The recursive internet scanner for hackers. 🧡
This report summarizes scanner evidence for blacklanternsecurity/bbot, a Python project with 10,689 GitHub stars. SynthScan examined 131,138 lines of code across 586 source files, recording 1224 pattern matches distributed across 19 syntactic categories. The legacy adjusted pattern signal is 15.4 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 781 finding(s).
Are imports declared and package/API names verified? 133 finding(s).
Are wrappers, guards, and repeated structures necessary? 628 finding(s).
Which changes need focused human review? 1224 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1224 distinct pattern matches across 19 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | bbot/core/modules.py | 348 | Preloads all BBOT modules. This function recursively iterates through each file in the module directories | STRING |
| HIGH | bbot/core/modules.py | 596 | Preloads a BBOT module to gather its meta-information and dependencies. This function reads a BBOT mod | STRING |
| HIGH | bbot/core/modules.py | 866 | Loads a BBOT module by its name. Imports the module from its namespace, locates its class, and returns it. | STRING |
| HIGH | bbot/core/modules.py | 926 | Generates a table of module information. Constructs a table to display information such as module name, type, a | STRING |
| HIGH | bbot/core/event/base.py | 2317 | Creates and returns a new event object. This function serves as a factory for creating new event objects from | STRING |
| HIGH | bbot/core/event/base.py | 2412 | Creates an event object from a JSON dictionary. This function deserializes a JSON dictionary to create a new e | STRING |
| HIGH | bbot/core/helpers/misc.py | 33 | Check if the given input represents a domain without subdomains. This function takes an input string `d` and r | STRING |
| HIGH | bbot/core/helpers/misc.py | 68 | Check if the given input represents a subdomain. This function takes an input string `d` and returns True if i | STRING |
| HIGH | bbot/core/helpers/misc.py | 103 | Check if the given input represents a PTR record domain. This function takes an input string `d` and returns T | STRING |
| HIGH | bbot/core/helpers/misc.py | 126 | Check if the given input represents a valid URL. This function takes an input string `u` and returns True if i | STRING |
| HIGH | bbot/core/helpers/misc.py | 156 | Check if the given input represents a URI and optionally return its scheme. This function takes an input strin | STRING |
| HIGH | bbot/core/helpers/misc.py | 191 | Parse a string containing a host and port into a tuple. This function takes an input string `d` and returns a | STRING |
| HIGH | bbot/core/helpers/misc.py | 262 | Retrieve the parent domain of a given subdomain string. This function takes an input string `d` representing a | STRING |
| HIGH | bbot/core/helpers/misc.py | 297 | Generate a list of parent domains for a given domain string. This function takes an input string `d` and gener | STRING |
| HIGH | bbot/core/helpers/misc.py | 349 | Retrieve the parent URL of a given URL. This function takes an input string `u` representing a URL and returns | STRING |
| HIGH | bbot/core/helpers/misc.py | 381 | Generate a list of parent URLs for a given URL string. This function takes an input string `u` representing a | STRING |
| HIGH | bbot/core/helpers/misc.py | 411 | Determine the better HTTP status code between two given codes. The 'better' status code is considered based on | STRING |
| HIGH | bbot/core/helpers/misc.py | 455 | Extracts the subdomain, domain, and suffix from a URL string. Args: data (str): The URL string to be p | STRING |
| HIGH | bbot/core/helpers/misc.py | 478 | Splits the hostname into its subdomain and registered domain components. Args: hostname (str): The ful | STRING |
| HIGH | bbot/core/helpers/misc.py | 507 | Returns an abbreviated representation of the hostname by removing the TLD (Top-Level Domain). Args: do | STRING |
| HIGH | bbot/core/helpers/misc.py | 528 | Generates all parent IP networks for a given IP address or network, optionally including the network itself. A | STRING |
| HIGH | bbot/core/helpers/misc.py | 551 | Checks if the given string represents a valid port number. Args: p (str or int): The port number to ch | STRING |
| HIGH | bbot/core/helpers/misc.py | 572 | Determines if the given string is a valid DNS name. Args: d (str): The string to be checked. Retu | STRING |
| HIGH | bbot/core/helpers/misc.py | 598 | Checks if the given string or object represents a valid IP address. Args: d (str or ipaddress.IPvXAddr | STRING |
| HIGH | bbot/core/helpers/misc.py | 634 | Checks if the given object is an instance of an IPv4 or IPv6 type from the ipaddress module. Args: i ( | STRING |
| HIGH | bbot/core/helpers/misc.py | 695 | Convert a string to its corresponding IP address or network type. This function attempts to convert the input | STRING |
| HIGH | bbot/core/helpers/misc.py | 737 | Computes the SHA-1 hash of the given data. Args: data (str or dict): The data to hash. If a dictionary | STRING |
| HIGH | bbot/core/helpers/misc.py | 758 | Decodes the input data to a UTF-8 string, silently ignoring errors. Args: data (str or bytes): The dat | STRING |
| HIGH | bbot/core/helpers/misc.py | 780 | Encodes the input data to bytes using UTF-8 encoding, silently ignoring errors. Args: data (str or byt | STRING |
| HIGH | bbot/core/helpers/misc.py | 809 | Recursively decodes doubly or triply-encoded strings to their original form. Supports both URL-encoding and ba | STRING |
| HIGH | bbot/core/helpers/misc.py | 851 | Generates a random string of specified length. Args: length (int, optional): The length of the random | STRING |
| HIGH | bbot/core/helpers/misc.py | 892 | Extracts key-value pairs from a JSON object and returns them as a set of tuples. Used by the `paramminer_headers` m | STRING |
| HIGH | bbot/core/helpers/misc.py | 936 | Extracts tags and their text values from an XML object and returns them as a set of tuples. Args: xml_ | STRING |
| HIGH | bbot/core/helpers/misc.py | 997 | Intelligently extracts words from given data. This function uses regular expressions and optionally wordninja to ex | STRING |
| HIGH | bbot/core/helpers/misc.py | 1054 | Finds the closest matching strings from a list of choices based on a given string. This function uses the difflib l | STRING |
| HIGH | bbot/core/helpers/misc.py | 1138 | Reads a string or file and yields its content line-by-line. This function tries to open the given string `s` as a f | STRING |
| HIGH | bbot/core/helpers/misc.py | 1201 | Chains together list elements, allowing for entries separated by commas. This function takes a list `l` and flatten | STRING |
| HIGH | bbot/core/helpers/misc.py | 1260 | Lists files in a given directory that meet a specified filter condition. Args: directory (str): The directo | STRING |
