List of Presets

description: Run all baddns modules and submodules.


modules:
  - baddns
  - baddns_zone
  - baddns_direct

config:
  modules:
    baddns:
      enabled_submodules: [CNAME,references,MX,NS,TXT]

description: Enumerate cloud resources such as storage buckets, etc.

include:
  - subdomain-enum

flags:
  - cloud-enum

description: Enumerate Git repositories, Docker images, etc.

flags:
  - code-enum

description: Recursive web directory brute-force (aggressive)

include:
  - spider

flags:
  - iis-shortnames

modules:
  - ffuf
  - wayback

config:
  modules:
    iis_shortnames:
      # we exploit the shortnames vulnerability to produce URL_HINTs which are consumed by ffuf_shortnames
      detect_only: False
    ffuf:
      depth: 3
      lines: 5000
      extensions:
        - php
        - asp
        - aspx
        - ashx
        - asmx
        - jsp
        - jspx
        - cfm
        - zip
        - conf
        - config
        - xml
        - json
        - yml
        - yaml
    # emit URLs from wayback
    wayback:
      urls: True

description: Basic web directory brute-force (surface-level directories only)

include:
  - iis-shortnames

modules:
  - ffuf

config:
  modules:
    ffuf:
      # wordlist size = 1000
      lines: 1000

description: Comprehensive scan for all IIS/.NET specific modules and module settings


include:
  - iis-shortnames

modules:
  - httpx
  - badsecrets
  - ffuf_shortnames
  - ffuf
  - telerik
  - ajaxpro
  - dotnetnuke

config:
  modules:
    ffuf:
      extensions: asp,aspx,ashx,asmx,ascx
      extensions_ignore_case: True
    ffuf_shortnames:
      find_subwords: True
    telerik:
      exploit_RAU_crypto: True
      include_subdirs: True # Run against every directory, not the default first received URL per-host

description: Enumerate email addresses from APIs, web crawling, etc.

flags:
  - email-enum

output_modules:
  - emails

description: Scan only the provided targets as fast as possible - no extra discovery

exclude_modules:
  - excavate

config:
  # only scan the exact targets specified
  scope:
    strict: true
  # speed up dns resolution by doing A/AAAA only - not MX/NS/SRV/etc
  dns:
    minimal: true
  # essential speculation only
  modules:
    speculate:
      essential_only: true

description: Recursively enumerate IIS shortnames

flags:
  - iis-shortnames

config:
  modules:
    iis_shortnames:
      # exploit the vulnerability
      detect_only: false

description: Everything everywhere all at once

include:
  - subdomain-enum
  - cloud-enum
  - code-enum
  - email-enum
  - spider
  - web-basic
  - paramminer
  - dirbust-light
  - web-screenshots
  - baddns-intense

config:
  modules:
    baddns:
      enable_references: True

description: Discover web parameters and lightly fuzz them for vulnerabilities, with more intense discovery techniques, including POST parameters, which are more invasive. Uses all lightfuzz modules, and adds paramminer modules for parameter discovery.

include:
  - lightfuzz-medium

flags:
  - web-paramminer

modules:
  - robots

config:
  modules:
    lightfuzz:
      enabled_submodules: [cmdi,crypto,nosqli,path,serial,sqli,ssti,xss]
      disable_post: False

description: Discover web parameters and lightly fuzz them for vulnerabilities, with only the most common vulnerabilities and minimal extra modules. Safest to run alongside larger scans.

modules:
  - httpx
  - lightfuzz
  - portfilter

config:
  url_querystring_remove: False # don't strip off the querystring (BBOT normally does this; but lightfuzz needs it)
  url_querystring_collapse: True # in cases where the same parameter has multiple values, collapse them into a single parameter to save on fuzzing attempts
  modules:
    lightfuzz:
      enabled_submodules: [path,sqli,xss] # only look for the most common vulnerabilities
      disable_post: True # don't send POST requests (less aggressive)

conditions:
- |
  {% if config.web.spider_distance == 0 %}
    {{ warn("Lightfuzz works much better with spider enabled! Consider adding 'spider' or 'spider-intense' preset.") }}
  {% endif %}

description: Discover web parameters and lightly fuzz them for vulnerabilities. Uses all lightfuzz modules, without some of the more intense discovery techniques. Does not send POST requests. This is the default lightfuzz preset; if you're not sure which one to use, this is a good starting point.

include:
  - lightfuzz-light

modules:
  - badsecrets
  - hunt
  - reflected_parameters

config:
  modules:
    lightfuzz:
      enabled_submodules: [cmdi,crypto,nosqli,path,serial,sqli,ssti,xss]

description: Discover web parameters and lightly fuzz them for vulnerabilities, with the most intense discovery techniques, including POST parameters, which are more invasive. Uses all lightfuzz modules, adds paramminer modules for parameter discovery, and tests each unique parameter-value instance individually.

include:
  - lightfuzz-heavy

config:
  url_querystring_collapse: False # in cases where the same parameter is observed multiple times, fuzz them individually instead of collapsing them into a single parameter
  modules:
    lightfuzz:
      force_common_headers: True # Fuzz common headers like X-Forwarded-For even if they're not observed on the target
      enabled_submodules: [cmdi,crypto,nosqli,path,serial,sqli,ssti,xss]
    excavate:
      speculate_params: True # speculate potential parameters extracted from JSON/XML web responses

description: Discover web parameters and lightly fuzz them, limited to just GET-based xss vulnerabilities. This is an example of a custom lightfuzz preset, selectively enabling a single lightfuzz module.

