面向黑客的递归互联网扫描器。🧡
[](https://github.com/blacklanternsecurity/bbot)
[](https://www.python.org) [](https://github.com/blacklanternsecurity/bbot/blob/dev/LICENSE) [](https://pepy.tech/project/bbot) [](https://github.com/astral-sh/ruff) [](https://github.com/blacklanternsecurity/bbot/actions?query=workflow%3A"tests") [](https://codecov.io/gh/blacklanternsecurity/bbot) [](https://discord.com/invite/PZqkgxu5SA)
### **BEE·bot** 是一个多功能扫描器，灵感来自 [Spiderfoot](https://github.com/smicallef/spiderfoot)，旨在自动化你的**侦察**、**漏洞赏金**和**ASM**！
https://github.com/blacklanternsecurity/bbot/assets/20261699/e539e89b-92ea-46fa-b893-9cde94eebf81
_实时 BBOT 扫描 - 使用 [VivaGraphJS](https://github.com/blacklanternsecurity/bbot-vivagraphjs) 进行可视化_
## 安装
```bash
# stable version
pipx install bbot
# bleeding edge (dev branch)
pipx install --pip-args '\--pre' bbot
```
_更多安装方式，包括 [Docker](https://hub.docker.com/r/blacklanternsecurity/bbot)，请参阅 [开始使用](https://www.blacklanternsecurity.com/bbot/Stable/)_
> **从 2.x 升级？** BBOT 3.0 包含对 CLI、预设、模块、事件和 Python API 的破坏性更改。升级前请参阅 [2.x → 3.0 迁移指南](https://www.blacklanternsecurity.com/bbot/Stable/migration/3.0_breaking_changes/)（[来源](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/migration/3.0_breaking_changes.md)）。
> **提速提示：** BBOT 的 DNS 解析器（[blastdns](https://github.com/blacklanternsecurity/blastdns)）会为 `/etc/resolv.conf` 中的每个解析器启动多个线程。添加更多无过滤的解析器可大幅加快扫描速度。详见 [示例 resolv.conf](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/data/resolv-sample.conf) 和 [技巧与诀窍](https://www.blacklanternsecurity.com/bbot/Stable/scanning/tips_and_tricks/#speed-up-scans-with-more-dns-resolvers)。
## 示例命令
### 1) 子域名发现
被动 API 源，以及使用目标特定子域名变异的递归 DNS 暴力破解。
```bash
# find subdomains of evilcorp.com
bbot -t evilcorp.com -p subdomain-enum
# passive sources only
bbot -t evilcorp.com -p subdomain-enum -rf passive
```
<!-- BBOT SUBDOMAIN-ENUM PRESET EXPANDABLE -->
<details>
<summary><b><code>subdomain-enum.yml</code></b></summary>
```yaml
description: Enumerate subdomains via APIs, brute-force
flags:
# enable every module with the subdomain-enum flag
- subdomain-enum
output_modules:
# output unique subdomains to TXT file
- subdomains
config:
dns:
threads: 25
brute_threads: 1000
# put your API keys here
# modules:
# github:
# api_key: ""
# chaos:
# api_key: ""
# securitytrails:
# api_key: ""
```
</details>
<!-- END BBOT SUBDOMAIN-ENUM PRESET EXPANDABLE -->
BBOT 始终能比其他工具多发现 20-50% 的子域名。域名越大，差异越大。想了解这是如何实现的，请参阅[工作原理](https://www.blacklanternsecurity.com/bbot/Stable/how_it_works/)。
### 2) Web 爬虫
```bash
# crawl evilcorp.com, extracting emails and other goodies
bbot -t evilcorp.com -p spider
```
<!-- BBOT SPIDER PRESET EXPANDABLE -->
<details>
<summary><b><code>spider.yml</code></b></summary>
```yaml
description: Recursive web spider
modules:
- http
blacklist:
# Prevent spider from invalidating sessions by logging out
- "RE:/.*(sign|log)[_-]?out"
config:
web:
# how many links to follow in a row
spider_distance: 2
# don't follow links whose directory depth is higher than 4
spider_depth: 4
# maximum number of links to follow per page
spider_links_per_page: 25
```
</details>
<!-- END BBOT SPIDER PRESET EXPANDABLE -->
### 3) 邮箱收集器
```bash
# quick email enum with free APIs + scraping
bbot -t evilcorp.com -p email-enum
# pair with subdomain enum + web spider for maximum yield
bbot -t evilcorp.com -p email-enum subdomain-enum spider
```
<!-- BBOT EMAIL-ENUM PRESET EXPANDABLE -->
<details>
<summary><b><code>email-enum.yml</code></b></summary>
```yaml
description: Enumerate email addresses from APIs, web crawling, etc.
