Bbot

Open source alternative to Censys ASM

11.1K stars
AGPL-3.0
Active this week
Last commit today

Last verified Nov 14, 2026

Run recursive internet scans for subdomains, emails, and attack surface data, finding 20-50% more subdomains than comparable tools.

Visit website GitHub11.1K

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who Bbot is for#

Bug bounty hunters mapping target scope

Bbot's recursive engine covers the full scope of a bug bounty target in one command, running subdomain enumeration, web spidering, email harvesting, and web scanning together via the kitchen-sink preset. The 20-50% subdomain coverage improvement over single-pass tools means more potential findings from the same scope.

Skip if:

Your target scope is narrowly defined with a single domain and a small known asset list. For limited-scope targets, a faster single-purpose subdomain tool may deliver results with less run time.

Pentesters doing pre-engagement recon

Bbot automates the full recon phase: subdomain discovery, web scanning, email address gathering, and cloud asset enumeration all run from a single preset combination. Output goes directly to Neo4j, Postgres, or CSV for the report without additional processing.

Skip if:

Your engagement has a very narrow scope and tight time constraints. The recursive engine takes longer on larger targets; for quick surface-level enumeration before a short engagement window, a simpler tool fits the schedule better.

Security teams building ASM without a SaaS subscription

Bbot covers subdomain enumeration, cloud asset discovery, web scanning, and OSINT workflows that commercial ASM platforms charge subscription fees for. Run it on a schedule via cron to maintain a snapshot of internet-facing assets. Output to Postgres or Elasticsearch integrates with existing SIEM or alerting infrastructure.

Skip if:

Your team needs continuous automated discovery that runs and alerts without manual scheduling. Bbot scans are on-demand only; a managed ASM platform is a better fit if operational overhead is the constraint.

the problem

The problem it solves#

Manual recon and single-pass subdomain enumeration leave gaps. Standard tools query a fixed set of passive DNS sources in one sweep and stop: they find obvious assets but miss subdomains that only appear when you chain certificate transparency lookups into further DNS brute-force, or cloud asset discovery into web spidering. The bigger the target domain, the larger the gap between a single-pass tool and one that recurses.

Commercial attack surface management platforms address coverage but charge enterprise subscription fees that most individual bug bounty hunters and small security teams cannot justify. Running fresh attack surface scans regularly amplifies the cost: a continuous-discovery SaaS is priced for large enterprise security teams, not for the pentesters and researchers who need the same visibility.

how Bbot solves it

How it solves it#

Recursive Discovery Engine

Each scan module emits typed events into a shared bus. Other modules consume those events and generate further discoveries, chaining outward from every new asset. The result is 20-50% more subdomains found on the same target compared to single-pass scanners, with the gap growing as the target domain gets larger.

Preset-Based Scan Profiles

Built-in presets cover common recon tasks: subdomain-enum for DNS brute-force plus passive API sources, spider for recursive web crawling, email-enum for address harvesting, web and web-heavy for active vulnerability scanning, and kitchen-sink to combine all of them. Presets are YAML files, so custom combinations are straightforward to create.

Multi-Format Target Support

Accepts any combination of DNS names, IP addresses, IP ranges, open TCP ports, URLs, email addresses, organization names, usernames, and more as targets in a single command. A single scan can cover a full organization's internet footprint without running separate commands per asset type.

Flexible Output Destinations

Results export to Neo4j for graph visualization, Postgres, MySQL, or SQLite for SQL queries, Elasticsearch or Splunk for SIEM integration, and Slack, Discord, or Teams for alerting. CSV and JSON are also available. Scan output feeds directly into existing security tooling without custom transformation.

Third-Party API Enrichment

Supports API keys for external enrichment sources including SecurityTrails, Shodan, VirusTotal, Chaos, and C99. Keys are stored in ~/.config/bbot/secrets.yml and multiple keys per service are allowed. Each service adds passive subdomain and threat intelligence data that expands coverage beyond what active DNS probing alone finds.