| HIGH | bbot/core/helpers/misc.py | 1314 | Reads a file line by line and yields each line without line breaks. Args: filename (str or Path): The path | STRING |
| HIGH | bbot/core/helpers/misc.py | 1335 | Generates numbers with variable padding and returns them as a set of strings. Args: n (int): The upper limi | STRING |
| HIGH | bbot/core/helpers/misc.py | 1362 | Constructs a network location string from a given host and port. Args: host (str): The hostname or IP addre | STRING |
| HIGH | bbot/core/helpers/misc.py | 1395 | Finds the full path of the first available executable from a list of executables. Args: *executables (str): | STRING |
| HIGH | bbot/core/helpers/misc.py | 1420 | Search a nested dictionary or list of dictionaries by a key and yield all matching values. Args: key (str): | STRING |
| HIGH | bbot/core/helpers/misc.py | 1445 | Recursively format string values in a dictionary or list using the provided keyword arguments. Args: d (Uni | STRING |
| HIGH | bbot/core/helpers/misc.py | 1470 | Recursively search a dictionary's values based on provided regex patterns. Args: d (Union[dict, list, str]) | STRING |
| HIGH | bbot/core/helpers/misc.py | 1512 | Grouper groups an iterable into chunks of a given size. Args: iterable (iterable): The iterable to be | STRING |
| HIGH | bbot/core/helpers/misc.py | 1533 | Splits a list into a specified number of approximately equal parts. Args: alist (list): The list to be | STRING |
| HIGH | bbot/core/helpers/misc.py | 1552 | Creates a directory and optionally checks if it's writable. Args: path (str or Path): The directory to | STRING |
| HIGH | bbot/core/helpers/misc.py | 1589 | Generates a string representation of the current date and time, with optional microsecond precision. Args: | STRING |
| HIGH | bbot/core/helpers/misc.py | 1621 | Extracts the file extension from a given string representing a URL or file path. Args: s (str): The st | STRING |
| HIGH | bbot/core/helpers/misc.py | 1647 | Renames a file by appending an iteration number as a backup. Recursively renames files up to a specified maximu | STRING |
| HIGH | bbot/core/helpers/misc.py | 1682 | Get the latest modified time of any file or sub-directory in a given directory. This function takes a directory pat | STRING |
| HIGH | bbot/core/helpers/misc.py | 1710 | Get the file size of a given file. This function takes a file path as an argument and returns its size in bytes. If | STRING |
| HIGH | bbot/core/helpers/misc.py | 1781 | Extract email addresses from a body of text This function takes in a string and yields all email addresses fou | STRING |
| HIGH | bbot/core/helpers/misc.py | 1803 | Attempts to find and extract the host portion of a string. Args: s (str): The string from which to ext | STRING |
| HIGH | bbot/core/helpers/misc.py | 1918 | Verify if the given sudo password is correct. This function checks whether the sudo password provided is valid for | STRING |
| HIGH | bbot/core/helpers/misc.py | 1947 | Generate a formatted table from the given rows and headers. This function uses the `tabulate` package to generate a | STRING |
| HIGH | bbot/core/helpers/misc.py | 2001 | Convert a TimeDelta object into a human-readable string. This function takes a datetime.timedelta object and conver | STRING |
| HIGH | bbot/core/helpers/misc.py | 2037 | Convert a bytes size to a human-readable string. This function converts a numeric bytes value into a human-readable | STRING |
| HIGH | bbot/core/helpers/misc.py | 2072 | Convert a human-readable file size string to its bytes equivalent. This function takes a human-readable file size s | STRING |
| 70 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bbot/constants.py | 34 | def is_valid_scan_status_code(status): | CODE |
| LOW | bbot/core/config/models.py | 181 | def partition_sensitive_config(config, model, *, keep_sensitive: bool): | CODE |
| LOW | bbot/core/event/helpers.py | 13 | def _get_sorted_event_classes(): | CODE |
| LOW | bbot/core/event/helpers.py | 105 | def _sanitize_and_extract_host(self, data): | CODE |
| LOW | bbot/core/event/helpers.py | 158 | def _sanitize_and_extract_host(data): | CODE |
| LOW | bbot/core/event/helpers.py | 167 | def _sanitize_and_extract_host(data): | CODE |
| LOW | bbot/core/event/helpers.py | 183 | def _sanitize_and_extract_host(data): | CODE |
| LOW | bbot/core/event/helpers.py | 193 | def _sanitize_and_extract_host(data): | CODE |
| LOW | bbot/core/event/helpers.py | 209 | def _sanitize_and_extract_host(data): | CODE |
| LOW | bbot/core/event/helpers.py | 223 | def _sanitize_and_extract_host(data): | CODE |
| LOW | bbot/core/helpers/misc.py | 1893 | def can_sudo_without_password(): | CODE |
| LOW | bbot/core/helpers/misc.py | 2681 | async def _cancel_and_drain_remaining(): | CODE |
| LOW | bbot/test/conftest.py | 76 | def _patch_python_module_loader(): | CODE |
| LOW | bbot/test/conftest.py | 199 | async def patched_request_batch_stream(self, urls, threads=10, **kwargs): | CODE |
| LOW | bbot/test/conftest.py | 247 | def bbot_httpserver_allinterfaces(): | CODE |
| LOW | bbot/test/conftest.py | 360 | def pytest_collection_modifyitems(config, items): | CODE |
| LOW | bbot/test/test_step_1/test_field_metadata.py | 13 | def test_field_records_sensitive_and_mandatory_in_json_schema_extra(): | CODE |
| LOW | bbot/test/test_step_1/test_field_metadata.py | 31 | def test_global_config_marks_known_secrets_sensitive(): | CODE |
| LOW | bbot/test/test_step_1/test_field_metadata.py | 40 | def test_module_preload_extracts_sensitive_and_mandatory_sets(): | CODE |
| LOW | bbot/test/test_step_1/test_field_metadata.py | 59 | def test_modules_table_needs_api_key_derived_from_mandatory(): | CODE |
| LOW | bbot/test/test_step_1/test_field_metadata.py | 72 | def test_no_secrets_config_redacts_module_and_global_secrets(): | CODE |
| LOW | bbot/test/test_step_1/test_field_metadata.py | 105 | def test_secrets_only_config_extracts_sensitive_fields(): | CODE |
| LOW | bbot/test/test_step_1/test_field_metadata.py | 131 | def test_auth_required_property_derives_from_config(): | CODE |
| LOW | bbot/test/test_step_1/test_field_metadata.py | 148 | def test_credential_connection_fields_are_sensitive(): | CODE |
| LOW | bbot/test/test_step_1/test_manager_scope_accuracy.py | 52 | async def test_manager_scope_accuracy_correct(bbot_scanner, bbot_httpserver, bbot_other_httpservers, bbot_httpserver_ssl | CODE |
| LOW | bbot/test/test_step_1/test_manager_scope_accuracy.py | 818 | async def test_manager_scope_tagging(bbot_scanner): | CODE |
| LOW | bbot/test/test_step_1/test_manager_scope_accuracy.py | 845 | async def test_scope_accuracy_with_special_urls(bbot_scanner, bbot_httpserver): | CODE |
| LOW | bbot/test/test_step_1/test_manager_deduplication.py | 6 | async def test_manager_deduplication(bbot_scanner): | CODE |
| LOW | bbot/test/test_step_1/test_target.py | 407 | async def test_asn_targets_integration(bbot_scanner): | CODE |
