bbot -t targets.txt -p kitchen-sink --allow-deadly --force -c modules.github_org.api_key=API_KEY_GITHUB,modules.shodan.api_key=API_KEY_SHODAN -o /path/to/bbot/dir/output
By far the most effective way to speed up a BBOT scan is to add more resolvers to /etc/resolv.conf. BBOT's DNS resolver (blastdns) spins up multiple threads per resolver (default: 10, configurable via dns.threads), so more resolvers = more parallelism = faster scans.
For OSINT, it's critical that every resolver is unfiltered. Specialized resolvers that try to block ads, malicious domains, etc. will intentionally omit results. Below is a sample /etc/resolv.conf with 11 unfiltered public resolvers:
# ============================================================================
# Sample /etc/resolv.conf for BBOT
# ============================================================================
#
# BBOT's DNS engine (blastdns) automatically spins up ten workers per
# resolver listed here. Adding more resolvers = more parallelism =
# faster scans.
#
# To use: copy (or append) to /etc/resolv.conf, or point your
# systemd-resolved / resolvconf config at these addresses.
# ============================================================================
# --- Google Public DNS ---
# No filtering, DNSSEC-validating, DoH/DoT capable.
# Huge anycast footprint for geographically relevant answers.
nameserver 8.8.8.8
nameserver 8.8.4.4
# --- Cloudflare 1.1.1.1 ---
# Unfiltered, DNSSEC, very fast, DoH/DoT.
# NOTE: Avoid 1.1.1.2 / 1.1.1.3 -- those variants apply malware
# and adult-content filtering, which will hide results during OSINT.
nameserver 1.1.1.1
nameserver 1.0.0.1
# --- Quad9 (unfiltered) ---
# IMPORTANT: Quad9's main address (9.9.9.9) blocks known-malicious
# domains -- exactly what you do NOT want when pivoting on adversary
# infrastructure. The .10 addresses are their no-blocklist,
# no-DNSSEC-validation variant, which lets you see raw responses
# without validation stripping records.
nameserver 9.9.9.10
nameserver 149.112.112.10
# --- OpenDNS "Sandbox" (unfiltered) ---
# Cisco Umbrella's unfiltered pair. The well-known 208.67.222.222
# enforces category filtering; the .2 addresses do not.
nameserver 208.67.222.2
nameserver 208.67.220.2
# --- Verisign Public DNS ---
# Run by the .com / .net registry operator.
# No filtering, no NXDOMAIN hijacking, DNSSEC.
nameserver 64.6.64.6
nameserver 64.6.65.6
# --- Hurricane Electric ---
# Unfiltered, strong IPv6 support, well-regarded in the netops community.
nameserver 74.82.42.42
# ============================================================================
# IPv6 equivalents (uncomment if your host has IPv6 connectivity)
# ============================================================================
# nameserver 2001:4860:4860::8888 # Google
# nameserver 2001:4860:4860::8844 # Google
# nameserver 2606:4700:4700::1111 # Cloudflare
# nameserver 2606:4700:4700::1001 # Cloudflare
# nameserver 2620:fe::10 # Quad9 (unfiltered)
# nameserver 2620:fe::fe:10 # Quad9 (unfiltered)
# nameserver 2001:470:20::2 # Hurricane Electric
BBot create an output.csv file. It contains all rows tagged with some [value].
Extract OPEN_TCP_PORT:
awk -F ',' '$1 == "OPEN_TCP_PORT" {print $2}' output.csv
Extract domain and subdomain correlated using DNS_NAME:
awk -F ',' '$1 == "DNS_NAME" {print $2}' output.csv
Extract URL:
awk -F ',' '$1 == "URL" {print $2}' output.csv
Extract CODE_REPOSITORY:
awk -F ',' '$1 == "CODE_REPOSITORY" {print $2}' output.csv
Neo4j Cypher Query
If you have used Neo4j output module, here there are some interesting cypher query to do offline:
DNS_NAME entries associated with an OPEN_TCP_PORT, resolves any associated IP_ADDRESSes, and (if a domain resolves to multiple IP addresses) concatenates them into a single cell, separated by ;, to avoid duplicating rows for the same port