Python SDK for Custom Automation

Bbot ships a Python API alongside the CLI. Instantiate a Scanner with a target and preset, then iterate over typed events synchronously or with asyncio. This lets you build custom pipelines and integrate scan results into Python-based automation without shell subprocess calls. Developer documentation covers writing custom modules.

strengths · trade-offs

Strengths and trade-offs#

Strengths

20-50% More Subdomains Than Comparable ToolsThe README documents that Bbot consistently finds 20-50% more subdomains than other tools on the same target, with the difference growing for larger domains. Benchmarks included in the project documentation show this against real targets. For bug bounties where any undiscovered asset is a missed finding, that coverage margin is meaningful.
Runs Without Server InfrastructureA single pipx install bbot command gets you running on any Python 3.11+ host. No cloud account, no database setup, and no server provisioning required for basic scanning. For pentesters working from their own machines, this eliminates the operational setup overhead of ASM platforms that require infrastructure before the first scan.
Active Development and Broad Module CoverageThe repo logged its last push on 2026-11-13 with 11,120 GitHub stars and 991 forks. Black Lantern Security maintains it actively, and the community has contributed modules covering subdomain enumeration, web scanning, cloud asset discovery, code repository enumeration, and more. The module list continues to expand.

Trade-offs

-AGPL-3.0 Restricts Redistribution as a ServiceAGPL-3.0 is an OSI-approved copyleft license. You can run Bbot for any internal purpose, including commercial security testing and paid penetration testing engagements. The restriction applies if you distribute a modified version as a network service to others: that use case requires publishing your modifications under AGPL.
-No Built-In Continuous MonitoringBbot runs scans when invoked and has no built-in scheduling or change-detection between runs. Tracking what new assets appeared since the last scan requires external logic or a cron job. Teams that need continuous automated attack surface monitoring will need to build that layer themselves or use a dedicated ASM platform alongside Bbot.
-Scan Speed Requires DNS Resolver TuningThe README notes that Bbot's DNS resolver (blastdns) runs multiple threads per resolver in /etc/resolv.conf, and that adding more unfiltered resolvers dramatically speeds up scans. Default system resolvers are often rate-limited. For large targets, DNS resolver tuning is a required performance step, not an optional one.

versus alternatives

Bbot vs alternatives#

Bbot vs Censys ASM

Both tools target attack surface discovery, but their models differ: Bbot is an open source CLI scanner you run on demand; Censys ASM is a commercial SaaS platform with continuous monitoring.

Feature	Bbot	Censys ASM
License	AGPL-3.0	Proprietary
Deployment	Local CLI or Docker	SaaS only
Cost	Free (self-hosted)	Enterprise subscription
Scanning	On-demand	Continuous
Output	Neo4j, Postgres, Slack, CSV, JSON, and more	Platform dashboard
Subdomain coverage	20-50% more than comparable tools	Broad internet-wide index
API enrichment	SecurityTrails, Shodan, Chaos, and more	Proprietary data sources

Bbot is the better choice when you need targeted recon on a specific scope, want full control over output format and scheduling, or cannot justify a paid subscription. The recursive engine outperforms single-pass tools on subdomain coverage, and the output module system sends results directly into your existing security infrastructure: Neo4j for graph analysis, Postgres or MySQL for querying, Slack or Discord for alerting. Bug bounty hunters and pentesters benefit from running custom preset combinations against any target type, without being constrained to organization profiles in a SaaS dashboard.

Censys ASM is the better fit for enterprise security teams that need continuous automated monitoring, historical exposure data from Censys's proprietary internet-scanning infrastructure, or a managed platform where discovery runs without manual scheduling. If the operational overhead of maintaining and running an open source CLI tool is a constraint, the SaaS model reduces that work.

install · quick start

Quick start#

bash

Install Bbot via pipx for the stable release; a Docker image is also available from Docker Hub.

```bash
pipx install bbot
```

tech stack · detected from GitHub

What it's built on#

Languages: Python

frequently asked

FAQ#

Is Bbot free to use for commercial security testing?

