面向黑客的递归互联网扫描器。🧡
https://github.com/blacklanternsecurity/bbot/assets/20261699/e539e89b-92ea-46fa-b893-9cde94eebf81
实时进行的 BBOT 扫描——使用 VivaGraphJS 进行可视化
# stable version
pipx install bbot
# bleeding edge (dev branch)
pipx install --pip-args '\--pre' bbot
从 3.0 升级？ 请参阅 3.0 → 3.1 迁移指南（源文件），了解可能影响现有预设、配置、自定义模块和输出的变更。
从 2.x 升级？ BBOT 3.0 对 CLI、预设、模块、事件和 Python API 引入了破坏性变更。升级前请参阅 2.x → 3.0 迁移指南（源文件）。
速度提示： BBOT 的 DNS 解析器（blastdns）会为
/etc/resolv.conf中的每个解析器启动多个线程。添加更多未经过滤的解析器可显著加快扫描速度。详情请参阅示例 resolv.conf 和技巧与窍门。
被动 API 来源，加上针对目标特定子域名变异的递归 DNS 暴力破解。
# find subdomains of evilcorp.com
bbot -t evilcorp.com -p subdomain-enum
# passive sources only
bbot -t evilcorp.com -p subdomain-enum -rf passive
subdomain-enum.ymldescription: Enumerate subdomains via APIs, brute-force
flags:
# enable every module with the subdomain-enum flag
- subdomain-enum
output_modules:
# output unique subdomains to TXT file
- subdomains
config:
dns:
brute_threads: 1000
# put your API keys here
# modules:
# github:
# api_key: ""
# chaos:
# api_key: ""
# securitytrails:
# api_key: ""
BBOT 发现的子域名数量始终比其他工具多 20-50%。域名越大，差距越明显。要了解这是如何实现的，请参阅 工作原理。
# crawl evilcorp.com, extracting emails and other goodies
bbot -t evilcorp.com -p spider
spider.ymldescription: Recursive web spider
modules:
- http
blacklist:
# Prevent spider from invalidating sessions by logging out
- "RE:/.*(sign|log)[_-]?out"
config:
web:
# how many links to follow in a row
spider_distance: 2
# don't follow links whose directory depth is higher than 4
spider_depth: 4
# maximum number of links to follow per page
spider_links_per_page: 25
# quick email enum with free APIs + scraping
bbot -t evilcorp.com -p email-enum
# pair with subdomain enum + web spider for maximum yield
bbot -t evilcorp.com -p email-enum subdomain-enum spider
email-enum.ymldescription: Enumerate email addresses from APIs, web crawling, etc.
flags:
- email-enum
output_modules:
- emails
# run a light web scan against www.evilcorp.com
bbot -t www.evilcorp.com -p web
# run a heavy web scan against www.evilcorp.com
bbot -t www.evilcorp.com -p web-heavy
web.ymldescription: Quick web scan
include:
- iis-shortnames
flags:
- web
web-heavy.ymldescription: Aggressive web scan
include:
# include the web preset
- web
flags:
- web-heavy
# everything everywhere all at once
bbot -t evilcorp.com -p kitchen-sink
# roughly equivalent to:
bbot -t evilcorp.com -p subdomain-enum cloud-enum code-enum email-enum spider web paramminer webbrute web-screenshots
kitchen-sink.ymldescription: Everything everywhere all at once
include:
- subdomain-enum
- cloud-enum
- code-enum
- email-enum
- spider
- web
- paramminer
- webbrute
- web-screenshots
- baddns-heavy
config:
modules:
dnsbrute:
recursive_mutations: true
dnscommonsrv:
recursive_mutations: true
webbrute:
avoid_wafs: False
wayback:
urls: True
parameters: True
archive: True
点击下方图表，探索 BBOT 的内部工作原理。