| LOW | bbot/test/test_step_1/test_target.py | 445 | async def test_asn_targets_edge_cases(bbot_scanner): | CODE |
| LOW | bbot/test/test_step_1/test_target.py | 495 | async def test_asn_blacklist_functionality(bbot_scanner): | CODE |
| LOW | bbot/test/test_step_1/test_target.py | 560 | async def test_asn_event_json_serialization(bbot_scanner): | CODE |
| LOW | bbot/test/test_step_1/test_target.py | 589 | async def test_asn_resolution_failure_aborts_scan(bbot_scanner): | CODE |
| LOW | bbot/test/test_step_1/test_target.py | 609 | async def test_asn_resolution_failure_retries(bbot_scanner): | CODE |
| LOW | bbot/test/test_step_1/test_target.py | 707 | def test_blacklist_get_invalid_host(): | STRING |
| LOW | bbot/test/test_step_1/test_target.py | 784 | def test_target_comments_url_fragment_not_stripped(): | CODE |
| LOW | bbot/test/test_step_1/test_target.py | 797 | def test_target_comments_blacklist(): | CODE |
| LOW | bbot/test/test_step_1/test_target.py | 813 | def test_target_comments_seeds(): | CODE |
| LOW | bbot/test/test_step_1/test_target.py | 828 | def test_target_comments_from_file(tmp_path): | CODE |
| LOW | bbot/test/test_step_1/test_target.py | 853 | def test_strip_comments_helper(): | CODE |
| LOW⚡ | bbot/test/test_step_1/test_validate_preset.py | 6 | def test_validate_preset_valid(): | CODE |
| LOW⚡ | bbot/test/test_step_1/test_validate_preset.py | 11 | def test_validate_preset_typo_top_level(): | CODE |
| LOW⚡ | bbot/test/test_step_1/test_validate_preset.py | 18 | def test_validate_preset_typo_in_config(): | CODE |
| LOW⚡ | bbot/test/test_step_1/test_validate_preset.py | 26 | def test_validate_preset_wrong_type(): | CODE |
| LOW⚡ | bbot/test/test_step_1/test_validate_preset.py | 34 | def test_validate_preset_unknown_module(): | CODE |
| LOW⚡ | bbot/test/test_step_1/test_validate_preset.py | 40 | def test_validate_preset_unknown_module_option(): | CODE |
| LOW⚡ | bbot/test/test_step_1/test_validate_preset.py | 49 | def test_validate_preset_wrong_type_on_module_option(): | CODE |
| LOW⚡ | bbot/test/test_step_1/test_validate_preset.py | 58 | def test_validate_preset_unknown_module_in_config(): | CODE |
| LOW⚡ | bbot/test/test_step_1/test_validate_preset.py | 65 | def test_validate_preset_multiple_errors(): | CODE |
| LOW⚡ | bbot/test/test_step_1/test_validate_preset.py | 83 | def test_validate_preset_non_dict(): | CODE |
| LOW⚡ | bbot/test/test_step_1/test_validate_preset.py | 89 | def test_validate_preset_config_modules_as_list(): | CODE |
| LOW⚡ | bbot/test/test_step_1/test_validate_preset.py | 97 | def test_validate_preset_module_dirs_as_string(): | CODE |
| LOW⚡ | bbot/test/test_step_1/test_validate_preset.py | 103 | def test_validate_preset_modules_as_string_no_cascade(): | CODE |
| LOW⚡ | bbot/test/test_step_1/test_validate_preset.py | 112 | def test_validate_preset_non_string_module_entry_no_crash(): | CODE |
| LOW | bbot/test/test_step_1/test_validate_preset.py | 132 | def test_validate_preset_top_level_typo_suggests_preset_field(): | CODE |
| LOW | bbot/test/test_step_1/test_validate_preset.py | 147 | def test_validate_preset_file_missing_returns_error(): | CODE |
| LOW | bbot/test/test_step_1/test_validate_preset.py | 156 | def test_from_dict_raises_on_typos(): | CODE |
| LOW | bbot/test/test_step_1/test_validate_preset.py | 169 | def test_from_yaml_string_raises_on_top_level_typo(): | CODE |
| LOW | bbot/test/test_step_1/test_validate_preset.py | 181 | def test_from_yaml_config_typo_deferred_to_validate(): | CODE |
| LOW | bbot/test/test_step_1/test_validate_preset.py | 195 | def test_validate_preset_interactsh_server_accepts_valid(): | CODE |
| 243 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bbot/cli.py | 39 | CODE | |
| LOW | bbot/cli.py | 346 | CODE | |
| LOW | bbot/core/modules.py | 197 | CODE | |
| LOW | bbot/core/modules.py | 347 | CODE | |
| LOW | bbot/core/modules.py | 457 | CODE | |
| LOW | bbot/core/modules.py | 535 | CODE | |
| LOW | bbot/core/modules.py | 595 | CODE | |
| LOW | bbot/core/modules.py | 865 | CODE | |
| LOW | bbot/core/modules.py | 1003 | CODE | |
| LOW | bbot/core/modules.py | 572 | CODE | |
| LOW | bbot/core/config/models.py | 181 | CODE | |
| LOW | bbot/core/config/logger.py | 89 | CODE | |
| LOW | bbot/core/event/helpers.py | 66 | CODE | |
| LOW | bbot/core/event/base.py | 2306 | CODE | |
| LOW | bbot/core/event/base.py | 460 | CODE | |
| LOW | bbot/core/event/base.py | 660 | CODE | |
| LOW | bbot/core/event/base.py | 1196 | CODE | |
| LOW | bbot/core/event/base.py | 1227 | CODE | |
| LOW | bbot/core/event/base.py | 1605 | CODE | |
| LOW | bbot/core/event/base.py | 1751 | CODE | |
| LOW | bbot/core/helpers/misc.py | 891 | CODE | |
| LOW | bbot/core/helpers/misc.py | 1192 | CODE | |
| LOW | bbot/core/helpers/misc.py | 1444 | CODE | |
| LOW | bbot/core/helpers/misc.py | 1469 | CODE | |
| LOW | bbot/core/helpers/misc.py | 2111 | CODE | |
| LOW | bbot/core/helpers/misc.py | 2313 | CODE | |
| LOW | bbot/core/helpers/misc.py | 2522 | CODE | |
| LOW | bbot/core/helpers/misc.py | 2616 | CODE | |
| LOW | bbot/core/helpers/misc.py | 2663 | CODE | |
| LOW | bbot/core/helpers/misc.py | 2854 | CODE | |
| LOW | bbot/core/helpers/misc.py | 2891 | CODE | |
| LOW | bbot/core/helpers/files.py | 12 | CODE | |
| LOW | bbot/core/helpers/files.py | 52 | CODE | |
| LOW | bbot/core/helpers/command.py | 14 | CODE | |
| LOW | bbot/core/helpers/command.py | 80 | CODE | |
| LOW | bbot/core/helpers/command.py | 234 | CODE | |
| LOW | bbot/core/helpers/validators.py | 78 | CODE | |
| LOW | bbot/core/helpers/yara_helper.py | 38 | CODE | |
| LOW | bbot/core/helpers/wordcloud.py | 89 | CODE | |
| LOW | bbot/core/helpers/wordcloud.py | 327 | CODE | |
| LOW | bbot/core/helpers/wordcloud.py | 368 | CODE | |
| LOW | bbot/core/helpers/wordcloud.py | 499 | CODE | |
| LOW | bbot/core/helpers/url.py | 105 | CODE | |
| LOW | bbot/core/helpers/helper.py | 329 | CODE | |
| LOW | bbot/core/helpers/diff.py | 218 | CODE | |
| LOW | bbot/core/helpers/diff.py | 256 | CODE | |
| LOW | bbot/core/helpers/diff.py | 350 | CODE | |
| LOW | bbot/core/helpers/interactsh.py | 289 | CODE | |
| LOW | bbot/core/helpers/ratelimiter.py | 38 | CODE | |
| LOW | bbot/core/helpers/web/web.py | 99 | CODE | |
| LOW | bbot/core/helpers/web/web.py | 351 | CODE | |
| LOW | bbot/core/helpers/web/web.py | 434 | CODE | |
| LOW | bbot/core/helpers/web/web.py | 523 | CODE | |
| LOW | bbot/core/helpers/web/envelopes.py | 115 | CODE | |
| LOW | bbot/core/helpers/depsinstaller/installer.py | 155 | CODE | |
| LOW | bbot/core/helpers/depsinstaller/installer.py | 361 | CODE | |
| LOW | bbot/core/helpers/dns/brute.py | 85 | CODE | |
| LOW | bbot/core/helpers/dns/dns.py | 181 | CODE | |
| LOW | bbot/core/helpers/dns/helpers.py | 19 | CODE | |
| LOW | bbot/test/conftest.py | 159 | CODE | |
| 184 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bbot/cli.py | 389 | except Exception as e: | STRING |
