BBOT 2.0 - Upgrade Process & Troubleshooting Tips

[TheTechromancer]

Hey everyone,

BBOT 2.0 is now in prerelease! 🎉🎉🎉

If you installed BBOT version 1 and then upgraded to 2.0, you may run into a few hiccups. There have been a few changes to the CLI, and the structure of the config. The goal of this post is to help you navigate those.

Since the old config can cause problems for BBOT 2.0, the first thing you probably want to do is remove it and start fresh:

# rename config dir
mv ~/.config/bbot ~/.config/bbot.bak

# rename bbot home dir
mv ~/.bbot ~/.bbot.bak

Here is a highlight of the major changes:

New Features

• Presets (-p / --presets)
• New discovery_context attribute on every event which contains a description of exactly how the event was discovered.
  • Also, a new discovery_path attribute that contains the complete chain of parent contexts all the way back to the scan target.
• New --json command-line flag (alias for -c modules.stdout.format=json)
• New --brief command-line flag for cleaner output

Breaking Changes

• --current-config is now --current-preset (or --current-preset-full)
• --help-all has gone away. To list module options, you now do --list-module-options or -lmo
• • All module configs are now directly under modules (output_modules and internal_modules have gone away):

# before
bbot -c output_modules.splunk.url=http://example.com

# after
bbot -c modules.splunk.url=http://example.com

• Event source attribute has been renamed to parent
• max_event_handlers has been renamed to module_threads
• Massdns threads are now a global option:

# before
bbot -c modules.massdns.max_resolvers=5000

# after
bbot -c dns.brute_threads=5000

• DNS, web, and scope settings are now nested:

### SCOPE ###

scope:
  # Filter by scope distance which events are displayed in the output
  # 0 == show only in-scope events (affiliates are always shown)
  # 1 == show all events up to distance-1 (1 hop from target)
  report_distance: 0
  # How far out from the main scope to search
  # Do not change this setting unless you know what you're doing
  search_distance: 0

### DNS ###

dns:
  # Completely disable DNS resolution (careful if you have IP whitelists/blacklists, consider using minimal=true instead)
  disable: false
  # Speed up scan by not creating any new DNS events, and only resolving A and AAAA records
  minimal: false
  # How many instances of the dns module to run concurrently
  threads: 20
  # How many concurrent DNS resolvers to use when brute-forcing
  # (under the hood this is passed through directly to massdns -s)
  brute_threads: 1000
  # How far away from the main target to explore via DNS resolution (independent of scope.search_distance)
  # This is safe to change
  search_distance: 1
  # Limit how many DNS records can be followed in a row (stop malicious/runaway DNS records)
  runaway_limit: 5
  # DNS query timeout
  timeout: 5
  # How many times to retry DNS queries
  retries: 1
  # Completely disable BBOT's DNS wildcard detection
  wildcard_disable: False
  # Disable BBOT's DNS wildcard detection for select domains
  wildcard_ignore: []
  # How many sanity checks to make when verifying wildcard DNS
  # Increase this value if BBOT's wildcard detection isn't working
  wildcard_tests: 10
  # Skip DNS requests for a certain domain and rdtype after encountering this many timeouts or SERVFAILs
  # This helps prevent faulty DNS servers from hanging up the scan
  abort_threshold: 50
  # Don't show PTR records containing IP addresses
  filter_ptrs: true
  # Enable/disable debug messages for DNS queries
  debug: false
  # For performance reasons, always skip these DNS queries
  # Microsoft's DNS infrastructure is misconfigured so that certain queries to mail.protection.outlook.com always time out
  omit_queries:
    - SRV:mail.protection.outlook.com
    - CNAME:mail.protection.outlook.com
    - TXT:mail.protection.outlook.com

### WEB ###

web:
  # HTTP proxy
  http_proxy: 
  # Web user-agent
  user_agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.2151.97
  # Set the maximum number of HTTP links that can be followed in a row (0 == no spidering allowed)
  spider_distance: 0
  # Set the maximum directory depth for the web spider
  spider_depth: 1
  # Set the maximum number of links that can be followed per page
  spider_links_per_page: 25
  # HTTP timeout (for Python requests; API calls, etc.)
  http_timeout: 10
  # HTTP timeout (for httpx)
  httpx_timeout: 5
  # Custom HTTP headers (e.g. cookies, etc.)
  # in the format { "Header-Key": "header_value" }
  # These are attached to all in-scope HTTP requests
  # Note that some modules (e.g. github) may end up sending these to out-of-scope resources
  http_headers: {}
  # HTTP retries (for Python requests; API calls, etc.)
  http_retries: 1
  # HTTP retries (for httpx)
  httpx_retries: 1
  # Enable/disable debug messages for web requests/responses
  debug: false
  # Maximum number of HTTP redirects to follow
  http_max_redirects: 5
  # Whether to verify SSL certificates
  ssl_verify: false