Skip to main content Início Criadores oyi77 1ai-skills bbot-recon
bbot-recon Automated reconnaissance using BBOT (Black Lantern Security's recursive internet scanner). Use when performing bug bounty recon, attack surface management, subdomain enumeration, web.
Ir para a instalação Skills Marketplace Descubra e explore skills de IA criadas pela comunidade.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Mostrar detalhes do prompt Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/oyi77/1ai-skills --skill bbot-reconO comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
Baixar Zip Baixando... Ocupações relacionadas SOC
Baseado na classificação ocupacional SOC
name bbot-recon description Automated reconnaissance using BBOT (Black Lantern Security's recursive internet scanner). Use when performing bug bounty recon, attack surface management, subdomain enumeration, web. domain cybersecurity author oyi77 subdomain penetration-testing tags ["bbot","recon","bug-bounty","subdomain-enum","osint","attack-surface","automation","nuclei","yara"] version 1.0 license AGPL-3.0 nist_csf ["ID.RA-01","ID.RA-02","DE.CM-01"]
BBOT Recon Skill
Overview
BBOT (Bee·bot) is a multipurpose recursive internet scanner by Black Lantern Security, inspired by SpiderFoot. It automates reconnaissance for bug bounties and Attack Surface Management (ASM) with 200+ modules, NLP-powered subdomain mutations, custom YARA rules, Lightfuzz, and native output to Neo4j, SIEMs, and databases. BBOT consistently finds 20-50% more subdomains than competing tools.
When to Use
Trigger phrases:
"bbot recon"
"Starting bug bounty reconnaissance on authorized targets"
"Enumerating subdomains for a target domain"
"Crawling/spidering web applications for endpoint discovery"
Starting bug bounty reconnaissance on authorized targets
Enumerating subdomains for a target domain
Crawling/spidering web applications for endpoint discovery
Gathering emails and OSINT data for social engineering assessments
Mapping attack surface across cloud, code repos, and web assets
Building target profiles for penetration testing engagements
Running custom vulnerability scans with YARA rules
Fuzzing web parameters with Lightfuzz
Correlating findings in graph databases
When NOT to Use
Target has no bug bounty program or written authorization
Simple single-endpoint testing (use nuclei directly)
Real-time monitoring (use dedicated ASM platforms)
Source code review (use SAST tools directly)
Prerequisites
Python 3.9+
pipx (recommended) or pip
Docker (optional, for full stack)
Optional: API keys for enhanced module coverage (Shodan, SecurityTrails, VirusTotal, etc.)
Installation
pipx install bbot
pipx install --pip-args '\--pre' bbot
docker run -it blacklanternsecurity/bbot --help
git clone https://github.com/blacklanternsecurity/bbot.git
cd bbot
docker compose up -d
The Process
Scope the task — define objectives, boundaries, and success criteriaGather information — collect all necessary data and context before proceedingExecute the core workflow — follow the domain-specific steps methodicallyValidate results — verify outputs against expected outcomes or baselinesDocument findings — record results, anomalies, and recommendations
Step 1: Scope Validation Verify the target is authorized before any scanning begins.
