GO KALI FREE
IntermediateOSINT

Amass Guide: Open Source Attack Surface Mapping

Learn to use Amass for comprehensive attack surface mapping including DNS enumeration, subdomain discovery, integration with APIs, and visualizations.

#Amass#OSINT#Attack Surface#DNS Enumeration#Reconnaissance

Attack Surface Mapping at Scale

Amass is an open-source intelligence-gathering framework for systematic attack surface mapping. Developed by the OWASP community, Amass aggregates data from over 50 passive sources combined with active enumeration to discover subdomains, DNS records, and network infrastructure. Its methodology mirrors the intelligence cycle — collect, process, analyze — at a scale impossible with manual reconnaissance.

Prerequisites

Before studying Amass, you should understand:

  • **DNS Enumeration** — DNS record types and queries
  • **Subdomain Enumeration** — Basic enumeration techniques
  • **OSINT Introduction** — Information gathering methodology
  • **API Concepts** — Using API keys for data sources

    • Installation

    # In GO KALI, Amass is pre-installed
amass --help

# Manual installation
sudo apt install amass

# Or from GitHub releases
wget https://github.com/OWASP/Amass/releases/latest/download/amass_linux_amd64.zip
unzip amass_linux_amd64.zip
sudo mv amass /usr/local/bin/

    Amass Data Sources

    Amass pulls data from over 50 sources including:

  • **Certificate Transparency Logs**: crt.sh, CertSpotter, Google CT
  • **Search Engines**: Google, Bing, Yahoo, DuckDuckGo
  • **DNS Databases**: SecurityTrails, AlienVault OTX, VirusTotal
  • **WHOIS Records**: Reverse WHOIS lookups
  • **Web Archives**: Wayback Machine, Common Crawl
  • **Passive DNS**: BinaryEdge, Censys, Shodan

    • Configuring API Keys

    # Edit config file
nano ~/.config/amass/config.ini

# Add API keys for better results
[data_sources]
[data_sources.SecurityTrails]
apikey = YOUR_SECURITYTRAILS_KEY

[data_sources.VirusTotal]
apikey = YOUR_VIRUSTOTAL_KEY

[data_sources.Shodan]
apikey = YOUR_SHODAN_KEY

[data_sources.Censys]
apikey = YOUR_CENSYS_ID:YOUR_CENSYS_SECRET

    Basic Usage

    Subdomain Enumeration

    # Basic passive enumeration
amass enum -d target.com

# With active techniques (DNS brute forcing)
amass enum -active -d target.com

# Save results to file
amass enum -d target.com -o results.txt

# JSON output for processing
amass enum -d target.com -o results.json -json

# Multiple domains
amass enum -d target.com -d target.org -d target.net

    Intext Mode

    # Extract domains from text files
amass intel -whois -d target.com

# Find related domains via reverse WHOIS
amass intel -org "Target Organization"

    Advanced Enumeration

    Brute Forcing Configuration

    # Use custom wordlist
amass enum -active -d target.com -brute -w /path/to/wordlist.txt

# Include subdomains from known sources
amass enum -active -d target.com -brute -w /usr/share/amass/wordlists/jhaddix_all.txt

    Multiple Techniques Combined

    amass enum   -active   -d target.com   -brute   -w /usr/share/wordlists/dns/subdomains-top1million-50000.txt   -o results.txt   -json results.json   -config ~/.config/amass/config.ini

    Subdomain Resolving

    # Verify subdomains resolve to IPs
amass enum -d target.com -resolve

# With custom resolvers
amass enum -d target.com -r 8.8.8.8,1.1.1.1

    Visualizing Results

    Graph Generation

    # Create HTML visualization
amass viz -d target.com -o visualization/

# DOT format for Graphviz
amass viz -d target.com -dot -o amass.dot
dot -Tpng amass.dot -o amass_graph.png

# D3.js visualization
amass viz -d target.com -d3 -o d3_vis/

    Example: Full Enumeration Pipeline

    #!/bin/bash
DOMAIN=$1

echo "[*] Starting Amass enumeration for $DOMAIN"

# Phase 1: Passive enumeration
echo "[*] Passive enumeration..."
amass enum -passive -d "$DOMAIN" -o "passive_$DOMAIN.txt"

# Phase 2: Active enumeration with brute forcing
echo "[*] Active enumeration..."
amass enum -active -d "$DOMAIN" -brute -o "active_$DOMAIN.txt"

# Phase 3: Combine and deduplicate
echo "[*] Combining results..."
cat "passive_$DOMAIN.txt" "active_$DOMAIN.txt" | sort -u > "all_$DOMAIN.txt"

# Phase 4: Generate visualization
echo "[*] Generating visualization..."
amass viz -d "$DOMAIN" -dot -o "$DOMAIN.dot"
dot -Tpng "$DOMAIN.dot" -o "$DOMAIN.png"

echo "[*] Done! Found $(wc -l < "all_$DOMAIN.txt") unique subdomains"

    Integration with Other Tools

    With Nmap

    # Pipe Amass results to Nmap
amass enum -d target.com | sort -u |   xargs -I{} nmap -sV -p 80,443,8080 {} -oN nmap_scan.txt