| LOW | bbot/cli.py | 397 | except Exception as e: | STRING |
| LOW | bbot/cli.py | 443 | except Exception as e: | STRING |
| MEDIUM | bbot/cli.py | 381 | def akeyboard_listen(): | CODE |
| LOW | bbot/core/core.py | 163 | except Exception: | CODE |
| LOW | bbot/core/modules.py | 112 | except Exception as e: | CODE |
| LOW | bbot/core/modules.py | 423 | except Exception: | CODE |
| LOW | bbot/core/modules.py | 563 | except Exception as e: | CODE |
| MEDIUM | bbot/core/modules.py | 554 | def make_adapter(annotation): | CODE |
| LOW | bbot/core/config/files.py | 72 | except Exception as e: | CODE |
| LOW | bbot/core/config/__init__.py | 6 | except Exception: | CODE |
| LOW | bbot/core/event/spill.py | 162 | except Exception as e: # pragma: no cover — defensive | CODE |
| MEDIUM | bbot/core/event/base.py | 366 | def host_metadata(self): | CODE |
| MEDIUM | bbot/core/event/base.py | 1828 | def http_status(self): | CODE |
| LOW | bbot/core/event/base.py | 279 | except Exception as e: | CODE |
| LOW | bbot/core/event/base.py | 501 | except Exception as e: | CODE |
| LOW | bbot/core/event/base.py | 1005 | except Exception: | CODE |
| LOW | bbot/core/event/base.py | 1839 | except Exception: | CODE |
| LOW | bbot/core/event/base.py | 2206 | except Exception as e: | CODE |
| LOW | bbot/core/event/base.py | 2234 | except Exception as e: | CODE |
| LOW | bbot/core/event/base.py | 2241 | except Exception: | CODE |
| LOW | bbot/core/event/base.py | 2376 | except Exception as e: | CODE |
| LOW | bbot/core/event/base.py | 2466 | except Exception: | CODE |
| LOW | bbot/core/helpers/misc.py | 622 | except Exception: | CODE |
| LOW | bbot/core/helpers/misc.py | 626 | except Exception: | CODE |
| LOW | bbot/core/helpers/misc.py | 1579 | except Exception as e: | CODE |
| LOW | bbot/core/helpers/misc.py | 1773 | except Exception as e: | CODE |
| LOW | bbot/core/helpers/files.py | 45 | except Exception as e: | CODE |
| LOW | bbot/core/helpers/files.py | 91 | except Exception as e: | CODE |
| LOW | bbot/core/helpers/files.py | 139 | except Exception as e: | CODE |
| LOW | bbot/core/helpers/files.py | 164 | except Exception as e: | CODE |
| LOW | bbot/core/helpers/command.py | 225 | except Exception as e: | CODE |
| MEDIUM | bbot/core/helpers/command.py | 220 | def _write_proc_line(proc, chunk): | CODE |
| LOW | bbot/core/helpers/ntlm.py | 71 | except Exception: | CODE |
| LOW | bbot/core/helpers/ntlm.py | 79 | except Exception as e: | CODE |
| MEDIUM | bbot/core/helpers/ntlm.py | 68 | def ntlmdecode(authenticate_header): | CODE |
| LOW | bbot/core/helpers/validators.py | 35 | except Exception as e: | CODE |
| LOW | bbot/core/helpers/validators.py | 115 | except Exception: | CODE |
| LOW | bbot/core/helpers/validators.py | 121 | except Exception: | CODE |
| MEDIUM | bbot/core/helpers/validators.py | 32 | def validate_wrapper(*args, **kwargs): | CODE |
| LOW | bbot/core/helpers/asn.py | 77 | except Exception as e: | CODE |
| LOW | bbot/core/helpers/asn.py | 99 | except Exception as e: | CODE |
| LOW | bbot/core/helpers/asn.py | 111 | except Exception: | CODE |
| LOW | bbot/core/helpers/wordcloud.py | 361 | except Exception as e: | CODE |
| LOW | bbot/core/helpers/wordcloud.py | 394 | except Exception as e: | CODE |
| LOW | bbot/core/helpers/url.py | 171 | except Exception: | CODE |
| LOW | bbot/core/helpers/diff.py | 68 | except Exception: | CODE |
| LOW | bbot/core/helpers/diff.py | 205 | except Exception as e: | CODE |
| LOW | bbot/core/helpers/interactsh.py | 154 | except Exception: | CODE |
| LOW | bbot/core/helpers/interactsh.py | 266 | except Exception as e: | CODE |
| LOW | bbot/core/helpers/bloom.py | 73 | except Exception: | CODE |
| MEDIUM | bbot/core/helpers/bloom.py | 70 | def __del__(self): | CODE |
| LOW | bbot/core/helpers/web/web.py | 600 | except Exception as e: | CODE |
| LOW | bbot/core/helpers/web/web.py | 672 | except Exception as e: | CODE |
| MEDIUM⚡ | bbot/core/helpers/depsinstaller/sudo_askpass.py | 28 | print("Error: Encrypted password or encryption key not found in environment variables.", file=sys.stderr) | CODE |
| LOW⚡ | bbot/core/helpers/depsinstaller/sudo_askpass.py | 35 | except Exception as e: | CODE |
| MEDIUM⚡ | bbot/core/helpers/depsinstaller/sudo_askpass.py | 36 | print(f"Error decrypting sudo password: {str(e)}", file=sys.stderr) | CODE |
| LOW | bbot/test/worker.py | 101 | except Exception as e: | CODE |
| LOW | bbot/test/conftest.py | 475 | except Exception as e: | CODE |
| MEDIUM | bbot/test/conftest.py | 476 | print(f"An error occurred: {str(e)}") | CODE |
| 146 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | bbot/core/config/models.py | 159 | except ValidationError: | CODE |
| HIGH | bbot/core/event/spill.py | 160 | except FileNotFoundError: | CODE |
| HIGH | bbot/core/event/base.py | 1248 | except KeyError: | CODE |
| HIGH | bbot/core/event/base.py | 1340 | except AttributeError: | CODE |
| HIGH | bbot/core/event/base.py | 2460 | except AttributeError: | CODE |
| HIGH | bbot/core/helpers/async_helpers.py | 124 | except StopAsyncIteration: | CODE |
| HIGH | bbot/core/helpers/async_helpers.py | 154 | except KeyError: | CODE |
| HIGH | bbot/core/helpers/async_helpers.py | 159 | except ValueError: | CODE |
| HIGH | bbot/core/helpers/misc.py | 727 | except ValueError: | CODE |
| HIGH | bbot/core/helpers/misc.py | 731 | except ValueError: | CODE |
| HIGH | bbot/core/helpers/misc.py | 1869 | except UnicodeError: | CODE |
| HIGH | bbot/core/helpers/misc.py | 1887 | except UnicodeError: | CODE |
| HIGH | bbot/core/helpers/misc.py | 2106 | except KeyError: | CODE |
| HIGH | bbot/core/helpers/misc.py | 2696 | except StopIteration: | CODE |
| HIGH | bbot/core/helpers/misc.py | 626 | except Exception: | CODE |
| HIGH | bbot/core/helpers/misc.py | 2711 | except StopIteration: | CODE |
| HIGH | bbot/core/helpers/asn.py | 111 | except Exception: | CODE |
| HIGH | bbot/core/helpers/diff.py | 68 | except Exception: | CODE |
| HIGH | bbot/core/helpers/interactsh.py | 208 | except (asyncio.CancelledError, Exception): | CODE |
| HIGH | bbot/core/helpers/bloom.py | 73 | except Exception: | CODE |
| HIGH | bbot/core/helpers/dns/dns.py | 311 | except KeyError: | CODE |
| HIGH | bbot/test/conftest.py | 521 | except Exception: | CODE |
| HIGH | bbot/test/conftest.py | 516 | except io.UnsupportedOperation: | CODE |
| HIGH | bbot/test/benchmarks/_eventloop_profiler.py | 357 | except (KeyboardInterrupt, SystemExit): | CODE |
| HIGH | bbot/test/benchmarks/_eventloop_profiler.py | 292 | except asyncio.TimeoutError: | CODE |
| HIGH | bbot/test/benchmarks/_memory_helpers.py | 138 | except TypeError: | CODE |
| HIGH | bbot/test/benchmarks/test_ipaddress_benchmarks.py | 120 | except Exception: | CODE |
| HIGH | bbot/test/benchmarks/test_ipaddress_benchmarks.py | 138 | except Exception: | CODE |
| HIGH | …t/test/test_step_2/module_tests/test_module_elastic.py | 67 | except URLError: | CODE |
