Recon
Chain OSINT modules from a seed into a surface map
Modular OSINT recon that chains modules from a seed target.
overview
What bbot does
Seed bbot with --targets. Modules feed each other: a subdomain find becomes DNS input, hosts feed port checks, ports feed web modules. One seed expands into connected subdomains, IPs, ports, and exposures.
Dial aggression with --flags, --require-flags, or a --preset. --whitelist, --blacklist, and --strict-scope keep recursion inside cleared assets. --output-modules and --json shape how results land.
Broad by design next to a single-step tool like subfinder. The managed recon node takes --targets and writes a folder of scan data for downstream triage.
use cases
Where bbot fits
Sweep an attack surface in one run
Seed bbot with a domain and let its modules chain from subdomains to hosts to ports to web exposures for a connected surface map.
Dial scan aggression with flags
Require the passive flag for a quiet pass, or allow aggressive and deadly modules for a deeper authorized sweep, all from the flag set.
Keep recursion in scope
Use whitelist, blacklist, and strict-scope so module-to-module expansion stays within the assets you are cleared to test.
Emit structured results for triage
Turn on JSON output and the relevant output modules so findings land as structured data the rest of a workflow can query and route.
reference
bbot inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| targets | FILE | --targets | Targets to seed the scan. |
| preset | STRING | --preset | Enable one or more BBOT presets. |
| flags | STRING | --flags | Enable modules by flag. |
| modules | STRING | --modules | Modules to enable. |
| whitelist | STRING | --whitelist | What is considered in scope (defaults to --targets). |
| blacklist | STRING | --blacklist | Targets to never touch. |
| output-modules | STRING | --output-modules | Output modules, e.g. json, csv, subdomains, http, neo4j. |
| json | BOOLEAN | --json | Output scan data in JSON format. |
Showing key inputs. bbot exposes 39 inputs in total.
Full flag reference (39 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| json | BOOLEAN | --json | Output scan data in JSON format |
| name | STRING | --name | Name of scan (default: random) |
| brief | BOOLEAN | --brief | Output only the data itself |
| debug | BOOLEAN | --debug | Enable debugging |
| flags | STRING | --flags | Enable modules by flag. |
| force | BOOLEAN | --force | Run scan even if module setups fail |
| proxy | STRING | --proxy | Use this proxy for all HTTP requests |
| config | STRING | --config | configuration options in key=value format: 'modules.shodan.api_key=1234' |
| preset | STRING | --preset | Enable BBOT preset(s) |
| silent | BOOLEAN | --silent | Be quiet |
| dry-run | BOOLEAN | --dry-run | Abort before executing scan |
| modules | STRING | --modules | Modules to enable. |
| no-deps | BOOLEAN | --no-deps | Don't install module dependencies |
| targets | FILE | --targets | Targets to seed the scan |
| verbose | BOOLEAN | --verbose | Be more verbose |
| blacklist | STRING | --blacklist | Don't touch these things |
| whitelist | STRING | --whitelist | What's considered in-scope (by default it's the same as --targets) |
| force-deps | BOOLEAN | --force-deps | Force install all module dependencies |
| list-flags | BOOLEAN | --list-flags | List available flags. |
| retry-deps | BOOLEAN | --retry-deps | Try again to install failed module dependencies |
| user-agent | STRING | --user-agent | Set the user-agent for all HTTP requests |
| event-types | STRING | --event-types | Choose which event types to display |
| exclude-cdn | BOOLEAN | --exclude-cdn | Filter out unwanted open ports on CDNs/WAFs (80,443 only) |
| allow-deadly | BOOLEAN | --allow-deadly | Enable the use of highly aggressive modules |
| list-modules | BOOLEAN | --list-modules | List available modules. |
| list-presets | BOOLEAN | --list-presets | List available presets. |
| strict-scope | BOOLEAN | --strict-scope | Don't consider subdomains of target/whitelist to be in-scope |
| exclude-flags | STRING | --exclude-flags | Disable modules with these flags. (e.g. -ef aggressive) |
| require-flags | STRING | --require-flags | Only enable modules with these flags (e.g. -rf passive) |
| current-preset | BOOLEAN | --current-preset | Show the current preset in YAML format |
| custom-cookies | STRING | --custom-cookies | List of custom cookies as key value pairs (cookie=value). |
| custom-headers | STRING | --custom-headers | List of custom headers as key value pairs (header=value). |
| output-modules | STRING | --output-modules | Output module(s). Choices: asset_inventory,csv,discord,emails,http,json,mysql,neo4j,nmap_xml,postgres,python,slack,splunk,sqlite,stdout,subdomains,teams,txt,web_parameters,web_report,websocket |
| exclude-modules | STRING | --exclude-modules | Exclude these modules. |
| install-all-deps | BOOLEAN | --install-all-deps | Install dependencies for all modules |
| custom-yara-rules | FILE | --custom-yara-rules | Add custom yara rules to excavate |
| ignore-failed-deps | BOOLEAN | --ignore-failed-deps | Run modules even if they have failed dependencies |
| current-preset-full | BOOLEAN | --current-preset-full | Show the current preset in its full form, including defaults |
| list-module-options | BOOLEAN | --list-module-options | Show all module config options |
example
Run bbot
# passive preset against a seed domain, JSON eventsbbot --targets example.com --preset subdomain-enum --require-flags passive --json --name example-scan[INFO] Scan example-scan started against example.com[DNS_NAME] example.com (TARGET)[DNS_NAME] www.example.com[DNS_NAME] api.example.com[DNS_NAME] mail.example.com[DNS_NAME] staging.example.com[OPEN_TCP_PORT] api.example.com:443[URL] https://api.example.com/[TECHNOLOGY] nginx on api.example.com[INFO] Scan finished: 48 eventsguidance
Choosing bbot
Reach for bbot when one seed should fan out through many recon modules into a connected surface map. Scope with --whitelist and --flags. For a single passive subdomain step, subfinder is leaner.
amass
Deep OSINT focused on subdomain and infrastructure mapping. bbot chains a wider mix of module types from one seed.
spiderfoot
Another modular OSINT automation framework. Same goal, different module ecosystem and UI.
subfinder
Passive subdomain discovery only. Prefer it when you need one lean step, not a full module chain.
faq
bbot questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
cloudlist
List assets from multiple cloud providers in one inventory.
Run bbot yourself
A seed target feeds bbot, which chains its OSINT modules to expand the surface and writes the connected scan data as a queryable output folder.
Facts on this page come from the live Trickest tool library.