Menu
BBOT module and preset reference for reconnaissance scanning. Use when choosing which modules, presets, or flags to use for a BBOT scan, or when you need to understand what a specific module does.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
Use when beginning a web assessment from a domain, wildcard, ASN, organization, IP list, or CIDR and measurable attack-surface coverage is needed.
Decision tree for selecting AIRT attacks based on goals, target type, and constraints
Common Active Directory attack chains with tool mappings. Covers Kerberoasting, AS-REP roasting, RBCD, AD CS, DCSync, relay attacks, and credential reuse patterns. Use during exploitation and privilege escalation phases.
Decision tree for Active Directory enumeration. Maps enumeration tasks to tools, defines priority signals, and specifies what findings trigger deeper investigation. Use during the enumeration phase of network operations.
Load when performing network operations or Active Directory exploitation. Enforces enumeration-before-attack discipline, credential verification, trust boundary awareness, scope compliance, reversibility preference, and structured reporting. Prevents premature exploitation, credential misuse, and scope violations.
Direct Caido interaction via the caido-sdk-client Python library, bypassing the Caido MCP server. Prefer this over the caido-proxy MCP skill for efficiency WHEN the SDK is importable in the current runtime. If the import fails, or Caido/the MCP is not loaded, fall back to the caido-proxy skill.
| name | bbot-module-reference |
| description | BBOT module and preset reference for reconnaissance scanning. Use when choosing which modules, presets, or flags to use for a BBOT scan, or when you need to understand what a specific module does. |
Presets are curated combinations of modules for common tasks.
| Preset | Purpose | Key Modules |
|---|---|---|
subdomain-enum | Comprehensive subdomain discovery | anubisdb, certspotter, crt, dnsdumpster, dnsbrute, shodan_dns, securitytrails, wayback, +40 more |
cloud-enum | Cloud resource enumeration (includes subdomain-enum) | bucket_amazon, bucket_azure, bucket_firebase, bucket_google |
code-enum | Git repos, Docker images | github_codesearch, dockerhub, git_clone, postman |
email-enum | Email address harvesting | emailformat, hunterio, pgp, skymem |
| Preset | Purpose | Key Modules |
|---|---|---|
web-basic | Quick web scan for essentials | httpx, wappalyzer, badsecrets, robots, sslcert, ffuf_shortnames |
web-thorough | Aggressive web scan (includes web-basic) | All web-basic + web-thorough flagged modules |
spider | Recursive web crawling | distance:2, depth:4, 25 links/page |
spider-intense | Aggressive spidering | distance:4, depth:6, 50 links/page |
tech-detect | Technology detection only | wappalyzer, nuclei tech templates, fingerprintx |
| Preset | Purpose | Notes |
|---|---|---|
nuclei | Template-based vulnerability scanning | directory_only mode |
nuclei-intense | All URLs with robots/urlscan/wayback | More thorough, slower |
nuclei-technology | Templates matching discovered tech | Targeted based on detected stack |
nuclei-budget | Low-hanging fruit mode | budget:10, fastest nuclei option |
| Preset | Purpose | Notes |
|---|---|---|
dirbust-light | Basic directory brute-force | 1000-line wordlist |
dirbust-heavy | Recursive directory brute-force | 5000-line wordlist, depth:3 |
lightfuzz-light | Basic fuzzing | path, sqli, xss only |
lightfuzz-medium | All fuzzing modules | No POST requests |
lightfuzz-heavy | Intense fuzzing | Includes POST and paramminer |
paramminer | Parameter discovery | Brute-force parameter names |
| Preset | Purpose |
|---|---|
baddns-intense | DNS misconfiguration checks (CNAME, MX, NS, TXT) |
iis-shortnames | IIS shortname enumeration |
dotnet-audit | Comprehensive IIS/.NET scanning |
fast | Minimal discovery, strict scope |
kitchen-sink | Everything combined (use with caution on large targets) |
Flags enable groups of modules sharing a characteristic.
| Flag | Description | Use When |
|---|---|---|
passive | No direct target contact | Stealth required |
safe | Non-intrusive modules only | Production systems |
active | Modules that contact target | Standard engagement |
aggressive | Potentially disruptive | Lab/controlled environment |
subdomain-enum | All subdomain discovery | Comprehensive DNS mapping |
web-basic | Essential web modules | Quick web assessment |
web-thorough | Extended web modules | Deep web analysis |
web-screenshots | Visual capture | Screenshot collection |
portscan | Port scanning | Network service discovery |
cloud-enum | Cloud resources | Cloud-focused targets |
code-enum | Code repositories | OSINT / code leakage |
dnsbrute — Active DNS brute-forcing with wordlistscertspotter / crt — Certificate transparency logsdnsdumpster — DNSDumpster.com queries (passive)wayback — Archive.org historical datashodan_dns — Shodan DNS database (requires API key)securitytrails — Historical DNS records (requires API key)httpx — Fast web service detection, status codes, titlesgowitness — Web page screenshots (configurable resolution)wappalyzer — Technology fingerprintingffuf — Fast web fuzzer for directories/filesnuclei — Template-based vulnerability scannerbucket_amazon / bucket_azure / bucket_google — Storage bucket enumerationazure_realm / azure_tenant — Azure-specific enumerationoauth — OAuth endpoint discoverybadsecrets — Hardcoded secrets/keys detectionbaddns — DNS misconfigurations and potential takeoverslightfuzz — Lightweight vulnerability fuzzinggit / gitdumper — Exposed git repository detection and dumpinggithub_codesearch — Search code for secrets/infodockerhub — Docker image discoverypostman — API documentation discoverysocial — Social media profile enumerationPassive-only subdomain discovery:
targets=["target.com"], presets=["subdomain-enum"], flags=["passive"]
Subdomain enum + basic web scan:
targets=["target.com"], presets=["subdomain-enum", "web-basic"]
Targeted nuclei scan on known hosts:
targets=["api.target.com", "admin.target.com"], presets=["nuclei"]
Technology detection across all subdomains:
targets=["target.com"], presets=["subdomain-enum", "tech-detect"]
Screenshot collection:
targets=["target.com"], modules=["gowitness"], presets=["subdomain-enum"]
Cloud resource hunt:
targets=["target.com"], presets=["cloud-enum"]
Deep web spider on specific app:
targets=["app.target.com"], presets=["spider"], config=["web.spider_distance=2", "web.spider_depth=3"]
Full kitchen sink (small targets only):
targets=["target.com"], presets=["kitchen-sink"]
~/.config/bbot/bbot.yaml for modules like Shodan, SecurityTrails, VirusTotalextra_args=["--strict-scope"] to prevent scope creepextra_args=["--proxy", "http://127.0.0.1:8080"] to route through a proxyextra_args=["--custom-headers", "Authorization=Bearer token"]config=["modules.http.timeout=10"]