bbscan
A recon CLI that keeps its receipts.
Most recon tooling either swallows everything into a wall of JSON or throws it away between runs. bbscan is deliberately narrow: it collects, persists, and lets you re-scan what it already knows.
- Python
- SQLite
- asyncio
- argparse
- pytest
The problem
The bottleneck on a fresh authorised target is never the scan — it is context. You spend the first hour collecting subdomains, finding out what actually answers, pulling endpoints out of pages and JavaScript, and then you lose all of it, so the second pass starts from zero.
Approach
- 01Four verbs only — recon, scan, full, plus config loading — so the workflow is legible without reading the source.
- 02Split recon into passive and active modes, and degrade gracefully when subfinder, amass, or nuclei are missing instead of aborting.
- 03Persist every finding into SQLite so a second pass has memory: re-scan what was already collected rather than re-collecting it.
- 04Extract endpoints from both HTML and JavaScript, since the interesting surface in modern apps is usually in the bundle.
- 05Score and prioritise collected targets instead of dumping them in discovery order.
Structure
- cli.py
- argparse subcommands, config resolution, domain validation
- recon/
- subdomains · live_hosts · endpoints
- scanners/
- basic checks · optional nuclei handoff
- storage.py
- SQLite: subdomains, live_hosts, endpoints, vulnerabilities
- prioritization.py
- ranks what was found by likely value
- utils/
- domain validation, logging setup
What it does
- Passive and active subdomain enumeration with live host probing
- Endpoint extraction from HTML and JavaScript bundles
- Checks for reflected XSS, open redirect, SSRF sinks, and common misconfigurations
- SSRF verification is sink-identification by default; active out-of-band only with a callback configured
- YAML or JSON config, plus a test suite and packaging via pyproject
A tool that forgets everything between runs makes you slower, not faster. Persistence is the feature.