Summary
During a scan, the console can suddenly flip into the terminal's alternate/line-drawing charset, garbling all subsequent output:
[INFO] ␍␊└⎺_⎽␌▒┼: E┴␊┼├⎽ ⎻⎼⎺␍┤␌␊␍ ⎽⎺ °▒⎼: HTTP_RESPONSE: 100, DNS_NAME: 50, URL: 40, FINDING: 12
[INFO] ┼┤␌┌␊␋: T␊└⎻┌▒├␊⎽: 6000 | H⎺⎽├⎽: 200 | RPS: 200
That's normal BBOT output (demo_scan: Events produced so far, nuclei: ... Templates: 6000 | Hosts: 200 | RPS: 200) with each ASCII letter substituted for a DEC Special Graphics glyph. The scan, output files, and on-disk logs are all correct; this is display-only corruption.
Cause
A raw 0x0E byte (Shift Out) from scan data reaches the TTY and switches the terminal to the line-drawing charset; nothing emits the 0x0F counterpart to switch back, so every later line renders wrong. BBOT prints externally-influenced strings to the console without escaping control characters (stderr log formatter, stdout output module, log_to_stderr).
The likely culprit is the nuclei module, which surfaces raw matched/extracted response content into findings that get echoed to the console. It only triggers when a target returns that byte in a spot that gets echoed, so it's rare.
Summary
During a scan, the console can suddenly flip into the terminal's alternate/line-drawing charset, garbling all subsequent output:
That's normal BBOT output (
demo_scan: Events produced so far,nuclei: ... Templates: 6000 | Hosts: 200 | RPS: 200) with each ASCII letter substituted for a DEC Special Graphics glyph. The scan, output files, and on-disk logs are all correct; this is display-only corruption.Cause
A raw
0x0Ebyte (Shift Out) from scan data reaches the TTY and switches the terminal to the line-drawing charset; nothing emits the0x0Fcounterpart to switch back, so every later line renders wrong. BBOT prints externally-influenced strings to the console without escaping control characters (stderr log formatter,stdoutoutput module,log_to_stderr).The likely culprit is the
nucleimodule, which surfaces raw matched/extracted response content into findings that get echoed to the console. It only triggers when a target returns that byte in a spot that gets echoed, so it's rare.