do I control how aggressive it gets?

Use --flags, --require-flags, and --exclude-flags, or load a --preset. Require passive for quiet runs, or add --allow-deadly for highly aggressive modules on authorized scopes.

How do I keep it in scope?

Set --whitelist, --blacklist, and --strict-scope so module-to-module recursion stays within the assets you are allowed to test.

A folder of scan data. With --json and --output-modules such as json, csv, or subdomains, you get structured results downstream nodes can query.

How do I run a passive-only subdomain pass?

Seed with --targets, set --require-flags passive, and enable subdomain-focused output. That keeps the chain on quiet OSINT modules without active probing.

Is bbot an OSINT automation framework?

Yes. It is built for OSINT automation: presets and module flags chain discovery steps so you do not hand-wire each tool.

Updated Jul 15, 2026

Recon

Chain OSINT modules from a seed target into a surface map

OSINT automation for hackers.

Sweep an attack surface in one run Dial scan aggression with flags Keep recursion in scope

overview

What bbot does

bbot runs recon as a graph of modules that feed each other. A subdomain a passive module finds becomes input to a DNS module, whose hosts feed a port module, whose services feed a web module, so a single seed target expands into a connected picture of subdomains, IPs, open ports, and exposures.

Flags and presets control how aggressive a scan gets. Enable modules by flag, require or exclude flags such as passive or aggressive, and use whitelist, blacklist, and strict-scope to keep recursion inside the assets you are allowed to touch. Output modules send results to JSON, CSV, and many other sinks.

Use it as a one-shot attack-surface sweep, or scope it tightly and slot it beside focused tools. On Trickest it is a Recon node that takes seed targets and writes a folder of scan data.

source github.com/blacklanternsecurity/bbot

use cases

Where bbot fits

Sweep an attack surface in one run

Seed bbot with a domain and let its modules chain from subdomains to hosts to ports to web exposures for a connected surface map.

Dial scan aggression with flags

Require the passive flag for a quiet pass, or allow aggressive and deadly modules for a deeper authorized sweep, all from the flag set.

Keep recursion in scope

Use whitelist, blacklist, and strict-scope so module-to-module expansion stays within the assets you are cleared to test.

Emit structured results for triage

Turn on JSON output and the relevant output modules so findings land as structured data the rest of a workflow can query and route.

reference

bbot inputs and flags

39 inputs

Name	Type	Flag	Description
targets	FILE	--targets	Targets to seed the scan.
preset	STRING	--preset	Enable one or more BBOT presets.
flags	STRING	--flags	Enable modules by flag.
modules	STRING	--modules	Modules to enable.
whitelist	STRING	--whitelist	What is considered in scope (defaults to --targets).
blacklist	STRING	--blacklist	Targets to never touch.
output-modules	STRING	--output-modules	Output modules, e.g. json, csv, subdomains, http, neo4j.
json	BOOLEAN	--json	Output scan data in JSON format.

Showing key inputs. bbot exposes 39 inputs in total.

Full flag reference (39 inputs)