| HIGH | …t/test/test_step_2/module_tests/test_module_elastic.py | 123 | except URLError: | CODE |
| HIGH | …test/test_step_2/module_tests/test_module_lightfuzz.py | 358 | except ValueError: | CODE |
| HIGH | bbot/modules/subdomainradar.py | 156 | except asyncio.TimeoutError: | CODE |
| HIGH | bbot/modules/subdomainradar.py | 165 | except asyncio.CancelledError: | CODE |
| HIGH | bbot/modules/paramminer_headers.py | 185 | except AssertionError: | CODE |
| HIGH | bbot/modules/trajan.py | 215 | except ValueError: | CODE |
| HIGH | bbot/modules/wayback.py | 326 | except ValueError: | CODE |
| HIGH | bbot/modules/wayback.py | 254 | except ValueError: | CODE |
| HIGH | bbot/modules/http.py | 128 | except ValueError: | CODE |
| HIGH | bbot/modules/internal/cloudcheck.py | 59 | except KeyError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bbot/cli.py | 8 | CODE | |
| LOW | bbot/core/config/merge.py | 9 | CODE | |
| LOW | bbot/core/config/models.py | 14 | CODE | |
| LOW | bbot/core/event/__init__.py | 1 | CODE | |
| LOW | bbot/core/event/__init__.py | 1 | CODE | |
| LOW | bbot/core/event/__init__.py | 1 | CODE | |
| LOW | bbot/core/event/__init__.py | 1 | CODE | |
| LOW | bbot/core/event/base.py | 24 | CODE | |
| LOW | bbot/core/helpers/misc.py | 18 | CODE | |
| LOW | bbot/core/helpers/misc.py | 20 | CODE | |
| LOW | bbot/core/helpers/misc.py | 20 | CODE | |
| LOW | bbot/core/helpers/misc.py | 21 | CODE | |
| LOW | bbot/core/helpers/misc.py | 23 | CODE | |
| LOW | bbot/core/helpers/misc.py | 24 | CODE | |
| LOW | bbot/core/helpers/misc.py | 27 | CODE | |
| LOW | bbot/core/helpers/misc.py | 27 | CODE | |
| LOW | bbot/core/helpers/misc.py | 27 | CODE | |
| LOW | bbot/core/helpers/__init__.py | 1 | CODE | |
| LOW | bbot/core/helpers/__init__.py | 2 | CODE | |
| LOW | bbot/core/helpers/__init__.py | 3 | CODE | |
| LOW | bbot/core/helpers/__init__.py | 4 | CODE | |
| LOW | bbot/core/helpers/helper.py | 76 | CODE | |
| LOW | bbot/core/helpers/helper.py | 79 | CODE | |
| LOW | bbot/core/helpers/helper.py | 79 | CODE | |
| LOW | bbot/core/helpers/helper.py | 79 | CODE | |
| LOW | bbot/core/helpers/helper.py | 79 | CODE | |
| LOW | bbot/core/helpers/helper.py | 80 | CODE | |
| LOW | bbot/core/helpers/helper.py | 80 | CODE | |
| LOW | bbot/core/helpers/helper.py | 80 | CODE | |
| LOW | bbot/core/helpers/helper.py | 80 | CODE | |
| LOW | bbot/core/helpers/helper.py | 81 | CODE | |
| LOW | bbot/core/helpers/helper.py | 81 | CODE | |
| LOW | bbot/core/helpers/helper.py | 81 | CODE | |
| LOW | bbot/core/helpers/helper.py | 81 | CODE | |
| LOW | bbot/core/helpers/web/__init__.py | 1 | CODE | |
| LOW | bbot/core/helpers/depsinstaller/__init__.py | 1 | CODE | |
| LOW | bbot/core/helpers/dns/dns.py | 13 | CODE | |
| LOW | bbot/core/helpers/dns/__init__.py | 1 | CODE | |
| LOW | bbot/test/bbot_fixtures.py | 1 | CODE | |
| LOW | bbot/test/bbot_fixtures.py | 2 | CODE | |
| LOW | bbot/test/bbot_fixtures.py | 4 | CODE | |
| LOW | bbot/test/bbot_fixtures.py | 5 | CODE | |
| LOW | bbot/test/bbot_fixtures.py | 13 | CODE | |
| LOW | bbot/test/mock_blasthttp.py | 33 | CODE | |
| LOW | bbot/test/mock_blasthttp.py | 33 | CODE | |
| LOW | bbot/test/mock_blasthttp.py | 33 | CODE | |
| LOW | bbot/test/test_step_1/test_command.py | 2 | CODE | |
| LOW | bbot/test/test_step_1/test_field_metadata.py | 10 | CODE | |
| LOW | bbot/test/test_step_1/test_db_models.py | 7 | CODE | |
| LOW | bbot/test/test_step_1/test_manager_scope_accuracy.py | 12 | CODE | |
| LOW | bbot/test/test_step_1/test_manager_deduplication.py | 1 | CODE | |
| LOW | bbot/test/test_step_1/test_target.py | 1 | CODE | |
| LOW | bbot/test/test_step_1/test_validate_preset.py | 1 | CODE | |
| LOW | bbot/test/test_step_1/test_depsinstaller.py | 3 | CODE | |
| LOW | bbot/test/test_step_1/test_python_api.py | 1 | CODE | |
| LOW | bbot/test/test_step_1/test_web.py | 5 | CODE | |
| LOW | bbot/test/test_step_1/test_scope.py | 1 | CODE | |
| LOW | bbot/test/test_step_1/test_presets.py | 4 | CODE | |
| LOW | bbot/test/test_step_1/test_dns.py | 1 | CODE | |
| LOW | bbot/test/test_step_1/test_gitdumper_safeguards.py | 10 | CODE | |
| 54 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …_step_2/module_tests/test_module_paramminer_headers.py | 0 | <html> <title>the title</title> <body> <p>hello null!</p>'; </body> </html> | STRING |
| HIGH | …tep_2/module_tests/test_module_paramminer_getparams.py | 0 | <html> <title>the title</title> <body> <p>hello null!</p>'; </body> </html> | STRING |
| HIGH | …st_step_2/module_tests/test_module_url_manipulation.py | 0 | <html> <title>the title</title> <body> <p>hello null!</p>'; </body> </html> | STRING |
| HIGH | …_step_2/module_tests/test_module_paramminer_cookies.py | 0 | <html> <title>the title</title> <body> <p>hello null!</p>'; </body> </html> | STRING |
| HIGH | …_step_2/module_tests/test_module_paramminer_headers.py | 0 | <html> <title>the title</title> <body> <p>hello aaaaaaaaaaaaaa!</p>'; </body> </html> | STRING |
| HIGH | …tep_2/module_tests/test_module_paramminer_getparams.py | 0 | <html> <title>the title</title> <body> <p>hello aaaaaaaaaaaaaa!</p>'; </body> </html> | STRING |
| HIGH | …st_step_2/module_tests/test_module_url_manipulation.py | 0 | <html> <title>the title</title> <body> <p>hello aaaaaaaaaaaaaa!</p>'; </body> </html> | STRING |
| HIGH | …_step_2/module_tests/test_module_paramminer_cookies.py | 0 | <html> <title>the title</title> <body> <p>hello aaaaaaaaaaaaaa!</p>'; </body> </html> | STRING |
| HIGH | …_step_2/module_tests/test_module_paramminer_headers.py | 0 | <html> <title>the title</title> <body> <p>hello administrator!</p>'; </body> </html> | STRING |
| HIGH | …tep_2/module_tests/test_module_paramminer_getparams.py | 0 | <html> <title>the title</title> <body> <p>hello administrator!</p>'; </body> </html> | STRING |
| HIGH | …_step_2/module_tests/test_module_paramminer_cookies.py | 0 | <html> <title>the title</title> <body> <p>hello administrator!</p>'; </body> </html> | STRING |
| HIGH | …t/test/test_step_2/module_tests/test_module_apkpure.py | 0 | <!doctype html> <html> <head> <title>"blacklanternsecurity" - android apps on google play</title> </head> <body> <a href | STRING |
| HIGH | bbot/test/test_step_2/module_tests/test_module_jadx.py | 0 | <!doctype html> <html> <head> <title>"blacklanternsecurity" - android apps on google play</title> </head> <body> <a href | STRING |
| HIGH | …st_step_2/module_tests/test_module_google_playstore.py | 0 | <!doctype html> <html> <head> <title>"blacklanternsecurity" - android apps on google play</title> </head> <body> <a href | STRING |
| HIGH | …t/test/test_step_2/module_tests/test_module_apkpure.py | 0 | <!doctype html> <html> <head> <title>bbot</title> </head> <body> <meta name="appstore:developer_url" content="https://ww | STRING |
| HIGH | bbot/test/test_step_2/module_tests/test_module_jadx.py | 0 | <!doctype html> <html> <head> <title>bbot</title> </head> <body> <meta name="appstore:developer_url" content="https://ww | STRING |