Confirm written authorization exists for the target
Define target type: domain, IP, IP range, URL, or organization
Check for rate limiting requirements or testing windows
Record scope in local config for downstream reference
Step 2: Target Configuration BBOT accepts multiple target types:
bbot -t evilcorp.com -p subdomain-enum
bbot -t 1.2.3.0/24 -p subdomain-enum
bbot -t https://www.evilcorp.com -p web-basic
bbot -t ORG:evilcorp -p subdomain-enum
bbot -t USER:bobsmith -p subdomain-enum
bbot -t MOBILE_APP:https://play.google.com/store/apps/details?id =com.evilcorp.app
bbot -t evilcorp.com evilcorp.org 1.2.3.0/24 -p subdomain-enum
bbot -t targets.txt -p subdomain-enum
Step 3: Select Preset BBOT presets are pre-configured scan profiles:
Preset Purpose Modules Enabled subdomain-enumSubdomain discovery APIs, DNS brute-force, mutations spiderWeb crawling Recursive link following, email extraction email-enumEmail gathering APIs, scraping, pattern matching web-basicLight web scan IIS shortnames, basic web modules web-thoroughAggressive web scan All web-basic + deeper analysis cloud-enumCloud asset discovery S3, Azure, GCP bucket enumeration code-enumCode repo discovery GitHub, GitLab secrets/repos paramminerParameter discovery Hidden params, API keys dirbust-lightDirectory brute-force Light directory enumeration web-screenshotsScreenshot capture Visual target mapping kitchen-sinkEverything All above combined
bbot -t evilcorp.com -p subdomain-enum
bbot -t evilcorp.com -p spider
bbot -t evilcorp.com -p kitchen-sink --allow-deadly
bbot -t evilcorp.com -p subdomain-enum spider web-basic
Step 4: Module Selection BBOT has 200+ modules organized by category:
Subdomain Modules
subfinder — Subfinder integrationamass — Amass integrationcrt — Certificate transparencydnscommonsrv — Common SRV recordsmassdns — High-speed DNS resolutionshodan_dns — Shodan DNS lookupvirustotal — VirusTotal subdomainschaos — ProjectDiscovery Chaossecuritytrails — SecurityTrails APIc99 — C99 APIfacebook — Facebook CT logsrapiddns — RapidDNS lookupthreatminer — ThreatMiner intel
Web Modules
httpx — HTTP probingnuclei — Vulnerability scanningparamminer — Parameter discoverydirbust — Directory brute-forcebadsecrets — Secret detectionbaddns — DNS misconfigurationlightfuzz — Web fuzzingffuf — Directory/file fuzzingiis-shortnames — IIS shortname enumerationwappalyzer — Technology detection
OSINT Modules
github — GitHub code/searchgitlab — GitLab code/searchemails — Email harvestingurlscan — URLScan.io integrationwayback — Wayback Machineotx — AlienVault OTXhunterio — Hunter.io emailshibp — Have I Been Pwned
Cloud Modules
bucket_amazon — AWS S3 bucket enumbucket_azure — Azure blob enumbucket_firebase — Firebase enumbucket_google — GCP bucket enumcloudcheckr — Cloud resource discovery
bbot -t evilcorp.com -m subfinder httpx nuclei
bbot -t evilcorp.com -p subdomain-enum -em amass
bbot --list-modules
bbot --list-flags
Step 5: Output Configuration BBOT supports multiple output formats:
bbot -t evilcorp.com -p subdomain-enum -o json
bbot -t evilcorp.com -p subdomain-enum -o csv
bbot -t evilcorp.com -p subdomain-enum -om subdomains
bbot -t evilcorp.com -p subdomain-enum -om neo4j
bbot -t evilcorp.com -p subdomain-enum -om splunk
bbot -t evilcorp.com -p subdomain-enum -om discord
bbot -t evilcorp.com -p subdomain-enum -om slack
bbot -t evilcorp.com -p subdomain-enum -om teams
bbot -t evilcorp.com -p subdomain-enum -om elasticsearch
bbot -t evilcorp.com -p subdomain-enum -om sqlite
bbot -t evilcorp.com -p subdomain-enum -om postgres
bbot -t evilcorp.com -p subdomain-enum -om mysql
bbot -t evilcorp.com -p subdomain-enum -om http
Step 6: API Key Configuration Enhance module coverage with API keys in ~/.config/bbot/bbot.yml:
