BBOT

BBOT runs modules that feed discovered events back into the scan, so each new subdomain, URL or IP can trigger further modules. Presets such as subdomain-enum, email-enum, spider, web and kitchen-sink pick module sets, and a passive-only flag limits a run to third-party sources. Output modules write to files, databases like Neo4j or Postgres, SIEMs and chat webhooks.

• subdomains
• IP addresses
• open ports
• URLs
• emails
• cloud buckets
• code repositories
• web screenshots
• technologies
• vulnerabilities

Has a passive mode and active modes. The active modes need the owner's permission.

README: "# passive sources only" bbot -t example.com -p subdomain-enum -rf passive. The default subdomain-enum preset adds "a recursive DNS brute-force"; the web-heavy preset is described as "Aggressive web scan".

API keys: README: "Similar to Amass or Subfinder, BBOT supports API keys for various third-party services such as SecurityTrails", stored in ~/.config/bbot/secrets.yml or passed with -c.

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

bbot -t example.com -p subdomain-enum

bbot -t example.com -p subdomain-enum -rf passive

bbot -t example.com -p email-enum

Output formats: txt, csv, json, neo4j, postgres, mysql, sqlite, splunk, elasticsearch, http, websocket

Runs these tools under the hood: nuclei, gowitness, blastdns, baddns, badsecrets, FingerprintX

• Docs: "Only Linux is supported at this time. Windows and macOS are not supported"; Docker is suggested for those platforms.
• README: BBOT 3.0 has breaking changes to the CLI, presets, modules, events and Python API versus 2.x.
• Docs: the nuclei module uses ALL templates by default on directory URLs, is tagged loud and invasive, and "no special flag is needed to enable it" (BBOT warns first).
• README: scan speed depends on the DNS resolvers in /etc/resolv.conf.

• FinalRecon: Single Python script for a quick web recon overview: headers, TLS, WHOIS, DNS, subdomains, crawling, directories, Wayback and ports.
• Osmedeus: Go workflow engine that runs security scans defined in YAML, with distributed workers, a web UI and a queryable asset database.
• Recon-ng: Python framework with a Metasploit-style console for modular web-based OSINT, storing harvested data in a per-workspace database.
• reconFTW: Bash orchestrator that chains dozens of recon tools for subdomains, OSINT, web analysis and optional vulnerability checks.
• reNgine: Self-hosted web UI that runs YAML-configured recon scan engines and stores results in a database for filtering and reports.
• sn0int: Rust OSINT framework and module package manager that runs sandboxed Lua modules and stores entities in a typed database.
• SpiderFoot: Python OSINT automation tool with 200+ modules, a web UI and CLI, correlating data about domains, IPs, emails, names and more.