This allows you to run daily cron jobs on your VPS in the cloud, and readily access their output from your local workstation. # note that the outscoped domains have been omitted Collaboration & Distributionīecause of the central database, you can install a client on any number of machines and configure them to point to the same BBRF server.

Now every added domain will be checked against the known domains and the defined scope before being ingested in the central database: $~ bbrf domain add '' '' '' '' '$~ bbrf domains $~ bbrf inscope add '*.' '$~ bbrf outscope add '' Create a new program with bbrf new and define both the inscope and outscope domains to get started: $~ bbrf new test # find all domains that contain 'dev'ībrf domains | grep 'dev' # pipe all domains from subfinder into bbrfībrf program scope -wildcard -top | subfinder | bbrf domain add - Features Programs & ScopesīBRF stores your recon data in programs, in line with how bug bounty platforms typically work. It was built with simplicity in mind, according to the Linux adagio to “do one thing and do it well”, with its primary purpose to output and digest domains and IP addresses, so as to work well together with other tools by piping input and output to and from the client. The BBRF client, on the other hand, can be thought of as a Python wrapper around the HTTP calls to the JSON database. ips, belonging to a program and containing a list of corresponding domains.domains, belonging to a program and containing a list of IPs they resolve to.programs, including a list of inscope and outscope domains and a disabled flag.Data is stored in JSON documents which has the advantage of not requiring any predefined data structure.Īt the time of publishing, the following document types are supported by default: CouchDB comes with a standard HTTP-based API, which allows interacting with the database by means of HTTP requests. The document store, or BBRF server, is a central document-oriented database running on CouchDB. To achieve the desired functionality, BBRF was designed as two separate components: the BBRF server, in the form of a central document store, and the BBRF client in the form of a Python script.

In particular, I was longing to be able to run commands like: bbrf domains and bbrf ips to list my data, and sublist3r.py | bbrf domain add - to store my results. To overcome this problem in an attempt to be more structured, I started implementing bbrf, which in the first place had to be a command-line tool allowing me to easily list all domains and IPs belonging to a project, and to store domains and IPs for later use. In other words, I would use tools for their specific purpose, interpret and use the output manually, and move on to the next one. In particular, managing the output of different tools and combining them to enrich each other was cumbersome enough that I kept on using tools on an ad-hoc basis. My biggest struggle when working with this growing variety of tools was always: being organized. ffuf) or successfully combine a lot of submodules into one big framework (e.g. massdns), try to be amazing all-rounders (e.g. Whereas five years ago, subdomain bruteforcing with fierce was all the recon I could muster, the community today has access to an abundance of very good tools that either specialize in very specific tasks (e.g. When it comes to reconnaissance, or “recon”, in bug bounty hunting, it is clear that there is a lot of tooling available. If you’ve stumbled on this article looking to get started with BBRF immediately, head over to the GitHub repo right away! If you’re interested to learn more about what it is (and what it ain’t), feel free to continue reading below. In this article, I want to introduce the solution I have designed to address some of those headaches, hoping that it may prove useful to you in some way. Like anyone involved in bug bounty hunting, I have encountered a number of challenges in organizing my reconnaissance data over the years. An example use case of bbrf, here integrating with subfinder from projectdiscovery.

Ssh tunnel putty couchdb