flags:
- email-enum
output_modules:
- emails
```
</details>
<!-- END BBOT EMAIL-ENUM PRESET EXPANDABLE -->
### 4) Web 扫描器
```bash
# run a light web scan against www.evilcorp.com
bbot -t www.evilcorp.com -p web
# run a heavy web scan against www.evilcorp.com
bbot -t www.evilcorp.com -p web-heavy
```
<!-- BBOT WEB PRESET EXPANDABLE -->
<details>
<summary><b><code>web.yml</code></b></summary>
```yaml
description: Quick web scan
include:
- iis-shortnames
flags:
- web
```
</details>
<!-- END BBOT WEB PRESET EXPANDABLE -->
<!-- BBOT WEB-HEAVY PRESET EXPANDABLE -->
<details>
<summary><b><code>web-heavy.yml</code></b></summary>
```yaml
description: Aggressive web scan
include:
# include the web preset
- web
flags:
- web-heavy
```
</details>
<!-- END BBOT WEB-HEAVY PRESET EXPANDABLE -->
### 5) 包罗万象（Everything Everywhere All at Once）
```bash
# everything everywhere all at once
bbot -t evilcorp.com -p kitchen-sink
# roughly equivalent to:
bbot -t evilcorp.com -p subdomain-enum cloud-enum code-enum email-enum spider web paramminer webbrute web-screenshots
```
<!-- BBOT KITCHEN-SINK PRESET EXPANDABLE -->
<details>
<summary><b><code>kitchen-sink.yml</code></b></summary>
```yaml
description: Everything everywhere all at once
include:
- subdomain-enum
- cloud-enum
- code-enum
- email-enum
- spider
- web
- paramminer
- webbrute
- web-screenshots
- baddns-heavy
config:
modules:
dnsbrute:
recursive_mutations: true
dnscommonsrv:
recursive_mutations: true
webbrute:
avoid_wafs: False
wayback:
urls: True
parameters: True
archive: True
```
</details>
<!-- END BBOT KITCHEN-SINK PRESET EXPANDABLE -->
## 工作原理
点击下方图表，探索 BBOT 的[内部工作原理](https://www.blacklanternsecurity.com/bbot/Stable/how_it_works/)。
[](https://www.blacklanternsecurity.com/bbot/Stable/how_it_works/)
## 输出模块
- [Neo4j](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/scanning/output.md#neo4j)
- [Teams](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/scanning/output.md#teams)
- [Discord](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/scanning/output.md#discord)
- [Slack](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/scanning/output.md#slack)
- [Postgres](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/scanning/output.md#postgres)
- [MySQL](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/scanning/output.md#mysql)
- [SQLite](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/scanning/output.md#sqlite)
- [Splunk](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/scanning/output.md#splunk)
- [Elasticsearch](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/scanning/output.md#elasticsearch)
- [CSV](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/scanning/output.md#csv)
- [JSON](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/scanning/output.md#json)
- [HTTP](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/scanning/output.md#http)
- [Websocket](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/scanning/output.md#websocket)
……以及[更多](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/scanning/output.md)！
## 将 BBOT 用作 Python 库
#### 同步
```python
from bbot.scanner import Scanner
if __name__ == "__main__":
scan = Scanner("evilcorp.com", presets=["subdomain-enum"])
for event in scan.start():
print(event)
```
#### 异步
```python
from bbot.scanner import Scanner
async def main():
scan = Scanner("evilcorp.com", presets=["subdomain-enum"])
