Show and Tell: Real-world Passive Scan results on GitLab

[Developer-Army]

Hey team! I just ran BBPTS in passive/stealth mode (-passive) against the GitLab HackerOne program scope to map the attack surface without active probes. In under 3 minutes, the tool discovered 3,142 subdomains, resolved 1,289 active HTTP endpoints, and identified a candidate subdomain takeover with zero active scanning overhead. The HTML report is clean and incredibly descriptive. Highly recommend trying out passive mode for rapid, low-footprint attack surface mapping!