BBOT is a multipurpose reconnaissance scanner built to automate recon, bug bounties, and attack surface management through recursive scanning and enumeration.
The tool addresses the need for comprehensive attack surface discovery by combining passive API sources with active reconnaissance techniques like recursive DNS brute-forcing and target-specific subdomain mutations. Its recursive approach means results from one scan phase feed into subsequent phases, progressively uncovering deeper layers of the target infrastructure. The scanner integrates multiple data sources and modules that work together to build a complete picture of an organization's external footprint, with particular strength in subdomain enumeration where it reportedly finds significantly more subdomains than competing tools across various domain sizes.
Organizations running bug bounty programs, performing security assessments, or managing external attack surfaces should consider this tool if they need broad reconnaissance capabilities in a single integrated platform. The tool suits teams that want to move beyond point solutions and need coordinated scanning across multiple reconnaissance vectors including subdomain discovery, web spidering, email gathering, and web vulnerability scanning. The README positions it as inspired by Spiderfoot, indicating it targets similar use cases but with a focus on recursive enumeration and modern attack surface management workflows.
The project maintains active development with regular updates to core functionality and breaking changes between major versions, as evidenced by the migration guide for version transitions. The tool includes performance optimization features like its custom DNS resolver that leverages multiple threads per resolver to accelerate scans. The project provides comprehensive documentation covering installation methods including Docker deployment, detailed scanning tips, and architectural explanations of how the recursive scanning approach works. Output is flexible with multiple preset configurations for different scanning scenarios, from focused subdomain enumeration to comprehensive full-scope assessments.