async for event in scan.async_start():
print(event.json())
if __name__ == "__main__":
import asyncio
asyncio.run(main())
```
<details>
<summary><b>看看：这个邪恶的 Discord 机器人</b></summary>
一个响应 `/scan` 命令的 [BBOT Discord 机器人](https://www.blacklanternsecurity.com/bbot/Stable/dev/#discord-bot-example)。在舒适的 Discord 服务器中扫描互联网！
</details>
## 功能概览
- 支持多个目标
- Web 截图
- 一系列攻击性 Web 模块
- NLP 驱动的子域名变异
- 原生输出到 Neo4j（以及更多）
- 使用 Ansible 自动安装依赖
- 使用自定义 YARA 规则搜索整个攻击面
- Python API + 开发者文档
## 目标
BBOT 通过 `-t` 接受无限数量的目标。你可以在命令行中直接指定目标，也可以在文件中指定（或两者都行！）：
```bash
bbot -t evilcorp.com evilcorp.org 1.2.3.0/24 -p subdomain-enum
```
目标可以是以下任意类型：
- DNS 名称 (`evilcorp.com`)
- IP 地址 (`1.2.3.4`)
- IP 范围 (`1.2.3.0/24`)
- 开放的 TCP 端口 (`192.168.0.1:80`)
- URL (`https://www.evilcorp.com`)
- 邮箱地址 (`[email protected]`)
- 组织 (`ORG:evilcorp`)
- 用户名 (`USER:bobsmith`)
- 文件系统 (`FILESYSTEM:/tmp/asdf`)
- 移动应用 (`MOBILE_APP:https://play.google.com/store/apps/details?id=com.evilcorp.app`)
更多信息，请参阅[目标](https://www.blacklanternsecurity.com/bbot/Stable/scanning/#targets-t)。要了解 BBOT 如何处理范围，请参阅[范围](https://www.blacklanternsecurity.com/bbot/Stable/scanning/#scope)。
## API 密钥
与 Amass 或 Subfinder 类似，BBOT 支持各种第三方服务（如 SecurityTrails 等）的 API 密钥。
标准做法是在 **`~/.config/bbot/secrets.yml`** 中输入你的 API 密钥。注意，允许多个 API 密钥：
```yaml
modules:
shodan_dns:
api_key: 4f41243847da693a4f356c0486114bc6
c99:
# multiple API keys
api_key:
- 21a270d5f59c9b05813a72bb41707266
- ea8f243d9885cf8ce9876a580224fd3c
- 5bc6ed268ab6488270e496d3183a1a27
virustotal:
api_key: dd5f0eee2e4a99b71a939bded450b246
securitytrails:
api_key: d9a05c3fd9a514497713c54b4455d0b0
```
如果你愿意，也可以在命令行中指定它们：
```bash
bbot -c modules.virustotal.api_key=dd5f0eee2e4a99b71a939bded450b246
```
详细信息请参阅[配置](https://www.blacklanternsecurity.com/bbot/Stable/scanning/configuration/)。
## 模块、标志等的完整列表
- [模块](https://www.blacklanternsecurity.com/bbot/Stable/modules/list_of_modules/)的完整列表。
- [标志](https://www.blacklanternsecurity.com/bbot/Stable/scanning/#list-of-flags)的完整列表。
- [预设](https://www.blacklanternsecurity.com/bbot/Stable/scanning/presets_list/)的完整列表。
- [全局配置选项](https://www.blacklanternsecurity.com/bbot/Stable/scanning/configuration/#global-config-options)的完整列表。
- [模块配置选项](https://www.blacklanternsecurity.com/bbot/Stable/scanning/configuration/#module-config-options)的完整列表。
## 文档
<!-- BBOT DOCS TOC -->
- **用户手册**
- **基础**
- [开始使用](https://www.blacklanternsecurity.com/bbot/Stable/)
- [工作原理](https://www.blacklanternsecurity.com/bbot/Stable/how_it_works)
- [与其他工具的比较](https://www.blacklanternsecurity.com/bbot/Stable/comparison)
- **扫描**
- [扫描概述](https://www.blacklanternsecurity.com/bbot/Stable/scanning/)
- **预设**
- [概述](https://www.blacklanternsecurity.com/bbot/Stable/scanning/presets)
- [预设列表](https://www.blacklanternsecurity.com/bbot/Stable/scanning/presets_list)
- [事件](https://www.blacklanternsecurity.com/bbot/Stable/scanning/events)
- [输出](https://www.blacklanternsecurity.com/bbot/Stable/scanning/output)
- [技巧与诀窍](https://www.blacklanternsecurity.com/bbot/Stable/scanning/tips_and_tricks)
- [高级用法](https://www.blacklanternsecurity.com/bbot/Stable/scanning/advanced)
- [配置](https://www.blacklanternsecurity.com/bbot/Stable/scanning/configuration)
- [扫描健全性检查](https://www.blacklanternsecurity.com/bbot/Stable/scanning/scan_sanity)
- **模块**
- [模块列表](https://www.blacklanternsecurity.com/bbot/Stable/modules/list_of_modules)
- [内部模块](https://www.blacklanternsecurity.com/bbot/Stable/modules/internal_modules)
