BBOT: Automating the OSINT Kill Chain with a Single Command

Reconnaissance is the foundation of every successful engagement but fragmented tooling, manual chaining, and missed data leave gaps that cost you findings. BBOT (Bighuge BLS OSINT Tool) was built to solve that. Developed by Black Lantern Security, BBOT is a recursive, event-driven OSINT framework that replaces the traditional phased approach with continuous, real-time discovery every new piece of data is immediately fed back into the scan engine to uncover what linear workflows miss.

This is a fully hands-on workshop. Attendees will install and configure BBOT, then run it live against their own scoped bug bounty targets turning the session into real reconnaissance rather than a slide-driven demo. We'll cover BBOT's 100+ module architecture spanning subdomain enumeration, cloud asset discovery, email harvesting, web spidering, and vulnerability scanning with Nuclei, all chainable in a single command and firing recursively in real time. Along the way we'll dig into scope management, passive vs. active recon tradeoffs, and the web hacking modules that can point you toward real findings.

By the end of the session, attendees will walk away with actual scan output from a live target, a repeatable BBOT-driven recon workflow they can drop into their next program, and a clear understanding of how to triage findings into real submissions. Whether you're new to automated recon or a seasoned bug bounty hunter still stitching tools together by hand, this workshop will change how you approach OSINT at scale.

Module 1 — Why BBOT? The Problem with How We Recon Now

• The fragmented toolchain problem: Amass → Subfinder → httpx → manual grep
• Why phased OSINT misses things — and what recursive, event-driven recon solves
• BBOT's origin at Black Lantern Security and design philosophy
• Quick architecture overview: modules, events, presets, scope
• 3.0 Updates - Rustification of HTTP and DNS
• Q&A / audience skill check

Module 2 — Getting Oriented: Installation, Config & First Scan

• Verify install and run bbot --help
• Listing and exploring modules with bbot -l
• Understanding flags vs. modules vs. presets
• Exercise 2.1: Run your first subdomain scan
• Reading and understanding BBOT output
• Scan output folders, naming conventions, and where data lives

Module 3 — Subdomain Enumeration Deep Dive

• How BBOT's recursive engine finds more than traditional tools
• Passive vs. active enumeration — when to use each
• Subdomain mutations and wordcloud usage
• Exercise 3.1: Full active subdomain enum

Module 4 — Going Deeper: Cloud, Email & Asset Discovery

• Cloud enumeration: S3 buckets, Azure blobs, GCP assets
• Email harvesting for org footprinting
• Combining flags for broader discovery
• Exercise 4.1: Run a combined cloud + email + subdomain scan
• Identifying misconfigured or exposed cloud assets in output
• Discussion: how these findings translate to bug bounty submissions

Module 5 — Web Hacking Modules & Vulnerability Scanning

• Overview of BBOT's web module suite: httpx, gowitness, wappalyzer, nuclei
• Web spidering for email, secrets, and exposed paths
• Nuclei integration — what it scans for and how to interpret results
• Exercise 5.1: Full web scan with screenshots
• Exercise 5.2: Kitchen sink scan (instructor-guided, safe target only)
• Setting expectations: BBOT points you at the doors — you still have to kick them open

Module 6 — Triage, Workflow & What Happens After the Scan

• How to structure your post-BBOT workflow: what to investigate first
• Prioritizing findings by severity and exploitability
• Avoiding common pitfalls: rate limiting, duplicate findings, out-of-scope mistakes
• Building a repeatable bug bounty recon workflow around BBOT
• Scheduling and automating recurring scans for continuous monitoring

Wrap-Up & Q&A

• Recap of key takeaways
• Recommended next steps and resources
• GitHub, docs, and community links
• Open Q&A