How do I keep module recursion in scope?

Set --whitelist and --blacklist, and enable --strict-scope when subdomains of the target should not expand the scope. Defaults treat --targets as the whitelist.

When should I use bbot vs subfinder or amass?

Use bbot for a multi-module chain from one seed. Prefer subfinder for a lean passive subdomain step. Prefer amass when you want deep subdomain and infrastructure mapping without bbot's wider module mix.

What do --json and --output-modules produce?

bbot writes a folder of scan data. --json emits JSON events; --output-modules can add sinks such as json, csv, or subdomains for structured handoff to later nodes.

How do I run a passive-only subdomain pass?

Seed with --targets, set --require-flags passive, and choose a subdomain-focused --preset or modules. That keeps the chain on quiet OSINT without active probing.

Updated Jul 15, 2026

Recon

Chain OSINT modules from a seed into a surface map

Modular OSINT recon that chains modules from a seed target.

Sweep an attack surface in one run Dial scan aggression with flags Keep recursion in scope

overview

What bbot does

Seed bbot with --targets. Modules feed each other: a subdomain find becomes DNS input, hosts feed port checks, ports feed web modules. One seed expands into connected subdomains, IPs, ports, and exposures.

Dial aggression with --flags, --require-flags, or a --preset. --whitelist, --blacklist, and --strict-scope keep recursion inside cleared assets. --output-modules and --json shape how results land.

Broad by design next to a single-step tool like subfinder. The managed recon node takes --targets and writes a folder of scan data for downstream triage.

source github.com/blacklanternsecurity/bbot

use cases

Where bbot fits

Sweep an attack surface in one run

Seed bbot with a domain and let its modules chain from subdomains to hosts to ports to web exposures for a connected surface map.

Dial scan aggression with flags

Require the passive flag for a quiet pass, or allow aggressive and deadly modules for a deeper authorized sweep, all from the flag set.

Keep recursion in scope

Use whitelist, blacklist, and strict-scope so module-to-module expansion stays within the assets you are cleared to test.

Emit structured results for triage

Turn on JSON output and the relevant output modules so findings land as structured data the rest of a workflow can query and route.

reference

bbot inputs and flags

39 inputs

Name	Type	Flag	Description
targets	FILE	--targets	Targets to seed the scan.
preset	STRING	--preset	Enable one or more BBOT presets.
flags	STRING	--flags	Enable modules by flag.
modules	STRING	--modules	Modules to enable.
whitelist	STRING	--whitelist	What is considered in scope (defaults to --targets).
blacklist	STRING	--blacklist	Targets to never touch.
output-modules	STRING	--output-modules	Output modules, e.g. json, csv, subdomains, http, neo4j.
json	BOOLEAN	--json	Output scan data in JSON format.

Showing key inputs. bbot exposes 39 inputs in total.

Full flag reference (39 inputs)

