Make BBOT compatible with Ax/Axiom

[Sh4d0wHunt3rX]

When I run BBOT, I need a very powerful server, but when it's not in process, I need a very cheap server to manage the data. I was thinking that would be awesome if possible to make BBOT compatible with AXIOM, so when we run it, it creates a powerful server and when it is finished, terminate that server and (move data to my main server?). Not sure if there is any other solution for this, axiom came to my mind. Maybe kubernete? (I have never worked with it)

https://github.com/pry0cc/axiom

[TheTechromancer]

This is a good idea. I'll look into axiom.

[Sh4d0wHunt3rX]

Axiom also can make processes parallel. For example, paramminer is a slow module, so we run it on 5 instances at the same time to finish it sooner. Maybe possible to make something like this as built-in in bbot. Same as "file splitter" in Trickest. In trickest, if we put file splitter before of any module, then that module will run on several machines concurrently. So, maybe the whole bbot can have axiom compatibility or some slow modules can run on several instances at the same time.

Thanks 🙏

[TheTechromancer]

BBOT already does this too. By default the paramminer modules run in parallel 12 instances at a time.

You can customize it through the config:

bbot -c modules.paramminer_headers.max_event_handlers=20

[Sh4d0wHunt3rX]

Or maybe shadowclone
https://github.com/fyoorer/ShadowClone

This actually can be used also as WAF bypass method

[Sh4d0wHunt3rX]

The new tool in this category is
https://github.com/defparam/lemma

If something like iis scanner, bypass 403, ffuf ... can execute at the end as serverless functions, can reduce the bbot scanning time significantly.

[Sh4d0wHunt3rX]

The defparam version is 404, but there are some forks available. Recently I have disabled some bbot modules such as shortscan or ffuf or bypass403 and doing these in lemma/shadowclone , I know it's not recursive on my side anymore but the reduction in scan time is significant.

I was thinking if possible to integrate this ability as an option in bbot, that possible to enable/disable it and do some of the operations in aws lambda, bbot will go in another level. Imagine, ffuf, bypass403, shortscan ... in 1000 parallel executions, how much fast can bbot be.

[marcelo321]

hey @amiremami were you able to run bbot with shadowclone? that would be awesome but I couldn't figure out a way to make it work (getting errors of 'wrong command')

[Sh4d0wHunt3rX]

Hey @marcelo321, sorry for delay, Unfortunately, I'm not running BBOT in Shadowclone as I only do recon on 1 domain at a time. However, each function has max 15 minutes time to terminate in AWS Lambda, is this even doable/practical to run BBOT in Shadowclone?

[bc0la]

Being able to distribute things like port scans/ffuf/gowitness/nuclei with axiom would be so awesome. It's probably the one thing holding us back from using bbot full time. (particularly on large scopes)

[TheTechromancer]

I agree this would be a good feature to have. I foresee BBOT having an option like this in the future, where you can specify an AWS key or similar, which certain modules like gowitness or nuclei could use to execute on a remote VM instead of the local system.

Right now we are looking for help with this feature. If anyone has a good idea for how to implement it, or experience in that kind of setup, I am happy to work with them.

[N7WEra]

I will add Ax framwork to the mix. It’s from the same author of AXIOM, he moved to work on Ax instead of Axiom.

[DrorDvash]

Axiom / Ax would be awesome!

From Axiom Github:

WARNING: Axiom Classic is now in maintenance mode. We encourage you to transition to the new Ax Framework. In the coming months, we will introduce essential quality-of-life updates to Axiom Classic before 2025. Long live Axiom!

Agree with the recommendations - I think you should consider integrating into one of them, similar to what reconFTW did.

The ability to distribute scans across multiple VPSs could make BBOT the king of all time :)

Note regarding the provider: AWS as alone isn’t enough, options like Linode, DigitalOcean, or my favorite- Hetzner (offer strong specs at a low cost) is also needed.