| HIGH | …st_step_2/module_tests/test_module_google_playstore.py | 0 | <!doctype html> <html> <head> <title>bbot</title> </head> <body> <meta name="appstore:developer_url" content="https://ww | STRING |
| HIGH | bbot/modules/paramminer_headers.py | 0 | inspired by https://github.com/portswigger/param-miner | STRING |
| HIGH | bbot/modules/paramminer_cookies.py | 0 | inspired by https://github.com/portswigger/param-miner | STRING |
| HIGH | bbot/modules/paramminer_getparams.py | 0 | inspired by https://github.com/portswigger/param-miner | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | bbot/core/event/spill.py | 92 | # ── Public API ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bbot/core/event/spill.py | 180 | # ── Internal ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bbot/core/helpers/dns/dns.py | 104 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | bbot/core/helpers/dns/dns.py | 107 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | bbot/core/helpers/dns/dns.py | 173 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | bbot/core/helpers/dns/dns.py | 175 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | bbot/core/helpers/dns/dns.py | 354 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | bbot/core/helpers/dns/dns.py | 356 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | bbot/core/helpers/dns/dns.py | 420 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | bbot/core/helpers/dns/dns.py | 422 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | bbot/test/mock_blasthttp.py | 55 | # should_intercept, request, request_batch, ...) ────────────── | COMMENT |
| MEDIUM | bbot/test/mock_blasthttp.py | 156 | # ── Batch-streaming entry point (per-call real_client) ────────── | COMMENT |
| MEDIUM⚡ | bbot/test/test_step_1/test_body_spill.py | 33 | # ── BodySpillStore unit tests ───────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | bbot/test/test_step_1/test_body_spill.py | 240 | # ── _BaselineSnapshot unit tests ────────────────────────────────────── | COMMENT |
| MEDIUM | bbot/test/test_step_1/test_body_spill.py | 145 | # ── HTTP_RESPONSE event integration tests ──────────────────────────── | COMMENT |
| MEDIUM | bbot/test/benchmarks/_eventloop_profiler.py | 31 | # ── Configuration ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bbot/test/benchmarks/_eventloop_profiler.py | 197 | # ── Top coroutines by total time ──────────────────────── | COMMENT |
| MEDIUM | bbot/test/benchmarks/_eventloop_profiler.py | 210 | # ── Top coroutines by max single step ─────────────────── | COMMENT |
| MEDIUM | bbot/test/benchmarks/_eventloop_profiler.py | 221 | # ── Slow step log ─────────────────────────────────────── | COMMENT |
| MEDIUM | bbot/test/benchmarks/_eventloop_profiler.py | 228 | # ── Task count timeline ───────────────────────────────── | COMMENT |
| MEDIUM | bbot/test/benchmarks/_eventloop_profiler.py | 239 | # ── Task breakdown at peak ────────────────────────────── | COMMENT |
| MEDIUM | …est/test_step_2/module_tests/test_module_cloudcheck.py | 67 | # ── Parent-inheritance regression tests ──────────────────────── | COMMENT |
| MEDIUM | …est/test_step_2/module_tests/test_module_cloudcheck.py | 127 | # ── _minimize() must not wipe resolved_hosts ─────────────────── | COMMENT |
| MEDIUM | …est/test_step_2/module_tests/test_module_cloudcheck.py | 148 | # ── URL/OPEN_TCP_PORT propagation end-to-end ────────────────── | COMMENT |
| MEDIUM | …est/test_step_2/module_tests/test_module_cloudcheck.py | 180 | # ── YARA prefilter short-circuit ─────────────────────────────── | COMMENT |
| MEDIUM | …est/test_step_2/module_tests/test_module_cloudcheck.py | 198 | # ── LRU cache on cloudcheck.lookup() ─────────────────────────── | COMMENT |
| MEDIUM | …test/test_step_2/module_tests/test_module_lightfuzz.py | 4911 | # --------------------------------------------------------------------------- | STRING |
| MEDIUM | …test/test_step_2/module_tests/test_module_lightfuzz.py | 4913 | # --------------------------------------------------------------------------- | STRING |
| MEDIUM | …test/test_step_2/module_tests/test_module_lightfuzz.py | 5137 | # --------------------------------------------------------------------------- | STRING |
| MEDIUM | …test/test_step_2/module_tests/test_module_lightfuzz.py | 5139 | # --------------------------------------------------------------------------- | STRING |
| MEDIUM | …test/test_step_2/module_tests/test_module_lightfuzz.py | 5205 | # --------------------------------------------------------------------------- | STRING |
| MEDIUM | …test/test_step_2/module_tests/test_module_lightfuzz.py | 5207 | # --------------------------------------------------------------------------- | STRING |
| MEDIUM | …test/test_step_2/module_tests/test_module_lightfuzz.py | 5299 | # --------------------------------------------------------------------------- | STRING |
| MEDIUM | …test/test_step_2/module_tests/test_module_lightfuzz.py | 5301 | # --------------------------------------------------------------------------- | STRING |
| MEDIUM | bbot/modules/templates/gitlab.py | 90 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | bbot/modules/templates/gitlab.py | 92 | # ------------------------------------------------------------------ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | bbot/core/event/base.py | 795 | # Create a shallow copy of the event first | COMMENT |
| MEDIUM | bbot/core/helpers/yara_helper.py | 22 | # Create the complete YARA rule | COMMENT |
| MEDIUM | bbot/core/helpers/bloom.py | 23 | # Create an anonymous mmap region, compatible with both Windows and Unix | COMMENT |
| MEDIUM | bbot/core/helpers/web/envelopes.py | 29 | # Create the class | COMMENT |
| MEDIUM | bbot/test/test_step_1/test_target.py | 573 | # Create an ASN event like the scanner does (bare int input) | COMMENT |
| MEDIUM | …ot/test/benchmarks/test_event_validation_benchmarks.py | 14 | # Create a minimal scanner config to isolate event validation performance | COMMENT |
| MEDIUM | bbot/test/benchmarks/test_excavate_benchmarks.py | 124 | # Create a mock HTTP_RESPONSE event | COMMENT |
| MEDIUM | …test/test_step_2/module_tests/test_module_websocket.py | 20 | # Define a coroutine for the server | COMMENT |
| MEDIUM | …st/test_step_2/module_tests/test_module_virtualhost.py | 168 | # Create a dummy module that will emit the URL event during the scan | COMMENT |
| MEDIUM | …st/test_step_2/module_tests/test_module_virtualhost.py | 787 | # Create a dummy module that will emit the URL event during the scan | COMMENT |
| MEDIUM | …test/test_step_2/module_tests/test_module_unarchive.py | 27 | # Create a text file to compress | COMMENT |
| MEDIUM | bbot/models/sql.py | 1 | # This file contains SQLModel (Pydantic + SQLAlchemy) models for BBOT events, scans, and targets. | COMMENT |