    With httprobe

    # Find live HTTP servers from Amass output
amass enum -d target.com | sort -u | httprobe > live_servers.txt

# Check for HTTPS
amass enum -d target.com | sort -u | httprobe -c 50 -t 3000

    With Aquatone

    # Screenshot discovered web servers
amass enum -d target.com | sort -u | aquatone -out screenshots/

    Real-World Use Cases

    Merger and Acquisition Due Diligence

    # Map all external assets of target company
amass intel -org "Target Company Name"
amass enum -d target-company.com -active

    Bug Bounty Reconnaissance

    # Comprehensive subdomain discovery
amass enum -active -d target.com -brute -o subs.txt

# Visualize attack surface
amass viz -d target.com -d3 -o bounty_report/

# Find related domains and IPs
amass intel -whois -d target.com

    Common Mistakes

    Not configuring API keys: Default Amass has limited data sources. Configure keys for maximum coverage.

    Using passive mode only: Active brute forcing discovers subdomains that passive sources miss.

    Not verifying results: Resolve found subdomains to confirm they are valid.

    Running too aggressively: Respect DNS rate limits to avoid IP blocks.

    Best Practices

  • **Configure all available API keys** — More sources = better results
  • **Combine passive and active modes** — Each catches what the other misses
  • **Use custom wordlists** — Larger, targeted wordlists find more subdomains
  • **Verify and resolve** — Confirm discovered subdomains are valid
  • **Visualize results** — Graphs reveal relationships between assets
  • **Integrate with other tools** — Pipe results to httprobe, Nmap, Aquatone

    • Related Tools

  • **Sublist3r** — Lightweight passive subdomain discovery
  • **dnsrecon** — DNS enumeration and zone transfer
  • **httprobe** — Check which subdomains are alive
  • **Aquatone** — Screenshot web applications
  • **Subjack** — Subdomain takeover detection

    • Related Articles

  • Subdomain Enumeration
  • DNS Enumeration
  • OSINT Introduction
  • Reconnaissance Workflow

    • Summary

    Amass is a powerful attack surface mapping tool that combines 50+ passive data sources with active enumeration techniques. Proper configuration of API keys, combining passive and active modes, and integrating with other tools maximizes its effectiveness for reconnaissance.

    Knowledge Check

  • What types of data sources does Amass use?
  • Why is configuring API keys important for Amass?
  • What is the difference between passive and active enumeration in Amass?
  • How does Amass generate visualizations of discovered assets?
  • What tools can Amass be piped into for further analysis?

    • Frequently Asked Questions

    What is Amass and who develops it?

    Amass is an open-source attack surface mapping tool developed by the OWASP community. It performs DNS enumeration, subdomain discovery, and network mapping using over 50 passive data sources combined with active enumeration techniques.

    Why are API keys important for Amass?

    API keys unlock additional data sources like SecurityTrails, VirusTotal, Shodan, and Censys. Without keys, Amass uses only free sources with limited results. Configuring all available keys maximizes subdomain discovery coverage.

    What is the difference between passive and active enumeration in Amass?

    Passive enumeration queries external sources (certificate logs, search engines, APIs) without touching the target. Active enumeration includes DNS brute forcing and direct queries. Combining both yields the most comprehensive results.

    How do you visualize Amass results?

    Use `amass viz -d target.com -dot -o output.dot` to generate Graphviz graphs, `-d3` for interactive D3.js visualizations, or `-d2` for D2 diagrams. Visualizations reveal relationships between subdomains and infrastructure.

    How does Amass integrate with other tools?

    Pipe Amass results to httprobe for live host detection, to Nmap for service scanning, to Aquatone for screenshots, and to Nuclei for vulnerability scanning. Use `amass enum -d target.com | httprobe > live.txt` for simple pipelines.

    What wordlists does Amass use for brute forcing?

    Amass includes built-in wordlists at /usr/share/amass/wordlists/ and uses external wordlists. The jhaddix_all.txt wordlist is comprehensive. You can also provide custom wordlists with the -brute -w flag.

    Can Amass enumerate multiple domains at once?

    Yes, use the -d flag multiple times: `amass enum -d target.com -d target.org -d target.net`. This is useful for mapping related organizations or subsidiaries in a single pass.

    How do you configure Amass data sources?

    Edit ~/.config/amass/config.ini to add API keys for SecurityTrails, VirusTotal, Shodan, Censys, and other sources. The more sources configured, the more comprehensive the enumeration results.

    What is Amass intel mode used for?

    Amass intel gathers organizational information through reverse WHOIS lookups and ASN queries. Use `amass intel -org 'Target Company'` to find all domains associated with an organization, expanding the scope of your assessment.

    How does Amass compare to other subdomain tools?

    Amass is the most comprehensive tool with 50+ data sources, but it's slower than lightweight alternatives like Sublist3r. Use Amass for thorough enumeration and Sublist3r or gobuster for quick discovery. See [Subdomain Enumeration](/learn/subdomain-enumeration) for a comparison.