Name	Type	Flag	Description
json	BOOLEAN	--json	Output scan data in JSON format
name	STRING	--name	Name of scan (default: random)
brief	BOOLEAN	--brief	Output only the data itself
debug	BOOLEAN	--debug	Enable debugging
flags	STRING	--flags	Enable modules by flag.
force	BOOLEAN	--force	Run scan even if module setups fail
proxy	STRING	--proxy	Use this proxy for all HTTP requests
config	STRING	--config	configuration options in key=value format: 'modules.shodan.api_key=1234'
preset	STRING	--preset	Enable BBOT preset(s)
silent	BOOLEAN	--silent	Be quiet
dry-run	BOOLEAN	--dry-run	Abort before executing scan
modules	STRING	--modules	Modules to enable.
no-deps	BOOLEAN	--no-deps	Don't install module dependencies
targets	FILE	--targets	Targets to seed the scan
verbose	BOOLEAN	--verbose	Be more verbose
blacklist	STRING	--blacklist	Don't touch these things
whitelist	STRING	--whitelist	What's considered in-scope (by default it's the same as --targets)
force-deps	BOOLEAN	--force-deps	Force install all module dependencies
list-flags	BOOLEAN	--list-flags	List available flags.
retry-deps	BOOLEAN	--retry-deps	Try again to install failed module dependencies
user-agent	STRING	--user-agent	Set the user-agent for all HTTP requests
event-types	STRING	--event-types	Choose which event types to display
exclude-cdn	BOOLEAN	--exclude-cdn	Filter out unwanted open ports on CDNs/WAFs (80,443 only)
allow-deadly	BOOLEAN	--allow-deadly	Enable the use of highly aggressive modules
list-modules	BOOLEAN	--list-modules	List available modules.
list-presets	BOOLEAN	--list-presets	List available presets.
strict-scope	BOOLEAN	--strict-scope	Don't consider subdomains of target/whitelist to be in-scope
exclude-flags	STRING	--exclude-flags	Disable modules with these flags. (e.g. -ef aggressive)
require-flags	STRING	--require-flags	Only enable modules with these flags (e.g. -rf passive)
current-preset	BOOLEAN	--current-preset	Show the current preset in YAML format
custom-cookies	STRING	--custom-cookies	List of custom cookies as key value pairs (cookie=value).
custom-headers	STRING	--custom-headers	List of custom headers as key value pairs (header=value).
output-modules	STRING	--output-modules	Output module(s). Choices: asset_inventory,csv,discord,emails,http,json,mysql,neo4j,nmap_xml,postgres,python,slack,splunk,sqlite,stdout,subdomains,teams,txt,web_parameters,web_report,websocket
exclude-modules	STRING	--exclude-modules	Exclude these modules.
install-all-deps	BOOLEAN	--install-all-deps	Install dependencies for all modules
custom-yara-rules	FILE	--custom-yara-rules	Add custom yara rules to excavate
ignore-failed-deps	BOOLEAN	--ignore-failed-deps	Run modules even if they have failed dependencies
current-preset-full	BOOLEAN	--current-preset-full	Show the current preset in its full form, including defaults
list-module-options	BOOLEAN	--list-module-options	Show all module config options

example

Run bbot

bbot · command

# passive preset against a seed domain, JSON eventsbbot --targets example.com --preset subdomain-enum --require-flags passive --json --name example-scan

sample output

[INFO] Scan example-scan started against example.com[DNS_NAME] example.com (TARGET)[DNS_NAME] www.example.com[DNS_NAME] api.example.com[DNS_NAME] mail.example.com[DNS_NAME] staging.example.com[OPEN_TCP_PORT] api.example.com:443[URL] https://api.example.com/[TECHNOLOGY] nginx on api.example.com[INFO] Scan finished: 48 events

guidance

Choosing bbot

Use bbot when you want one engine to chain many recon modules from a seed target into a connected surface map. It is broad by design, so scope it with whitelist and flags. For a single focused step like passive subdomains, a tool like subfinder is leaner.

amass

Deep OSINT focused on subdomain and infrastructure mapping. bbot chains a wider variety of module types.

spiderfoot

Another modular OSINT automation framework. Overlapping goal, different module ecosystem and UI.

subfinder

Passive subdomain discovery only. Leaner when you need one step, not a full module chain.

faq

bbot questions

Its modules feed each other, so one finding triggers the next module automatically and a seed target expands into a connected graph of assets.

Run bbot yourself

A seed target feeds bbot, which chains its OSINT modules to expand the surface and writes the connected scan data as a queryable output folder.

Run bbot in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

targets

FILE

--targets

Targets to seed the scan.

preset

STRING

--preset

Enable one or more BBOT presets.

flags

STRING

--flags

Enable modules by flag.

modules

STRING

--modules

Modules to enable.

whitelist

STRING

--whitelist

What is considered in scope (defaults to --targets).

blacklist

STRING

--blacklist

Targets to never touch.

output-modules

STRING

--output-modules

Output modules, e.g. json, csv, subdomains, http, neo4j.

json

BOOLEAN

--json

Output scan data in JSON format.