modules:
  - httpx
  - lightfuzz
  - paramminer_getparams
  - reflected_parameters
  - portfilter

config:
  url_querystring_remove: False
  url_querystring_collapse: False
  modules:
    lightfuzz:
      enabled_submodules: [xss]
      disable_post: True

conditions:
  - |
    {% if config.web.spider_distance == 0 %}
      {{ warn("The lightfuzz-xss preset works much better with spider enabled! Consider adding 'spider' or 'spider-intense' preset.") }}
    {% endif %}

description: Run nuclei scans against all discovered targets

modules:
  - httpx
  - nuclei
  - portfilter

config:
  modules:
    nuclei:
      directory_only: True # Do not run nuclei on individual non-directory URLs


conditions:
  - |
    {% if config.web.spider_distance != 0 %}
      {{ warn("Running nuclei with spider enabled is generally not recommended. Consider removing 'spider' preset.") }}
    {% endif %}



# Additional Examples:

# Slowing Down Scan

#config:
#  modules:
#    nuclei:
#      ratelimit: 10
#      concurrency: 5

description: Run nuclei scans against all discovered targets, using budget mode to look for low hanging fruit with greatly reduced number of requests

modules:
  - httpx
  - nuclei
  - portfilter

config:
  modules:
    nuclei:
      mode: budget
      budget: 10
      directory_only: true # Do not run nuclei on individual non-directory URLs

conditions:
  - |
    {% if config.web.spider_distance != 0 %}
      {{ warn("Running nuclei with spider enabled is generally not recommended. Consider removing 'spider' preset.") }}
    {% endif %}

description: Run nuclei scans against all discovered targets, allowing for spidering, against ALL URLs, and with additional discovery modules.

modules:
  - httpx
  - nuclei
  - robots
  - urlscan
  - portfilter
  - wayback

config:
  modules:
    nuclei:
      directory_only: False # Will run nuclei on ALL discovered URLs - Be careful!
    wayback:
      urls: true

conditions:
  - |
    {% if config.web.spider_distance == 0 and config.modules.nuclei.directory_only == False %}
      {{ warn("The 'nuclei-intense' preset turns the 'directory_only' limitation off on the nuclei module. To make the best use of this, you may want to enable spidering with 'spider' or 'spider-intense' preset.") }}
    {% endif %}


# Example for also running a dirbust

#include:
#  - dirbust-light

description: Run nuclei scans against all discovered targets, running templates which match discovered technologies

modules:
  - httpx
  - nuclei
  - portfilter

config:
  modules:
    nuclei:
      mode: technology
      directory_only: True # Do not run nuclei on individual non-directory URLs. This is less unsafe to disable with technology mode.

conditions:
  - |
    {% if config.web.spider_distance != 0 %}
      {{ warn("Running nuclei with spider enabled is generally not recommended. Consider removing 'spider' preset.") }}
    {% endif %}

# Example for also running a dirbust

#include:
#  - dirbust-light

description: Discover new web parameters via brute-force, and analyze them with additional modules

flags:
  - web-paramminer

modules:
  - httpx
  - reflected_parameters
  - hunt

conditions:
  - |
    {% if config.web.spider_distance == 0 %}
      {{ warn("The paramminer preset works much better with spider enabled! Consider adding 'spider' or 'spider-intense' preset.") }}
    {% endif %}

description: Recursive web spider

modules:
  - httpx

blacklist:
  # Prevent spider from invalidating sessions by logging out
  - "RE:/.*(sign|log)[_-]?out"

config:
  web:
    # how many links to follow in a row
    spider_distance: 2
    # don't follow links whose directory depth is higher than 4
    spider_depth: 4
    # maximum number of links to follow per page
    spider_links_per_page: 25

description: Recursive web spider with more aggressive settings

include:
  - spider

config:
  web:
    # how many links to follow in a row
    spider_distance: 4
    # don't follow links whose directory depth is higher than 6
    spider_depth: 6
    # maximum number of links to follow per page
    spider_links_per_page: 50

description: Enumerate subdomains via APIs, brute-force

flags:
  # enable every module with the subdomain-enum flag
  - subdomain-enum

output_modules:
  # output unique subdomains to TXT file
  - subdomains

config:
  dns:
    threads: 25
    brute_threads: 1000
  # put your API keys here
  # modules:
  #   github:
  #     api_key: ""
  #   chaos:
  #     api_key: ""
  #   securitytrails:
  #     api_key: ""

description: Detect technologies via Wappalyzer, Nuclei, and FingerprintX

modules:
  - nuclei
  - wappalyzer
  - fingerprintx

config:
  modules:
    nuclei:
      tags: tech

description: Quick web scan

include:
  - iis-shortnames

flags:
  - web-basic

description: Take screenshots of webpages

flags:
  - web-screenshots

config:
  modules:
    gowitness:
      resolution_x: 1440
      resolution_y: 900
      # folder to output web screenshots (default is inside ~/.bbot/scans/scan_name)
      output_path: ""
      # whether to take screenshots of social media pages
      social: True

description: Aggressive web scan

include:
  # include the web-basic preset
  - web-basic

flags:
  - web-thorough