arsenal/amass

amass

attack-surface mapping · Apache-2.0

OWASP's deep subdomain enumeration and DNS mapping tool, for building a thorough picture of an external attack surface.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01Where amass goes beyond a quick harvest

theHarvester gives you a fast, broad footprint. amass goes deep. It is OWASP's dedicated attack-surface mapper, pulling from dozens of data sources, certificate logs, and passive DNS, and optionally brute-forcing and permuting names and resolving them, to find subdomains the lighter tools miss. On a serious external assessment, amass is how you make sure you have found the whole surface, not just the obvious part.

↑ contents

02Install

amass is distributed as a single Go binary; your package manager or a direct release download both work. Results improve a lot when you add free API keys to its config file, since many data sources need one.

$ sudo apt install amass # Debian / Kali

$ go install github.com/owasp-amass/amass/v4/...@master # Gentoo / Fedora / any (Go)

$ # or grab a prebuilt release from github.com/owasp-amass/amass

03amass intel: find the domains first

Before enumerating subdomains you need the root domains, and large organisations own many. amass intel discovers them, from an organisation name, an ASN, or reverse-whois, so your work starts from the full footprint rather than the one domain you happened to know.

$ amass intel -org 'Warfi'

$ amass intel -asn 64500

$ amass intel -whois -d warfi.net

» Like the enumeration side, intel improves a lot with API keys in amass's config file. Once you have findings, amass viz renders the relationships as a graph you can explore.

intel probes third-party data and, with -asn, maps network ownership. Run it only against organisations you are authorised to assess; the same scope rules as the rest of amass apply.

04Passive enumeration first

Start passive: amass queries data sources only, never touching the target's DNS directly. It is quiet, safe, and often enough on its own. The subcommand is enum with -passive.

$ amass enum -passive -d warfi.net

05Active enumeration for depth

When you are authorized to probe, active mode resolves names, follows DNS, reads certificates from live hosts, and can brute-force and permute names to find more. It finds more than passive, at the cost of touching the target's DNS.

$ amass enum -active -d warfi.net -brute

» Active enumeration is the line between reading public data and interacting with the target. Stay passive unless your scope explicitly allows active.

06The results database

amass keeps findings in a local graph database, so results accumulate across runs and you can query and visualise relationships between names, IPs, and netblocks later rather than re-running everything.

$ amass db -d warfi.net -show

$ amass db -d warfi.net -names | sort -u > amass-subs.txt

↑ contents

07Into the active phase

As with theHarvester, the subdomain list is the handoff. Resolve the names, then scan the live hosts. amass's output tends to be larger and deeper, so this is often where a long masscan sweep and nmap follow-up get their target list.

$ amass enum -passive -d warfi.net -o amass-subs.txt

$ # resolve amass-subs.txt, then nmap -sV -iL live-hosts.txt

08Mapping your own surface before attackers do

amass against your own domains is one of the highest-value defensive exercises you can run. Its depth surfaces the things that get forgotten: an old staging host, a dev box with a public IP, a vendor subdomain pointed at a service you no longer use (a subdomain takeover risk). Everything amass finds is something you can decommission, firewall, or monitor before it becomes an entry point.

» Stale subdomains pointing at deprovisioned cloud services are prime subdomain-takeover targets; find and remove the dangling DNS records.

» Dev and staging hosts exposed to the internet are frequent first footholds; put them behind a VPN.

» Run it periodically; your attack surface grows every time someone spins up a new service.

Enumerate your own assets freely. For anyone else's, keep active modes inside written authorization; passive-only is the safe default.

↑ contents