Name

Type

Flag

Description

json

BOOLEAN

--json

Output scan data in JSON format

name

STRING

--name

Name of scan (default: random)

brief

BOOLEAN

--brief

Output only the data itself

debug

BOOLEAN

--debug

Enable debugging

flags

STRING

--flags

Enable modules by flag.

force

BOOLEAN

--force

Run scan even if module setups fail

proxy

STRING

--proxy

Use this proxy for all HTTP requests

config

STRING

--config

configuration options in key=value format: 'modules.shodan.api_key=1234'

preset

STRING

--preset

Enable BBOT preset(s)

silent

BOOLEAN

--silent

Be quiet

dry-run

BOOLEAN

--dry-run

Abort before executing scan

modules

STRING

--modules

Modules to enable.

no-deps

BOOLEAN

--no-deps

Don't install module dependencies

targets

FILE

--targets

Targets to seed the scan

verbose

BOOLEAN

--verbose

Be more verbose

blacklist

STRING

--blacklist

Don't touch these things

whitelist

STRING

--whitelist

What's considered in-scope (by default it's the same as --targets)

force-deps

BOOLEAN

--force-deps

Force install all module dependencies

list-flags

BOOLEAN

--list-flags

List available flags.

retry-deps

BOOLEAN

--retry-deps

Try again to install failed module dependencies

user-agent

STRING

--user-agent

Set the user-agent for all HTTP requests

event-types

STRING

--event-types

Choose which event types to display

exclude-cdn

BOOLEAN

--exclude-cdn

Filter out unwanted open ports on CDNs/WAFs (80,443 only)

allow-deadly

BOOLEAN

--allow-deadly

Enable the use of highly aggressive modules

list-modules

BOOLEAN

--list-modules

List available modules.

list-presets

BOOLEAN

--list-presets

List available presets.

strict-scope

BOOLEAN

--strict-scope

Don't consider subdomains of target/whitelist to be in-scope

exclude-flags

STRING

--exclude-flags

Disable modules with these flags. (e.g. -ef aggressive)

require-flags

STRING

--require-flags

Only enable modules with these flags (e.g. -rf passive)

current-preset

BOOLEAN

--current-preset

Show the current preset in YAML format

custom-cookies

STRING

--custom-cookies

List of custom cookies as key value pairs (cookie=value).

custom-headers

STRING

--custom-headers

List of custom headers as key value pairs (header=value).

output-modules

STRING

--output-modules

Output module(s). Choices: asset_inventory,csv,discord,emails,http,json,mysql,neo4j,nmap_xml,postgres,python,slack,splunk,sqlite,stdout,subdomains,teams,txt,web_parameters,web_report,websocket

exclude-modules

STRING

--exclude-modules

Exclude these modules.

install-all-deps

BOOLEAN

--install-all-deps

Install dependencies for all modules

custom-yara-rules

FILE

--custom-yara-rules

Add custom yara rules to excavate

ignore-failed-deps

BOOLEAN

--ignore-failed-deps

Run modules even if they have failed dependencies

current-preset-full

BOOLEAN

--current-preset-full

Show the current preset in its full form, including defaults

list-module-options

BOOLEAN

--list-module-options

Show all module config options

[INFO] Scan example-scan started against example.com[DNS_NAME] example.com (TARGET)[DNS_NAME] www.example.com[DNS_NAME] api.example.com[DNS_NAME] mail.example.com[DNS_NAME] staging.example.com[OPEN_TCP_PORT] api.example.com:443[URL] https://api.example.com/[TECHNOLOGY] nginx on api.example.com[INFO] Scan finished: 48 events

Chain OSINT modules from a seed target into a surface map

What bbot does

Where bbot fits

Sweep an attack surface in one run

Dial scan aggression with flags

Keep recursion in scope

Emit structured results for triage

bbot inputs and flags

Run bbot

Choosing bbot

amass

spiderfoot

subfinder

bbot questions

More Recon tools

aiodnsbrute

amass

amass-intel

amass-json

analyticsrelationships

assetfinder

Run bbot yourself

Chain OSINT modules from a seed target into a surface map

What bbot does

Where bbot fits

Sweep an attack surface in one run

Dial scan aggression with flags

Keep recursion in scope

Emit structured results for triage

bbot inputs and flags

Run bbot

Choosing bbot

amass

spiderfoot

subfinder

bbot questions

More Recon tools

aiodnsbrute

amass

amass-intel

amass-json

analyticsrelationships

assetfinder

Run bbot yourself