modules:
shodan_dns:
api_key: YOUR_SHODAN_KEY
virustotal:
api_key: YOUR_VT_KEY
securitytrails:
api_key: YOUR_ST_KEY
github:
api_key: YOUR_GITHUB_KEY
c99:
api_key:
- KEY1
- KEY2
- KEY3
chaos:
api_key: YOUR_CHAOS_KEY
hunterio:
api_key: YOUR_HUNTER_KEY
urlscan:
api_key: YOUR_URLSCAN_KEY
bbot -c modules.virustotal.api_key=YOUR_KEY -t evilcorp.com -p subdomain-enum
Step 7: Advanced Techniques
NLP Subdomain Mutations BBOT uses NLP to generate target-specific subdomain mutations:
bbot -t evilcorp.com -p subdomain-enum
bbot -t evilcorp.com -p subdomain-enum -w /path/to/wordlist.txt
bbot -t evilcorp.com -p subdomain-enum -c dns.disable_mutations=true
Scope Control
bbot -t evilcorp.com -p subdomain-enum --strict-scope
bbot -t evilcorp.com -p subdomain-enum --scope-distance 2
bbot -t evilcorp.com -p subdomain-enum -b "test.evilcorp.com"
Rate Limiting
bbot -t evilcorp.com -p web-thorough --rate-limit 50
bbot -t evilcorp.com -p subdomain-enum -c dns.threads=25 dns.brute_threads=1000
bbot -t evilcorp.com -p web-thorough -c web.request_delay=0.5
Custom YARA Rules BBOT supports custom YARA rules for scanning:
cat > custom.yar << 'EOF'
rule Find_API_Keys {
meta:
description = "Finds potential API keys"
strings:
$key1 = /sk-[a-zA-Z0-9]{32,}/
$key2 = /AKIA[0-9A-Z]{16}/
$key3 = /ghp_[a-zA-Z0-9]{36}/
condition:
any of them
}
EOF
bbot -t evilcorp.com -p spider -c modules.github.yara_rules=custom.yar
Lightfuzz Module BBOT's built-in fuzzer for web parameters:
bbot -t www.evilcorp.com -p web-basic -m lightfuzz
bbot -t www.evilcorp.com -m lightfuzz -c modules.lightfuzz.intensity=high
Nuclei Integration BBOT integrates with Nuclei for vulnerability scanning:
bbot -t evilcorp.com -p subdomain-enum -m nuclei
bbot -t evilcorp.com -p subdomain-enum -m nuclei -c modules.nuclei.templates=/path/to/templates
bbot -t evilcorp.com -p subdomain-enum -m nuclei -c modules.nuclei.severity=high,critical
Interactsh (Out-of-Band Testing) BBOT uses Interactsh for OOB vulnerability detection:
bbot -t evilcorp.com -p web-thorough
bbot -t evilcorp.com -p web-thorough -c interactsh.server=custom.server.com
Step 8: Custom Preset Creation Create reusable scan configurations:
description: Custom bug bounty recon preset
include:
- subdomain-enum
- spider
- web-basic
flags:
- subdomain-enum
- web-basic
modules:
- nuclei
- paramminer
- lightfuzz
config:
dns:
threads: 25
brute_threads: 1000
web:
spider_distance: 3
spider_depth: 5
modules:
nuclei:
severity: high,critical
output_modules:
- json
- subdomains
- neo4j
bbot -t evilcorp.com -p my-recon
Step 9: Python API Usage
from bbot.scanner import Scanner
if __name__ == "__main__" :
scan = Scanner("evilcorp.com" , presets=["subdomain-enum" ])
for event in scan.start():
print (event)
from bbot.scanner import Scanner
async def main ():
scan = Scanner("evilcorp.com" , presets=["subdomain-enum" ])
async for event in scan.async_start():
print (event.json())
if __name__ == "__main__" :
import asyncio
asyncio.run(main())
from bbot.scanner import Scanner
async def main ():
scan = Scanner(
"evilcorp.com" ,
modules=["subfinder" , "httpx" , "nuclei" ],
output_modules=["json" , "neo4j" ],
config={"modules" : {"nuclei" : {"severity" : "high,critical" }}}
)
async for event in scan.async_start():
if event.type == "VULNERABILITY" :
print (f"Found vuln: {event.data} " )
import asyncio
asyncio.run(main())
Step 10: Event Correlation with Neo4j
docker run -d --name neo4j \
-p 7474:7474 -p 7687:7687 \
-e NEO4J_AUTH=neo4j/bbotpassword \
neo4j:community
bbot -t evilcorp.com -p kitchen-sink -om neo4j
MATCH (n:DNS_NAME) RETURN n
MATCH (n:DNS_NAME)-[:RESOLVES_TO]->(ip:IP_ADDRESS)<-[:RESOLVES_TO]-(m:DNS_NAME)
