Amass

Passive mode (amass enum -passive) queries public data sources like certificate transparency logs, DNS databases, and search engines without sending any traffic to the target. Active mode (amass enum -active) directly probes DNS servers, web servers, and performs DNS brute-forcing, generating detectable network traffic. Use passive for stealthy recon; use active for comprehensive discovery when detection is acceptable.

Amass is a comprehensive OWASP project that supports both passive and active enumeration, DNS brute-forcing, ASN discovery, and network mapping. Subfinder is passive-only and extremely fast, ideal for a quick first pass. Use Subfinder for speed and stealth; use Amass when you need deeper, active attack-surface mapping. Many professionals run both and merge the results.

Amass runs without API keys but returns limited results from free sources. Adding API keys for services like Shodan, Censys, SecurityTrails, VirusTotal, and GitHub dramatically increases coverage. Keys are configured in the Amass configuration file (~/.config/amass/config.yaml). Free tiers are available for most services.

On Kali Linux: sudo apt update && sudo apt install amass. For the latest version, install from GitHub: go install -v github.com/owasp-amass/amass/v4/...@master. Verify the installation with amass -version. Amass requires Go 1.18+ for building from source.

amass intel discovers ASN (Autonomous System Number) data, IP ranges, and infrastructure details associated with a target organization. Use amass intel -org 'Company Name' to find all domains belonging to an organization, or amass intel -d example.com to discover ASN and IP ranges. This is useful for mapping the full network footprint before active scanning.

Yes. Amass active mode performs DNS brute-forcing and directly probes DNS servers, which can discover subdomains not listed in any public database. Subfinder is passive-only and cannot find subdomains that were never publicly logged. Combining passive (Subfinder) and active (Amass) enumeration gives the most complete subdomain list.

Amass is an OWASP project for in-depth network mapping and attack surface discovery. It uses passive OSINT sources and active DNS probing to discover subdomains, IP addresses, ASN data, and infrastructure details for target organizations. Amass is written in Go and available on Kali Linux, macOS, Windows, and Linux.

Amass works in two modes: passive and active. Passive mode queries over 20 public data sources including Certificate Transparency logs, DNS databases, web archives, and API services (Shodan, Censys) without sending traffic to the target. Active mode directly queries DNS servers and web servers for faster, more thorough discovery. It builds a graph database of discovered assets.

Yes, Amass is completely free and open source under the Apache 2.0 license. It is maintained by the OWASP Foundation. Some data sources require free API keys from services like Shodan and Censys, but Amass itself costs nothing.

OWASP Amass is a project under the Open Web Application Security Project (OWASP) Foundation. It is the industry-standard tool for attack surface discovery, used by penetration testers, bug bounty hunters, and security teams to map external infrastructure.

Amass is used for subdomain enumeration, attack surface mapping, DNS intelligence gathering, certificate transparency analysis, ASN discovery, organization-based reconnaissance, and network visualization. It is essential for penetration testing, bug bounty programs, and enterprise security assessments.

On Kali Linux: sudo apt install amass. On other Linux: go install github.com/owasp-amass/amass/v4/...@master. On macOS: brew install amass. You can also use Docker: docker pull ghcr.io/owasp-amass/amass. Verify with amass -version.

Yes, beginners can learn Amass. Start with passive enumeration (amass enum -passive -d target.com) which is safe and simple. Gradually learn API key configuration, active enumeration, and visualization. The tool has a learning curve but the basics are accessible.

Amass is written in Go (Golang). This gives it excellent performance, cross-platform compatibility, and easy installation via go install. The Go language also enables Amass to handle concurrent DNS queries efficiently.

Amass supports both passive and active modes. Passive mode (amass enum -passive) gathers data from OSINT sources without touching the target. Active mode (amass enum -active) directly queries DNS servers and web servers. Use passive for safe reconnaissance and active only with authorization.

Yes, Amass is one of the best tools for bug bounty reconnaissance. Its passive mode is safe for authorized testing, and it discovers subdomains that other tools miss. Use it as the first step in your recon workflow to maximize attack surface coverage.

Amass provides comprehensive attack surface discovery with both passive and active modes, ASN mapping, organization intelligence, and network visualization. Subfinder is faster for quick passive subdomain discovery but lacks active probing, ASN discovery, and visualization. Use both together for best coverage.

Amass is a full-featured attack surface discovery platform with 20+ data sources, active probing, and visualization. Assetfinder is a lightweight tool focused on quick subdomain and URL discovery. Amass provides deeper results; Assetfinder provides faster results.

Yes, subdomain enumeration is Amass's primary function. It discovers subdomains through passive OSINT sources, active DNS probing, brute-force DNS enumeration, Certificate Transparency logs, and recursive enumeration. It can find hundreds of subdomains for a single domain.

Amass is highly accurate for passive enumeration since it queries verified public data sources. Active enumeration accuracy depends on DNS configuration and network conditions. Use the -src flag to verify which sources discovered each subdomain and cross-reference with other tools.

Yes, Amass discovers cloud assets by identifying subdomains hosted on AWS, Azure, GCP, and other cloud providers. It maps IP ranges to ASN data which reveals hosting providers. Combine with Shodan API for deeper cloud asset discovery.

Passive scans of a single domain typically take 2-10 minutes depending on configured data sources. Active scans take 30 minutes to several hours. Large-scale organizational scans (amass intel -org) can take hours. Use timeout and max-dns-requests flags to control duration.

Create or edit ~/.config/amass/config.ini and add API keys under the [api_key] section. Supported services include Shodan, Censys, SecurityTrails, VirusTotal, GitHub, and many more. More API keys unlock more data sources and improve discovery coverage.

Amass supports flat text (-oF), JSON (-oJ), XML (-oX), and directory output (-oD). JSON format is best for integration with other tools and scripts. Flat text is easiest for manual review. XML integrates with reporting tools.

Yes, Amass output integrates with httpx for live host detection, nuclei for vulnerability scanning, nmap for port scanning, and many other tools. Use -oF to export subdomains for pipeline integration. The JSON output works with most security toolchains.

Amass intel mode (amass intel -org 'Company' or amass intel -d domain) discovers infrastructure associated with an organization, including ASN numbers, IP ranges, and related domains. It is ideal for initial reconnaissance before subdomain enumeration.