Choose the collection behavior before the preset
BBOT's subdomain preset combines passive API sources with recursive DNS brute-force and target-specific mutations. If your task permits only passive collection, that distinction matters before you run a command.
BBOT coordinates reconnaissance tasks through presets and modules. Its README documents subdomain discovery, email collection, web crawling and web scanning, with file outputs and external destinations. That breadth makes it worth evaluating when several tasks belong in the same workflow. Our sandbox run did not measure discovery coverage or establish that a scan completed.
What happened when we ran it
At commit a6fb827 on November 5, 2026, installation succeeded in 19 seconds and the build succeeded in 1 second. The run recorded 90 dependencies occupying 175 MB. The checkout contained 609 files occupying 9.7 MB.
The test command exited 4 after 2 seconds. Its log reported an unrecognized --benchmark-skip argument and identified pyproject.toml as the configuration file. Pytest rejected the command, so this result provides no passing-test count or scanner assertion result. The supplied log does not explain why the argument was unavailable.
pip-audit reported one known vulnerability without identifying its package, advisory or severity in the supplied record. Obtain those details before deciding whether the installed dependencies are acceptable for your environment.
The recorded sandbox configuration was 3 CPUs, 8 GB RAM and image ghcr.io/astral-sh/uv:python3.12-bookworm. These configuration labels do not establish the actual runtime or operating-system version. The repository scan found a Dockerfile and seven CI workflow files. Its negative tests-directory signal does not establish that the repository has no tests.
A passive filter still needs configuration review
The README shows a subdomain command with -rf passive and labels it "passive sources only." This is a documentation example, unexecuted in our run.
The supplied issues page also lists an open report titled "Module flags are static, but some modules are active or passive depending on config," opened July 30, 2026. The issue title records a reported limitation; it does not prove how every module behaves. It does mean this review cannot treat the README filter as independently verified assurance of passive operation. Inspect the selected modules and settings against your permitted collection behavior.
API-backed modules may also require service credentials. The README shows configuration for services including SecurityTrails and VirusTotal. Installation alone does not establish access to those sources or permission for a particular use.
For an evaluation, record the authorized target, preset, module configuration and available sources. Inspect the resulting events and files before expanding the scope. This is a proposed procedure; our run did not execute it.
Broader presets require broader inspection
The kitchen-sink preset combines subdomain, cloud, code and email enumeration with crawling and web-related tasks. Choose it only after deciding that the included work fits your assessment. A narrower task is easier to evaluate against an existing workflow.
The README distinguishes a light web scan from a heavy preset described as aggressive. These are documented descriptions, not measured request-volume or runtime comparisons. We did not run those examples.
Output choices need their own evaluation. The README lists JSON and CSV alongside destinations such as Neo4j and Postgres. Begin with an output you can inspect, then validate the destination your workflow needs. Our run did not verify integration credentials or delivery reliability.
Match the release to the evidence
The supplied release record identifies v3.0.2, published August 24, 2026, at a6fb827, the commit used in our sandbox. The pinned release page connects the measured checkout to that release. The supplied README and issues extracts describe repository documentation and reported concerns; they are not a separate execution record for v3.0.2.
The README warns that BBOT 3.0 contains breaking changes to the CLI, presets, modules, events and Python API. Existing integrations need migration checks, especially if they consume scan events. Its synchronous and asynchronous Python examples provide integration starting points, but neither was executed in our run.
The supplied issues extract includes a module proposal opened November 4, 2026. It establishes that a proposal was filed, without demonstrating implementation, maintainer response time or release reliability.
When a narrower tool fits
Subfinder uses passive online sources for subdomain discovery. Evaluate it when that is the whole task. SpiderFoot supports a web interface and command-line operation. Evaluate it when a browser interface matters to your OSINT workflow. These are documented scope and interface distinctions; we measured no winner on speed or discovery quality.
Our documentation rubric uses a five-point scale: 1 means essential evaluation instructions are missing; 2 means instructions leave major evaluation steps unclear; 3 means the documentation provides a concrete evaluation path; 4 requires that path to be independently checked with its consequential limits; 5 requires broader verification across the documented workflows. BBOT receives 3 for its installation route, preset examples, output options and migration warning. The commands and operating limits were not independently verified. Setup ease, community support and production maturity remain unassessed.
Before recurring use, resolve the test-command rejection, identify the audit advisory and complete a representative authorized scan. Save its configuration and output so later changes can be investigated.