- [Nuclei](https://www.blacklanternsecurity.com/bbot/Stable/modules/nuclei)
- [Wayback](https://www.blacklanternsecurity.com/bbot/Stable/modules/wayback)
- [自定义 YARA 规则](https://www.blacklanternsecurity.com/bbot/Stable/modules/custom_yara_rules)
- [Lightfuzz](https://www.blacklanternsecurity.com/bbot/Stable/modules/lightfuzz)
- [Webbrute](https://www.blacklanternsecurity.com/bbot/Stable/modules/webbrute)
- **迁移**
- [2.x → 3.0 破坏性更改](https://www.blacklanternsecurity.com/bbot/Stable/migration/3.0_breaking_changes)
- **杂项**
- [贡献](https://www.blacklanternsecurity.com/bbot/Stable/contribution)
- [发布历史](https://www.blacklanternsecurity.com/bbot/Stable/release_history)
- [故障排除](https://www.blacklanternsecurity.com/bbot/Stable/troubleshooting)
- **开发人员手册**
- [开发概述](https://www.blacklanternsecurity.com/bbot/Stable/dev/)
- [搭建开发环境](https://www.blacklanternsecurity.com/bbot/Stable/dev/dev_environment)
- [核心依赖](https://www.blacklanternsecurity.com/bbot/Stable/dev/core_dependencies)
- [BBOT 内部架构](https://www.blacklanternsecurity.com/bbot/Stable/dev/architecture)
- [如何编写 BBOT 模块](https://www.blacklanternsecurity.com/bbot/Stable/dev/module_howto)
- [验证与检查预设](https://www.blacklanternsecurity.com/bbot/Stable/dev/preset_validation)
- [单元测试](https://www.blacklanternsecurity.com/bbot/Stable/dev/tests)
- [Discord 机器人示例](https://www.blacklanternsecurity.com/bbot/Stable/dev/discord_bot)
- **代码参考**
- [Scanner](https://www.blacklanternsecurity.com/bbot/Stable/dev/scanner)
- [Presets](https://www.blacklanternsecurity.com/bbot/Stable/dev/presets)
- [Event](https://www.blacklanternsecurity.com/bbot/Stable/dev/event)
- [Target](https://www.blacklanternsecurity.com/bbot/Stable/dev/target)
- [BaseModule](https://www.blacklanternsecurity.com/bbot/Stable/dev/basemodule)
- [BBOTCore](https://www.blacklanternsecurity.com/bbot/Stable/dev/core)
- **辅助工具**
- [概述](https://www.blacklanternsecurity.com/bbot/Stable/dev/helpers/)
- [命令](https://www.blacklanternsecurity.com/bbot/Stable/dev/helpers/command)
- [DNS](https://www.blacklanternsecurity.com/bbot/Stable/dev/helpers/dns)
- [Interactsh](https://www.blacklanternsecurity.com/bbot/Stable/dev/helpers/interactsh)
- [杂项](https://www.blacklanternsecurity.com/bbot/Stable/dev/helpers/misc)
- [Web](https://www.blacklanternsecurity.com/bbot/Stable/dev/helpers/web)
- [词云](https://www.blacklanternsecurity.com/bbot/Stable/dev/helpers/wordcloud)
<!-- END BBOT DOCS TOC -->
## 贡献
一些最优秀的 BBOT 模块由社区编写。BBOT 在不断改进，每天都在变得更强大！
我们欢迎贡献。不仅仅是代码，也欢迎想法！如果你有新功能的想法，请到[讨论区](https://github.com/blacklanternsecurity/bbot/discussions)告诉我们。如果你想亲自动手，请参阅[贡献](https://www.blacklanternsecurity.com/bbot/Stable/contribution/)。在那里你可以找到环境搭建说明和如何编写 BBOT 模块的简单教程。我们还有丰富的[开发者文档](https://www.blacklanternsecurity.com/bbot/Stable/dev/)。
感谢这些为 BBOT 做出贡献的了不起的人！:heart:
<p align="center">
<a href="https://github.com/blacklanternsecurity/bbot/graphs/contributors">
<img src="https://contrib.rocks/image?repo=blacklanternsecurity/bbot&max=500">
</a>
</p>
特别感谢：
- 感谢 @TheTechromancer 创建了 BBOT
- 感谢 @liquidsec 在 BBOT 的 Web 攻击功能方面所做的广泛工作，包括 [badsecrets](https://github.com/blacklanternsecurity/badsecrets) 和 [baddns](https://github.com/blacklanternsecurity/baddns)
- 感谢 Steve Micallef (@smicallef) 创建了 Spiderfoot
- 感谢 @kerrymilan 在 Neo4j 和 Ansible 方面的专业知识
- 感谢 @domwhewell-sage 的系列超赞代码拾取模块
- 感谢 @aconite33 和 @amiremami 进行了严格的测试
- 感谢 Aleksei Kornev (@alekseiko) 授予我们对 bbot Pypi 仓库的所有权 <3