| MEDIUM | bbot/modules/hunt.py | 302 | # Create a comma-separated string of categories | COMMENT |
| MEDIUM | bbot/modules/lightfuzz/submodules/cmdi.py | 62 | ) # Initialize the http_compare object and establish a baseline HTTP response | CODE |
| MEDIUM⚡ | bbot/modules/output/postgres.py | 31 | # Create the engine for the initial connection to the server | COMMENT |
| MEDIUM⚡ | bbot/modules/output/postgres.py | 39 | # Create the database if it does not exist | COMMENT |
| MEDIUM | bbot/modules/output/nmap_xml.py | 86 | # Create the root element | COMMENT |
| MEDIUM | bbot/modules/output/nmap_xml.py | 164 | # Create a new document with the doctype | COMMENT |
| MEDIUM⚡ | bbot/modules/output/mysql.py | 30 | # Create the engine for the initial connection to the server | COMMENT |
| MEDIUM⚡ | bbot/modules/output/mysql.py | 38 | # Create the database if it does not exist | COMMENT |
| MEDIUM | bbot/modules/templates/sql.py | 91 | # Create a session factory bound to the engine | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …ot/test/test_step_2/module_tests/test_module_medusa.py | 9 | stdout = "ACCOUNT FOUND: [snmp] Host: 127.0.0.1 User: (null) Password: public [ERROR]\n" | CODE |
| HIGH | …st/test_step_2/module_tests/test_module_docker_pull.py | 269 | "created_by": 'RUN /bin/sh -c set -eux; \t\tsavedAptMark="$(apt-mark showmanual)"; \tapt-get upd | CODE |
| HIGH | …st/test_step_2/module_tests/test_module_docker_pull.py | 303 | "created_by": 'RUN /bin/sh -c set -eux; \t\tsavedAptMark="$(apt-mark showmanual)"; \tapt-get upd | CODE |
| HIGH | …st/test_step_2/module_tests/test_module_docker_pull.py | 337 | "created_by": "RUN /bin/sh -c apt-get update && apt-get install -y openssl gcc git make unzip cu | CODE |
| HIGH | …st/test_step_2/module_tests/test_module_docker_pull.py | 391 | "v1Compatibility": '{"id":"e45a5af57b00862e5ef5782a9925979a02ba2b12dff832fd0991335f4a11e5c5","pa | CODE |
| HIGH | …st/test_step_2/module_tests/test_module_docker_pull.py | 394 | "v1Compatibility": '{"id":"e45a5af57b00862e5ef5782a9925979a02ba2b12dff832fd0991335f4a11e5c5","pa | CODE |
| HIGH | …t/test/test_step_2/module_tests/test_module_ajaxpro.py | 10 | null; r.error = {"Message":"Constructor on type 'AjaxPro.Services.ICartService' not found.","Type":"System.MissingMe | CODE |
| HIGH | …t/test/test_step_2/module_tests/test_module_ajaxpro.py | 54 | <script src="ajax/AMBusinessFacades.AjaxUtils,AMBusinessFacades.ashx" type="text/javascript"></script><script type=' | CODE |
| HIGH | …est/test_step_2/module_tests/test_module_trufflehog.py | 773 | "created_by": 'RUN /bin/sh -c set -eux; \t\tsavedAptMark="$(apt-mark showmanual)"; \tapt-get upd | STRING |
| HIGH | …est/test_step_2/module_tests/test_module_trufflehog.py | 807 | "created_by": 'RUN /bin/sh -c set -eux; \t\tsavedAptMark="$(apt-mark showmanual)"; \tapt-get upd | STRING |
| HIGH | …est/test_step_2/module_tests/test_module_trufflehog.py | 841 | "created_by": "RUN /bin/sh -c apt-get update && apt-get install -y openssl gcc git make unzip cu | STRING |
| HIGH | bbot/modules/lightfuzz/submodules/ssti.py | 14 | collapse trick for engines that render `{{undefined}}` as ""), | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/scanning/configuration.md | 61 | ### BASIC OPTIONS ### | COMMENT |
| LOW | docs/scanning/configuration.md | 81 | max_mem_percent: 90 | COMMENT |
| LOW | docs/scanning/configuration.md | 121 | # This is safe to change | COMMENT |
| LOW | docs/scanning/configuration.md | 161 | user_agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/5 | COMMENT |
| LOW | docs/scanning/configuration.md | 181 | # which will retry API requests that don't return a successful status code | COMMENT |
| LOW | bbot/defaults.yml | 1 | ### BASIC OPTIONS ### | COMMENT |
| LOW | bbot/defaults.yml | 21 | max_mem_percent: 90 | COMMENT |
| LOW | bbot/defaults.yml | 61 | # This is safe to change | COMMENT |
| LOW | bbot/defaults.yml | 101 | user_agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/5 | COMMENT |
| LOW | bbot/defaults.yml | 121 | # which will retry API requests that don't return a successful status code | COMMENT |
| LOW | bbot/core/helpers/regexes.py | 21 | num_regex = re.compile(r"\d+") | COMMENT |
| LOW | bbot/test/benchmarks/__init__.py | 1 | # Benchmark tests for BBOT performance monitoring | COMMENT |
| LOW | …est/benchmarks/test_intercept_throughput_benchmarks.py | 101 | assert cloudcheck_idx >= 0, f"cloudcheck not in intercept chain: {[m.name for m in intercept_modules]}" | COMMENT |
| LOW | …est/test_step_2/module_tests/test_module_cloudcheck.py | 181 | # When no host could possibly match any bucket regex (mismatched | COMMENT |
| LOW | …test/test_step_2/module_tests/test_module_lightfuzz.py | 4461 | if e.type == "FINDING" and "Stream Cipher Keystream Reuse" in e.data.get("description", "") | COMMENT |
| LOW | …test/test_step_2/module_tests/test_module_lightfuzz.py | 4561 | assert secret_seen, ( | COMMENT |
| LOW | …test/test_step_2/module_tests/test_module_lightfuzz.py | 4641 | # attribute (it distinguishes "no value attribute" from "empty value attribute" | COMMENT |
| LOW | …test/test_step_2/module_tests/test_module_unarchive.py | 121 | # ), | COMMENT |
| LOW | …test/test_step_2/module_tests/test_module_unarchive.py | 201 | extract_path = Path(extract_event[0].data["path"]) / "test.txt" | COMMENT |
| LOW | bbot/models/pydantic.py | 41 | return indexed_fields | COMMENT |
| LOW | bbot/presets/subdomain-enum.yml | 21 | # securitytrails: | COMMENT |
| LOW | bbot/modules/securitytxt.py | 1 | # securitytxt.py | COMMENT |
| LOW | bbot/modules/securitytxt.py | 21 | # | COMMENT |
| LOW | bbot/modules/medusa.py | 181 | COMMENT | |
| LOW | bbot/modules/builtwith.py | 1 | ############################################################ | COMMENT |
| LOW | bbot/modules/newsletters.py | 1 | # Created a new module called 'newsletters' that will scrape the websites (or recursive websites, | COMMENT |
| LOW | bbot/modules/dnstlsrpt.py | 1 | # dnstlsrpt.py | COMMENT |
| LOW | bbot/modules/dnscaa.py | 1 | # dnscaa.py | COMMENT |
| LOW | bbot/modules/legba.py | 161 | # -C Combo wordlist delimited by ':' | COMMENT |
| LOW | bbot/modules/dnsbimi.py | 1 | # bimi.py | COMMENT |
| LOW | bbot/modules/dnsbimi.py | 21 | # | COMMENT |
| LOW | bbot/modules/internal/cloudcheck.py | 21 | # LRU cache for cloudcheck.lookup() results. Many subdomains in a single | COMMENT |
| LOW | .github/workflows/codeql.yml | 1 | # For most projects, this workflow file will not need changing; you simply need | COMMENT |
| LOW | .github/workflows/codeql.yml | 61 | # This includes steps like installing compilers or runtimes (`actions/setup-node` | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bbot/core/helpers/misc.py | 843 | # Check if there's still URL-encoded or Unicode-escaped content | COMMENT |
| LOW | …t/test/test_step_2/module_tests/test_module_telerik.py | 174 | # Check if the expected requests were made | COMMENT |
