otlite · Domain and DNS

Install BBOT on Linux or macOS in one command

BBOT is a recursive scanner that starts from a domain or IP, discovers subdomains, hosts, and services, and feeds each finding back in as a new target. Presets choose between passive enumeration and active scanning.

BBOT in three lines

pipx install otlite
otlite install bbot
otlite run bbot -- d:example.com

Runs blacklanternsecurity/bbot (AGPL-3.0, ★ 11k, otlite 1.2.1, catalog updated Oct 23, 2026). otlite installs and runs it at a tested version; it does not change or verify the tool itself.

What BBOT is for

Subdomain enumeration that keeps going as it finds new names.
Passive recon with the subdomain-enum preset when you must stay quiet.
Exports to JSON or CSV for a spreadsheet or a case.

Typed inputs for BBOT

otlite translates these prefixes into BBOT's own flags. Anything else after -- is passed through unchanged, so every original flag still works.

d:: Domain · otlite run bbot -- d:example.com
ip:: IP address · otlite run bbot -- ip:203.0.113.7

Run every installed tool that takes the same input at once: otlite run --all d:example.com

Where the results go

Every run lands under ./results/bbot/<target>/ as a timestamped output file, a .meta.json sidecar (the exact command, start and end time, exit code, and the SHA-256 of the output), and a .envelope.json with the entities found, in the same shape for every tool. List runs with otlite results, group them with --case, compare the last two with otlite diff bbot <target>, and pull indicators out with otlite extract bbot.

Before you run it

Active presets probe the target. Only run them with written authorisation.
The first run installs module dependencies, which can take a few minutes.

Update, remove, inspect

otlite info bbot      # inputs, keys, an example command
otlite example bbot   # sample output, where there is one
otlite update bbot    # move to the next tested version
otlite remove bbot    # delete its virtualenv

Full reference: the otlite docs, and the tool's own README on GitHub.

Pairs with

dnstwist

dnstwist generates lookalike domains for a name you give it, including typos, homoglyphs, and extra TLDs, then checks which ones are registered and what they resolve to.

ctfr

ctfr lists the subdomains of a domain by reading Certificate Transparency logs through crt.sh.

SpiderFoot

SpiderFoot runs two hundred-odd modules against a domain, IP, email, or username and links what they return into one graph.

FAQ

BBOT with otlite, answered

How do I install BBOT on Kali, Ubuntu, or macOS?

Install otlite once with pipx install otlite (or the one-line installer on the otlite page), run otlite init, then otlite install bbot. The tool lands in its own virtualenv under ~/.otlite/, pinned to a version that was tested, so nothing touches your system Python. otlite doctor prints the command that fixes a missing git or venv module.

Which inputs does BBOT take through otlite?

d: (domain), ip: (ip address). otlite maps each prefix to BBOT's own flag. Everything after -- that is not a typed input is passed through unchanged, so the original flags still work.

Where does otlite save BBOT results?

Under ./results/bbot/<target>/ in the folder you run from, as a timestamped output file plus a .meta.json sidecar (the exact command, timing, exit code, and SHA-256) and a .envelope.json with the entities found. Add --case <name> to group runs, otlite results to list them, and otlite diff bbot <target> to compare the last two.

Does BBOT need an API key or a login?

No key is required for the basic run. Optional keys, where the project supports them, go in with otlite keys set NAME and are passed only to tools that declare them.

Can I run BBOT together with other tools?

Yes. otlite run --all d:example.com runs every installed tool that takes domain input, in parallel, including BBOT. Save the combination as a playbook to repeat it.