OWASP Amass
Amass maps an organisation's external attack surface by enumerating subdomains and related network assets from many public sources.
What it is used for
- Discover forgotten subdomains of a domain you own
- Build an asset inventory for a security review
Key features
- Passive and active enumeration
- Many data sources
- Graph database of discovered assets
Installation
Install from your distribution, a release binary or Go; see the project wiki.
Beginner usage guide
Begin with the default passive enumeration to learn what is publicly known about a domain you own, then decide whether active checks are appropriate. Flags changed between major versions, so read `amass enum -h` for the version you installed.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
amass enum -d example.comIn Amass v5 passive collection is the default; the old -passive flag is deprecated. Add -active only for domains you own because it contacts the target (zone transfers, certificate grabs). Use a domain you own.