| LOW | bbot/scripts/benchmark_report.py | 57 | # Check if benchmarks directory exists | COMMENT |
| LOW | bbot/modules/azure_tenant.py | 289 | # Check if Exchange Online is in the MX records | COMMENT |
| LOW | bbot/modules/virtualhost.py | 739 | # Check if this virtual host is externally accessible | COMMENT |
| LOW⚡ | bbot/modules/virtualhost.py | 882 | # Check if HTTP codes are different first (hard failure) | COMMENT |
| LOW | bbot/modules/trajan.py | 210 | # Check if it's a specific job | COMMENT |
| LOW | bbot/modules/reflected_parameters.py | 52 | # Check if the probe parameter value is reflected AND the canary is not | COMMENT |
| LOW | bbot/modules/iis_shortnames.py | 356 | # Check if it's a ZIP file | COMMENT |
| LOW | bbot/modules/base.py | 865 | # Check if module accepts seeds and event is a seed (only if event type is watched) | COMMENT |
| LOW | bbot/modules/lightfuzz/submodules/crypto.py | 268 | # Check if the entropy of the data is greater than the threshold, indicating it is likely encrypted | COMMENT |
| LOW | bbot/modules/lightfuzz/submodules/crypto.py | 800 | # Check if cryptographic error strings are present in the response after performing the manipulation techniques | COMMENT |
| LOW | bbot/modules/lightfuzz/submodules/serial.py | 200 | # Check if the value starts with any of the PHP serialized prefixes | COMMENT |
| LOW | bbot/modules/lightfuzz/submodules/sqli.py | 168 | # Check if the status code change is due to a WAF, not SQL injection | COMMENT |
| LOW | bbot/modules/internal/excavate.py | 544 | # Check if the value is in the blacklist or starts with a blacklisted prefix. | COMMENT |
| LOW | bbot/modules/internal/excavate.py | 1497 | # Check if data and decoded_data are identical | STRING |
| LOW | bbot/modules/internal/excavate.py | 1513 | # Check if rule processing function exists | STRING |
| LOW⚡ | bbot/modules/output/postgres.py | 35 | # Check if the database exists | COMMENT |
| LOW⚡ | bbot/modules/output/mysql.py | 34 | # Check if the database exists | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bbot/core/helpers/web/envelopes.py | 121 | # if the value is empty, we just return the text envelope | COMMENT |
| LOW | bbot/core/helpers/web/envelopes.py | 204 | # if there's only one value to set, we can just set it directly | COMMENT |
| MEDIUM | bbot/test/benchmarks/_memory_helpers.py | 81 | # median over the last 25% of samples — robust to a single | COMMENT |
| MEDIUM⚡ | bbot/test/benchmarks/test_bloom_filter_benchmarks.py | 31 | """Benchmark comprehensive bloom filter operations (add, check, mixed) for DNS brute-forcing""" | STRING |
| MEDIUM | …ot/test/benchmarks/test_event_validation_benchmarks.py | 283 | """Benchmark full scan startup event validation with large batch (1000 targets) for comprehensive testing""" | STRING |
| MEDIUM | …/test/test_step_2/module_tests/test_module_excavate.py | 1915 | # here because the wall-clock includes the rest of the scan harness. | STRING |
| MEDIUM | bbot/modules/azure_tenant.py | 49 | # 4. Merge all data sources into comprehensive event | COMMENT |
| MEDIUM | bbot/modules/azure_tenant.py | 57 | # 6. Emit comprehensive AZURE_TENANT event | COMMENT |
| MEDIUM | bbot/modules/azure_tenant.py | 355 | """Merge data from all sources into single comprehensive event.""" | STRING |
| LOW | bbot/modules/dnsbrute_mutations.py | 33 | # here we don't brute-force, we just add the subdomain to our end-of-scan | COMMENT |
| LOW | bbot/modules/telerik.py | 335 | # Sometimes webapps will just return 500 for everything, so rule out the false positive | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bbot/core/event/base.py | 2306 | CODE | |
| LOW | bbot/core/event/base.py | 195 | CODE | |
| LOW | bbot/core/helpers/helper.py | 170 | CODE | |
| LOW | bbot/core/helpers/diff.py | 73 | CODE | |
| LOW | bbot/core/helpers/diff.py | 256 | CODE | |
| LOW | bbot/scripts/docs.py | 105 | CODE | |
| LOW | bbot/modules/fullhunt.py | 37 | CODE | |
| LOW | bbot/modules/rapiddns.py | 19 | CODE | |
| LOW | bbot/modules/securitytrails.py | 28 | CODE | |
| LOW | bbot/modules/hackertarget.py | 19 | CODE | |
| LOW | bbot/modules/subdomaincenter.py | 19 | CODE | |
| LOW | bbot/modules/leakix.py | 30 | CODE | |
| LOW | bbot/modules/reflected_parameters.py | 92 | CODE | |
| LOW | bbot/modules/output/asset_inventory.py | 78 | CODE | |
| LOW | bbot/scanner/preset/preset.py | 114 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | docs/javascripts/vega-lite@5.js | 1 | !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("vega")):"function"==typeof define | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bbot/core/config/merge.py | 94 | __all__ = ["deep_merge", "dotted_get", "dotted_set", "iter_dotted_paths"] | CODE |
| LOW | bbot/core/config/models.py | 469 | __all__ = [ | CODE |
| LOW | bbot/core/event/__init__.py | 3 | __all__ = ["make_event", "update_event", "is_event", "event_from_json"] | CODE |
| LOW | bbot/core/helpers/depsinstaller/__init__.py | 3 | __all__ = ["DepsInstaller"] | CODE |
| LOW | bbot/core/helpers/dns/dns.py | 469 | __all__ = ["DNSHelper", "all_rdtypes", "extract_targets", "record_to_text"] | CODE |
| LOW | …/test_step_2/module_tests/test_module_bucket_amazon.py | 7 | __all__ = ["random_bucket_name_1", "random_bucket_name_2", "random_bucket_name_3", "Bucket_Amazon_Base"] | CODE |
| LOW | bbot/scanner/__init__.py | 18 | __all__ = [ | CODE |
| LOW | bbot/scanner/preset/__init__.py | 16 | __all__ = [ | CODE |
| LOW | bbot/scanner/preset/validate.py | 317 | __all__ = ["PresetValidationError", "prevalidate_preset", "validate_preset", "validate_preset_file"] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …ot/test/benchmarks/test_event_validation_benchmarks.py | 412 | ("admin@example.com", "EMAIL_ADDRESS"), | CODE |
| LOW | bbot/test/benchmarks/test_excavate_benchmarks.py | 38 | padding_pattern = "Lorem ipsum dolor sit amet consectetur adipiscing elit sed do eiusmod tempor incididu | CODE |
| LOW | bbot/test/benchmarks/test_excavate_benchmarks.py | 38 | padding_pattern = "Lorem ipsum dolor sit amet consectetur adipiscing elit sed do eiusmod tempor incididu | CODE |
| LOW | bbot/wordlists/paramminer_cookies.txt | 351 | fake_user | CODE |
| LOW | bbot/modules/newsletters.py | 3 | # contains a 'placeholder'. The combination of these two HTML items usually signify the presence | COMMENT |
| LOW | bbot/modules/newsletters.py | 33 | regex = re.compile(r"placeholder") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bbot/scanner/preset/environ.py | 52 | # if we're running in a virtual environment, make sure to include its /bin in PATH | COMMENT |
| MEDIUM | .github/workflows/codeql.yml | 54 | # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bbot/test/test_step_1/test_helpers.py | 818 | async def do_stuff(r): | CODE |
| LOW | bbot/modules/base.py | 994 | async def run_task(self, coro, name, n=1): | CODE |