MATCH (n)-[:URL]->(u:URL)
RETURN u
MATCH path=(target:DNS_NAME {data: 'evilcorp.com' })-[*1..3]->(vuln:VULNERABILITY)
RETURN path
Scan Profiles for Bug Bounty Recommended scan profiles by time budget and target type:
Quick Recon (5 min) bbot -t evilcorp.com -p subdomain-enum -rf passive
Standard Recon (30 min) bbot -t evilcorp.com -p subdomain-enum spider email-enum
Deep Recon (2+ hours) bbot -t evilcorp.com -p kitchen-sink --allow-deadly
Web Application Focus bbot -t www.evilcorp.com -p web-thorough paramminer dirbust
Cloud Asset Discovery bbot -t evilcorp.com -p cloud-enum code-enum
Bug Bounty Pipeline
bbot -t evilcorp.com -p subdomain-enum -o json -om subdomains -o subdomains.json
bbot -t subdomains.json -p web-basic -m nuclei lightfuzz
bbot -t interesting_targets.txt -p spider -c web.spider_distance=3
Expected Output BBOT produces structured events:
{
"type" : "DNS_NAME" ,
"data" : "subdomain.evilcorp.com" ,
"module" : "subfinder" ,
"timestamp" : "2024-01-15T10:30:00" ,
"tags" : [ "subdomain" ] ,
"parent" : "evilcorp.com" ,
"scope_distance" : 1
}
DNS_NAME — Discovered subdomainsIP_ADDRESS — Resolved IP addressesURL — Discovered URLs/endpointsEMAIL — Harvested email addressesTECHNOLOGY — Detected technologiesVULNERABILITY — Found vulnerabilitiesFINDING — Security findingsOPEN_TCP_PORT — Open portsSOCIAL — Social media profilesCODE_REPOSITORY — Code repos
Docker Compose Stack Full BBOT stack with Neo4j and output modules:
version: '3.8'
services:
bbot:
image: blacklanternsecurity/bbot:latest
volumes:
- ./bbot_config:/root/.config/bbot
- ./output:/output
command: -t evilcorp.com -p kitchen-sink -om neo4j -o /output
depends_on:
- neo4j
neo4j:
image: neo4j:community
ports:
- "7474:7474"
- "7687:7687"
environment:
NEO4J_AUTH: neo4j/bbotpassword
volumes:
- neo4j_data:/data
volumes:
neo4j_data:
Red Flags
Scanning targets without explicit written authorization
Exceeding rate limits or causing denial of service
Scanning out-of-scope assets
Storing scan results insecurely (contains sensitive data)
Running aggressive scans (--allow-deadly) without understanding implications
Ignoring program-specific rules for bug bounty targets
Exfiltrating data beyond what's needed for the assessment
Verification
Target is explicitly authorized for testing
Scan completed without errors
Output files generated and accessible
API keys configured for enhanced coverage (optional)
Results deduplicated and filtered for actionable findings
Scope compliance documented
Rate limits respected
Integration with Other Skills
bug-hunting — Validate discovered vulnerabilitiesbounty-target-finder — Prioritize targets by payout potentialweb3-auditor — For blockchain/Web3 targetssmart-contract-exploiter — When BBOT discovers Web3 endpointsrecon-automation — Build automated recon pipelines
Troubleshooting Common issues and performance tuning for BBOT scans:
Common Issues
bbot -t evilcorp.com -p subdomain-enum -v
bbot -t evilcorp.com -p subdomain-enum -c dns.server=8.8.8.8
bbot --install-all-deps
bbot --list-modules
bbot -t evilcorp.com -m subfinder -v --debug
Performance Tuning
bbot -t evilcorp.com -p subdomain-enum -c dns.threads=50
bbot -t evilcorp.com -p subdomain-enum -c dns.threads=10
bbot -t evilcorp.com -p web-thorough -c web.max_concurrent=10
References
Process
Analyze the task requirements
Apply domain expertise
Verify output quality
Anti-Rationalization Table Rationalization Reality "We are too small to be targeted" Automated attacks target everyone. Size does not matter. "Security slows us down" A breach slows you down 100x more. Build security in from the start. "We will fix it after launch" Vulnerabilities in production are exploited within hours. Fix before deploy.
