01 · Product name
BBOT
Recursive scanner with a passive subdomain preset on Linux.
Published by Black Lantern Security.
In short
BBOT is a free scanner from Black Lantern Security, licensed AGPL-3.0. The docs say Linux is the supported platform and point Windows and macOS users at Docker. The stable install they document is pipx install bbot. A passive subdomain run is bbot -t the domain -p subdomain-enum -rf passive. API keys are optional, and modules without a key soft-fail. A name is not an authorization to scan it, and a passive flag does not by itself make every module quiet.
Product pricing strategy
02
Free
BBOT is free. The project is AGPL-3.0. The getting-started page documents a pipx install for the stable release and a Docker image, and it does not list a seat price, a credit pack, or a hosted subscription. Modules that want a third-party API key say so by soft-failing when the key is missing. Those keys belong to the other services. They are not a BBOT price, and this listing does not quote the other services' fees. If you need a module that cannot run without a key, the cost is that provider's account, which you confirm on that provider's site.
Utility and features
03
BBOT is the command-line scanner documented at blacklanternsecurity.com/bbot. Version 3.0.2 is what pipx installed here and what the getting-started page was showing. The docs say only Linux is supported, and that Windows and macOS are not, unless you use Docker. The passive example in the README is subdomain-enum with -rf passive.
- Presets, then modules. subdomain-enum is a preset. -rf passive keeps the run on modules tagged passive. Keys you did not set are modules you did not run.
- Linux, or Docker. The getting-started page says only Linux is supported, and it points Windows and macOS at Docker.
- Events, not a scope list. A DNS_NAME line is a name a module emitted. Confirm it is in the authorization before you resolve it further or hand it to another tool.
A local run of bbot -t owasp.org -p subdomain-enum -rf passive -y --brief --no-color finished in 1 minute 57 seconds. The log said 31 of 50 modules set up, the rest soft-failed for missing API keys, and the scan saved 61 subdomains. Names in that file include cheatsheetseries.owasp.org, wiki.owasp.org, and docs.owasp.org. The same log warned that the module ipneighbor was enabled and generates a lot of traffic, and it said no port scanner was enabled so it assumed ports 80 and 443. Read that warning before you treat an OPEN_TCP_PORT line as a probe you ordered. The preset can also be pointed at active modules. This listing does not walk through those.
- 1
Install the stable release with pipx, on Linux or in the Docker image the docs describe.
- 2
Run a passive subdomain preset against a domain you are allowed to enumerate. Keep the command with the output.
- 3
Read the setup summary. A soft-fail is a module that did not run. A loud-module warning means the tool still enabled something noisy.
- 4
Diff the subdomain file with Amass or Subfinder. Keep names that both support, and drop names outside the authorization.
Caveats
04
BBOT is a scanner with presets that go well past a passive name list. The passive flag is not a promise that every enabled module is quiet. The owasp.org log warned about a loud module and assumed common web ports. An assumed open port is not a banner and not a vulnerability.
API keys are optional and belong to other companies. A soft-fail means that module contributed nothing. Names can be stale, shared, or outside the organization that owns the seed domain. Scope is the authorization, not the length of the subdomain file. Compare with Amass or Subfinder before you call the list complete.
Screenshots
05
Potential use cases
06
- You are authorized to enumerate one domain passively. Run BBOT with the subdomain-enum preset and -rf passive, and save the subdomain file the log names. On owasp.org that file held 61 names, including wiki and cheatsheetseries hosts. Diff it with Amass or Subfinder. A name that only one tool emits stays a lead until DNS and the authorization agree. Do not feed the file into an exploit tool.
- A module you expected is missing from the results. Read the setup lines. The owasp.org run said 31 of 50 modules set up and the rest soft-failed for missing API keys. That is an empty source, not a negative finding about the domain. Add a key only if you are allowed to use that provider, and record which key was set. Otherwise leave the module failed and say so.
- Someone wants every hostname the preset can invent. Refuse the active presets unless the authorization covers the traffic. The passive run still warned that ipneighbor generates a lot of traffic and assumed ports 80 and 443 because no port scanner was enabled. Quote that log line if an OPEN_TCP_PORT row is being treated as a probe. The docs say Linux is supported and other desktops should use Docker.
Hard cases
The case where the first result is easy to over-read.
The passive log still shows open ports
The scan was started with -rf passive, and the output still contains OPEN_TCP_PORT rows. The log said no port scanner was enabled and that it was assuming 80 and 443. Those rows are assumptions, not a connect scan you can brief as a discovery. Cut them from the finding list, keep the DNS names that the subdomain file actually saved, and say which modules soft-failed. If the authorization forbids even that assumption, stop and use a DNS-only tool.
Questions
Is BBOT free?
Yes. It is AGPL-3.0 software you install. The docs do not sell a seat. Some modules need third-party API keys, and those keys are priced by the other service.
Does -rf passive mean the scan is silent?
No. On the owasp.org run the log still warned that ipneighbor was enabled and generates a lot of traffic, and it assumed ports 80 and 443 because no port scanner was enabled. Read the log.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
BBOT documentation
https://www.blacklanternsecurity.com/bbot/Documentation
BBOT repository
https://github.com/blacklanternsecurity/bbotDocumentation
BBOT getting started
https://www.blacklanternsecurity.com/bbot/Stable/