bbot

No entries match these filters. Clear filters

1. docs update Aug 25, 2026 · issue 056

   bbot adds js-audit preset to hunt for leaked credentials and vulnerable JavaScript libraries in client-side code.

   └──▷ TRY IT
   Scan a target web app for leaked credentials and outdated JavaScript libraries using the new built-in preset.
   copy

   $ bbot -t example.com -p js-audit

2. v3.0.2 Aug 24, 2026 · issue 056

   BBOT v3.0.2 adds a new js-audit preset and surfaces HTTP decode errors as tagged decode-error events.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.0.2 https://github.com/blacklanternsecurity/bbot.git
   # already have the repo? check out this version:
   $ git checkout v3.0.2

   └──▷ TRY IT
   Audit JavaScript files for secrets (e.g. API keys, tokens) across a target's web surface using the new js-audit preset.
   copy

   $ bbot -t www.evilcorp.com -p js-audit

   • New js-audit preset at bbot/presets/web/js-audit.yml runs trufflehog against HTTP bodies (streamed via stdin), includes the source URL on findings, and sets _module_threads to 2.
   • Adds decode-error tag to HTTP_RESPONSE events when a response body cannot be decoded, preventing undecoded content from being treated as valid body data.
   • Raises process pool max_tasks_per_child from 25 to 250, enabling more sustained parallel workloads before worker recycling.

   3 details in Everything

3. v3.0.1 Jul 21, 2026 · release notes

   waf_bypass improvements in v3.0.1

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.0.1 https://github.com/blacklanternsecurity/bbot.git
   # already have the repo? check out this version:
   $ git checkout v3.0.1

   • Lower neighbor_cidr default from /24 to /28 in the waf-bypass preset
   • Parallelize WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. bypass checks up to 100 concurrent by default

   2 details in Everything

4. v3.0.0 Jul 8, 2026 · issue 020

   BBOT 3.0 brings new HTTP/DNS engines, unified findings, 10+ new modules, and pydantic-validated config.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.0.0 https://github.com/blacklanternsecurity/bbot.git
   # already have the repo? check out this version:
   $ git checkout v3.0.0

   └──▷ TRY IT
   Regenerate a stale BBOT config file after upgrading to 3.0 to pick up new default keys.
   copy

   $ bbot --reset-config

   • New in-process, rate-limited HTTP engine (blasthttp) replaces the external httpx subprocess for all web traffic.
   • New DNS resolution engine (BlastDNS) with bounded LRU caches and noisy PTR flood filtering.
   • Pydantic-validated config and preset system catches typos and type errors before a scan starts.
   • Scope reworked: -t/--targets defines scope and -s/--seeds drives the scan; ASNs now usable as scan targets.
   • Findings and Vulnerabilities unified into a single event type carrying Severity and Confidence.

   +14 more show less

   • New --reset-config / --reset-secrets flags to regenerate stale config files.
   • New --no-color flag for color-free output.
   • Output modules are now additive; new exclude_output_modules option lets you opt individual modules out.
   • New output modules: MongoDB, Elasticsearch, Kafka, RabbitMQ, ZeroMQZeroMQA messaging library that provides socket-like abstractions for async message passing over TCP, IPC, or in-process transports, letting tools wire together distributed components without a dedicated message broker., and NATS.
   • New legba module for credential brute-forcing across many services.
   • New trajan module for misconfiguration scanning across GitHub, GitLab, Azure DevOps, Jenkins, and JFrog.
   • New virtualhost module for virtual-host fuzzing.
   • New waf_bypass module for WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server.-bypass detection.
   • New shodan_enterprise module for Shodan Enterprise API integration.
   • New Hetzner object-storage bucket enumeration module.
   • Lightfuzz overhaul adds SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. and ESI submodules with a default WAF filter and reduced false positives.
   • HTTP wildcard/catch-all host detection cuts false positives on catch-all servers.
   • Findings de-duplicated in output and a severity breakdown shown in the status line.
   • Supported Python range expanded to 3.10–3.14.

   19 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !-s now means --seeds (not --silent); scripts passing -s for quiet output will instead add a seed with no error. Silent output moved to -S/--silent.
   • !--whitelist was removed; use -t/--targets to define scope.
   • !--allow-deadly was removed.
   • !The noisy flag was renamed to loud (and other flags were similarly renamed).
   • !Module options are now pydantic-validated; the legacy per-module options dict hard-fails on upgrade.
   • !Some event types, event attributes, and config keys were renamed or removed.
   • !Modules wappalyzer, smuggler, digitorus, sitedossier, passivetotal, and wpscan were removed.
5. advisory CVE-2026-12568 Jun 17, 2026 · issue 128
   • CVE-2026-12568: Arbitrary File Write in postman_download Module (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= 2.1.0, <= 2.8.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
6. advisory CVE-2026-12565 Jun 17, 2026 · issue 128
   • CVE-2026-12565: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284 (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects >= 2.3.1, <= 2.8.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
7. advisory CVE-2025-10284 Oct 9, 2025 · issue 128
   • CVE-2025-10284: Various issues in unarchive.py can cause arbitrary file write and RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.6, affects < 2.7.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
8. advisory CVE-2025-10282 Oct 9, 2025 · issue 128
   • CVE-2025-10282: gitlab.py exposes globally configured gitlab API key to on-premise GitLab instances, potentially threatening confidentiality of a gitlab.com API key (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.7, affects < 2.7.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
9. advisory CVE-2025-10281 Oct 9, 2025 · issue 128
   • CVE-2025-10281: git_clone.py can be made to expose a user's github.com API key to an attacker-controlled webserver (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.7, affects < 2.7.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