BBOT：一款递归型互联网OSINT资源情报工具

https://github.com/blacklanternsecurity/bbot.git

pipx install bbot

bbot -t evilcorp.com -p subdomain-enumbbot -t evilcorp.com -p subdomain-enum -rf passive

description: Enumerate subdomains via APIs, brute-forceflags:  # enable every module with the subdomain-enum flag  - subdomain-enumoutput_modules:  # output unique subdomains to TXT file  - subdomainsconfig:  dns:    threads: 25    brute_threads: 1000  # put your API keys here  modules:    github:      api_key: ""    chaos:      api_key: ""    securitytrails:      api_key: ""

bbot -t evilcorp.com -p spider

description: Recursive web spidermodules:  - httpxconfig:  web:    # how many links to follow in a row    spider_distance: 2    # don't follow links whose directory depth is higher than 4    spider_depth: 4    # maximum number of links to follow per page    spider_links_per_page: 25电子邮件收集器bbot -t evilcorp.com -p email-enumbbot -t evilcorp.com -p email-enum subdomain-enum spideremail-enum.yml：description: Enumerate email addresses from APIs, web crawling, etc.flags:  - email-enumoutput_modules:  - emails

bbot -t www.evilcorp.com -p web-basicbbot -t www.evilcorp.com -p web-thorough

description: Quick web scaninclude:  - iis-shortnamesflags:  - web-basicweb-thorough.yml：description: Aggressive web scaninclude:  # include the web-basic preset  - web-basicflags:  - web-thorough

bbot -t evilcorp.com -p kitchen-sinkbbot -t evilcorp.com -p subdomain-enum cloud-enum code-enum email-enum spider web-basic paramminer dirbust-light web-screenshots

description: Everything everywhere all at onceinclude:  - subdomain-enum  - cloud-enum  - code-enum  - email-enum  - spider  - web-basic  - paramminer  - dirbust-light  - web-screenshotsconfig:  modules:    baddns:      enable_references: True

from bbot.scanner import Scannerif __name__ == "__main__":    scan = Scanner("evilcorp.com", presets=["subdomain-enum"])    for event in scan.start():        print(event)

from bbot.scanner import Scannerasync def main():    scan = Scanner("evilcorp.com", presets=["subdomain-enum"])    async for event in scan.async_start():        print(event.json())if __name__ == "__main__":    import asyncio    asyncio.run(main())