Name	Type	Flag	Description
json	BOOLEAN	--json	Output scan data in JSON format
name	STRING	--name	Name of scan (default: random)
brief	BOOLEAN	--brief	Output only the data itself
debug	BOOLEAN	--debug	Enable debugging
flags	STRING	--flags	Enable modules by flag.
force	BOOLEAN	--force	Run scan even if module setups fail
proxy	STRING	--proxy	Use this proxy for all HTTP requests
config	STRING	--config	configuration options in key=value format: 'modules.shodan.api_key=1234'
preset	STRING	--preset	Enable BBOT preset(s)
silent	BOOLEAN	--silent	Be quiet
dry-run	BOOLEAN	--dry-run	Abort before executing scan
modules	STRING	--modules	Modules to enable.
no-deps	BOOLEAN	--no-deps	Don't install module dependencies
targets	FILE	--targets	Targets to seed the scan
verbose	BOOLEAN	--verbose	Be more verbose
blacklist	STRING	--blacklist	Don't touch these things
whitelist	STRING	--whitelist	What's considered in-scope (by default it's the same as --targets)
force-deps	BOOLEAN	--force-deps	Force install all module dependencies
list-flags	BOOLEAN	--list-flags	List available flags.
retry-deps	BOOLEAN	--retry-deps	Try again to install failed module dependencies
user-agent	STRING	--user-agent	Set the user-agent for all HTTP requests
event-types	STRING	--event-types	Choose which event types to display
exclude-cdn	BOOLEAN	--exclude-cdn	Filter out unwanted open ports on CDNs/WAFs (80,443 only)
allow-deadly	BOOLEAN	--allow-deadly	Enable the use of highly aggressive modules
list-modules	BOOLEAN	--list-modules	List available modules.
list-presets	BOOLEAN	--list-presets	List available presets.
strict-scope	BOOLEAN	--strict-scope	Don't consider subdomains of target/whitelist to be in-scope
exclude-flags	STRING	--exclude-flags	Disable modules with these flags. (e.g. -ef aggressive)
require-flags	STRING	--require-flags	Only enable modules with these flags (e.g. -rf passive)
current-preset	BOOLEAN	--current-preset	Show the current preset in YAML format
custom-cookies	STRING	--custom-cookies	List of custom cookies as key value pairs (cookie=value).
custom-headers	STRING	--custom-headers	List of custom headers as key value pairs (header=value).
output-modules	STRING	--output-modules	Output module(s). Choices: asset_inventory,csv,discord,emails,http,json,mysql,neo4j,nmap_xml,postgres,python,slack,splunk,sqlite,stdout,subdomains,teams,txt,web_parameters,web_report,websocket
exclude-modules	STRING	--exclude-modules	Exclude these modules.
install-all-deps	BOOLEAN	--install-all-deps	Install dependencies for all modules
custom-yara-rules	FILE	--custom-yara-rules	Add custom yara rules to excavate
ignore-failed-deps	BOOLEAN	--ignore-failed-deps	Run modules even if they have failed dependencies
current-preset-full	BOOLEAN	--current-preset-full	Show the current preset in its full form, including defaults
list-module-options	BOOLEAN	--list-module-options	Show all module config options

example

Run bbot

bbot · command

# passive preset against a seed domain, JSON eventsbbot --targets example.com --preset subdomain-enum --require-flags passive --json --name example-scan

sample output

[INFO] Scan example-scan started against example.com[DNS_NAME] example.com (TARGET)[DNS_NAME] www.example.com[DNS_NAME] api.example.com[DNS_NAME] mail.example.com[DNS_NAME] staging.example.com[OPEN_TCP_PORT] api.example.com:443[URL] https://api.example.com/[TECHNOLOGY] nginx on api.example.com[INFO] Scan finished: 48 events

guidance

Choosing bbot

Reach for bbot when one seed should fan out through many recon modules into a connected surface map. Scope with --whitelist and --flags. For a single passive subdomain step, subfinder is leaner.

amass

Deep OSINT focused on subdomain and infrastructure mapping. bbot chains a wider mix of module types from one seed.

spiderfoot

Another modular OSINT automation framework. Same goal, different module ecosystem and UI.

subfinder

Passive subdomain discovery only. Prefer it when you need one lean step, not a full module chain.

faq

bbot questions

Use --flags to enable module groups, --require-flags or --exclude-flags to gate them, or load a --preset. Require passive for quiet OSINT; add --allow-deadly only on authorized scopes that need highly aggressive modules.

Run bbot yourself

A seed target feeds bbot, which chains its OSINT modules to expand the surface and writes the connected scan data as a queryable output folder.

Run bbot in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

targets

FILE

--targets

Targets to seed the scan.

preset

STRING

--preset

Enable one or more BBOT presets.

flags

STRING

--flags

Enable modules by flag.

modules

STRING

--modules

Modules to enable.

whitelist

STRING

--whitelist

What is considered in scope (defaults to --targets).

blacklist

STRING

--blacklist

Targets to never touch.

output-modules

STRING

--output-modules

Output modules, e.g. json, csv, subdomains, http, neo4j.

json

BOOLEAN

--json

Output scan data in JSON format.