Yes. AGPL-3.0 is an OSI-approved license that permits running Bbot for any internal or commercial purpose, including paid penetration testing engagements and bug bounty work. No subscription or cloud account is required. The AGPL clause only applies if you redistribute a modified version of Bbot as a network service to others.

How does Bbot compare to Subfinder or Amass for subdomain enumeration?

All three enumerate subdomains, but Bbot's recursive approach consistently finds 20-50% more. It chains each discovery back into the scan as a new seed, triggering certificate transparency lookups, DNS brute-force mutations, and passive API queries from every found subdomain. Subfinder and Amass are faster for quick single-pass passive lookups when coverage matters less than speed.

Can Bbot be used for continuous attack surface monitoring?

Not natively. Bbot runs scans on demand and has no built-in scheduling or change tracking between runs. You can invoke it on a cron schedule and pipe results to a database like Postgres, then query that database for changes. For built-in continuous monitoring with native alerting, a dedicated ASM platform handles that more directly.

What third-party API services does Bbot support?

The README lists SecurityTrails, Shodan, VirusTotal, C99, and Chaos as supported enrichment sources. API keys are stored in ~/.config/bbot/secrets.yml. Multiple keys per service are allowed for load distribution. Adding these keys extends passive subdomain and threat intelligence coverage beyond what active DNS probing alone produces. The full module list is in the project documentation.

How do I speed up slow Bbot scans?

The README recommends adding more unfiltered DNS resolvers to /etc/resolv.conf. Bbot's DNS component (blastdns) runs multiple threads per resolver, so more resolvers directly increase DNS throughput. The project provides a sample resolv.conf and a Tips and Tricks guide covering this and other performance settings. This is the most impactful single change for large-scope subdomain scans.

also worth a look

Similar open-source tools#

REA (Reverse Engineer Anything)

Featured

Alternative toRevEng.AI

AI-powered reverse engineering for binaries, apps, and assemblies.

450,612 GitHub stars
Licence MIT

Osv Scanner

Alternative toSnyk

Open source dependency vulnerability scanner backed by OSV.dev

11,510 GitHub stars
Licence Apache-2.0

Talos

InDevOps & CI/CD

Immutable Linux OS for Kubernetes, API-only with no SSH access.

11,521 GitHub stars
Licence MPL-2.0

mRemoteNG

Alternative toDevolutions Remote Desktop Manager

Tabbed multi-protocol remote connections manager for Windows

11,219 GitHub stars
Licence GPL-2.0

Zabbix

Alternative toDatadog

Self-hosted enterprise monitoring with agent and agentless collection.

6,557 GitHub stars
Licence AGPL-3.0

OneUptime

Alternative toDatadog

Uptime, on-call, incidents, logs, and traces; one open source product.

7,819 GitHub stars
Licence Apache-2.0

by category

Open source tools in these categories#

194

Security & Monitoring

REA (Reverse Engineer Anything), RustDesk, Sherlock

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

12,987 GitHub stars
Licence AGPL-3.0
#Email

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

7,869 GitHub stars
Licence Apache-2.0
#AI Agents

SnitchFeed

Live monitoring on LinkedIn, X, Reddit & more. Agentic social listening for startups.

Marketing & Growth

Advertise your product

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

Bbot vs Censys ASM

Both tools target attack surface discovery, but their models differ: Bbot is an open source CLI scanner you run on demand; Censys ASM is a commercial SaaS platform with continuous monitoring.

Feature	Bbot	Censys ASM
License	AGPL-3.0	Proprietary
Deployment	Local CLI or Docker	SaaS only
Cost	Free (self-hosted)	Enterprise subscription
Scanning	On-demand	Continuous
Output	Neo4j, Postgres, Slack, CSV, JSON, and more	Platform dashboard
Subdomain coverage	20-50% more than comparable tools	Broad internet-wide index
API enrichment	SecurityTrails, Shodan, Chaos, and more	Proprietary data sources