Name

Type

Flag

Description

json

BOOLEAN

--json

Output scan data in JSON format

name

STRING

--name

Name of scan (default: random)

brief

BOOLEAN

--brief

Output only the data itself

debug

BOOLEAN

--debug

Enable debugging

flags

STRING

--flags

Enable modules by flag.

force

BOOLEAN

--force

Run scan even if module setups fail

proxy

STRING

--proxy

Use this proxy for all HTTP requests

config

STRING

--config

configuration options in key=value format: 'modules.shodan.api_key=1234'

preset

STRING

--preset

Enable BBOT preset(s)

silent

BOOLEAN

--silent

Be quiet

dry-run

BOOLEAN

--dry-run

Abort before executing scan

modules

STRING

--modules

Modules to enable.

no-deps

BOOLEAN

--no-deps

Don't install module dependencies

targets

FILE

--targets

Targets to seed the scan

verbose

BOOLEAN

--verbose

Be more verbose

blacklist

STRING

--blacklist

Don't touch these things

whitelist

STRING

--whitelist

What's considered in-scope (by default it's the same as --targets)

force-deps

BOOLEAN

--force-deps

Force install all module dependencies

list-flags

BOOLEAN

--list-flags

List available flags.

retry-deps

BOOLEAN

--retry-deps

Try again to install failed module dependencies

user-agent

STRING

--user-agent

Set the user-agent for all HTTP requests

event-types

STRING

--event-types

Choose which event types to display

exclude-cdn

BOOLEAN

--exclude-cdn

Filter out unwanted open ports on CDNs/WAFs (80,443 only)

allow-deadly

BOOLEAN

--allow-deadly

Enable the use of highly aggressive modules

list-modules

BOOLEAN

--list-modules

List available modules.

list-presets

BOOLEAN

--list-presets

List available presets.

strict-scope

BOOLEAN

--strict-scope

Don't consider subdomains of target/whitelist to be in-scope

exclude-flags

STRING

--exclude-flags

Disable modules with these flags. (e.g. -ef aggressive)

require-flags

STRING

--require-flags

Only enable modules with these flags (e.g. -rf passive)

current-preset

BOOLEAN

--current-preset

Show the current preset in YAML format

custom-cookies

STRING

--custom-cookies

List of custom cookies as key value pairs (cookie=value).

custom-headers

STRING

--custom-headers

List of custom headers as key value pairs (header=value).

output-modules

STRING

--output-modules

Output module(s). Choices: asset_inventory,csv,discord,emails,http,json,mysql,neo4j,nmap_xml,postgres,python,slack,splunk,sqlite,stdout,subdomains,teams,txt,web_parameters,web_report,websocket

exclude-modules

STRING

--exclude-modules

Exclude these modules.

install-all-deps

BOOLEAN

--install-all-deps

Install dependencies for all modules

custom-yara-rules

FILE

--custom-yara-rules

Add custom yara rules to excavate

ignore-failed-deps

BOOLEAN

--ignore-failed-deps

Run modules even if they have failed dependencies

current-preset-full

BOOLEAN

--current-preset-full

Show the current preset in its full form, including defaults

list-module-options

BOOLEAN

--list-module-options

Show all module config options

[INFO] Scan example-scan started against example.com[DNS_NAME] example.com (TARGET)[DNS_NAME] www.example.com[DNS_NAME] api.example.com[DNS_NAME] mail.example.com[DNS_NAME] staging.example.com[OPEN_TCP_PORT] api.example.com:443[URL] https://api.example.com/[TECHNOLOGY] nginx on api.example.com[INFO] Scan finished: 48 events

Chain OSINT modules from a seed into a surface map

What bbot does

Where bbot fits

Sweep an attack surface in one run

Dial scan aggression with flags

Keep recursion in scope

Emit structured results for triage

bbot inputs and flags

Run bbot

Choosing bbot

amass

spiderfoot

subfinder

bbot questions

More Recon tools

amass

assetfinder

bevigil

cloud-enum

cloudlist

dnsrecon

Run bbot yourself

Chain OSINT modules from a seed into a surface map

What bbot does

Where bbot fits

Sweep an attack surface in one run

Dial scan aggression with flags

Keep recursion in scope

Emit structured results for triage

bbot inputs and flags

Run bbot

Choosing bbot

amass

spiderfoot

subfinder

bbot questions

More Recon tools

amass

assetfinder

bevigil

cloud-enum

cloudlist

dnsrecon

Run bbot yourself