OWASP Amass is the most comprehensive tool for attack surface mapping and asset discovery. It goes beyond simple subdomain enumeration by mapping relationships between domains, IP addresses, netblocks, and autonomous systems. Amass integrates with over 50 passive data sources and supports active reconnaissance techniques including DNS brute forcing, zone transfer attempts, and certificate grabbing. This guide covers twenty practical Amass commands, explaining what each does and when to use it during a security assessment.
1. Passive Subdomain Enumeration
amass enum -passive -d example.com
The -passive flag restricts Amass to querying its numerous data sources without sending any DNS queries to the target. This is the safest starting point for reconnaissance, gathering subdomains from certificate transparency logs, search engines, and public DNS datasets while leaving no trace on the target's infrastructure .
2. Basic Domain Enumeration
amass enum -d example.com
Running enum without the -passive flag performs standard enumeration, which may include some active DNS resolution to validate discovered names. This balances coverage with reasonable speed, making it a common default for initial reconnaissance .
3. Active Enumeration with DNS Queries
amass enum -active -d example.com
The -active flag enables active recon methods including direct DNS queries, zone transfer attempts, and certificate grabbing. This reaches beyond passive feeds to discover subdomains that public sources have not indexed, at the cost of generating traffic to the target .
4. Brute Force Subdomain Discovery
amass enum -brute -d example.com
The -brute flag performs DNS brute forcing using Amass's built-in wordlist. This systematically tests candidate subdomain names by querying DNS. Combined with active enumeration, brute forcing often reveals internal naming conventions and development environments not present in public sources .
5. Brute Force with Custom Wordlist
amass enum -brute -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -d example.com
The -w flag specifies a custom wordlist for brute forcing. Security-focused wordlists like those from SecLists contain common subdomain prefixes tailored to different industries and naming patterns, significantly improving discovery rates over generic lists .
6. Save Results to Text File
amass enum -d example.com -o subdomains.txt
The -o flag writes output to a plain text file. Always save enumeration results during assessments to maintain an audit trail and to feed subsequent tools without repeating queries .
7. Save Results in All Formats
amass enum -d example.com -oA results/amass
The -oA flag writes results in all available formats including JSON, plain text, and graph database entries. This is useful when different downstream tools need different output formats, eliminating the need for multiple runs .
8. Show IP Addresses for Discovered Names
amass enum -d example.com -ip
The -ip flag includes resolved IP addresses alongside each discovered subdomain. This immediately identifies which subdomains are active and reveals shared hosting, cloud provider IP ranges, and potential infrastructure relationships .
9. Show Data Sources for Each Result
amass enum -d example.com -src
The -src flag annotates each discovered subdomain with the data source that reported it. A subdomain found by multiple independent sources is more likely to be genuine and active. This helps assess reliability when triaging large result sets .
10. Enumerate Multiple Domains from File
amass enum -df domains.txt -o all_subdomains.txt
The -df flag reads a list of root domains from a file, one per line. This scales enumeration across large scopes such as bug bounty programs with dozens of in-scope domains or organizations with multiple primary domains .
11. Set Enumeration Timeout
amass enum -d example.com -timeout 30
The -timeout flag specifies the maximum number of minutes to run the enumeration. The default is 30 minutes. For large scopes or thorough scans, increasing this allows more sources to complete. For quick checks, reducing it keeps runs short .
12. Control DNS Query Rate
amass enum -d example.com -dns-qps 100
The -dns-qps flag limits the maximum number of DNS queries per second across all resolvers. This prevents overwhelming target DNS servers and avoids triggering rate limiting or detection systems during active enumeration .
13. Use Custom DNS Resolvers
amass enum -d example.com -r 8.8.8.8,1.1.1.1
The -r flag specifies untrusted DNS resolvers to use for enumeration queries. Using public resolvers like Google (8.8.8.8) or Cloudflare (1.1.1.1) can improve resolution speed and reliability, especially when local resolvers are slow or filtered .
14. Blacklist Specific Subdomains
amass enum -d example.com -bl admin.example.com -bl staging.example.com
The -bl flag excludes specific subdomains from investigation. This is useful when certain subdomains are out of scope, known to cause issues, or belong to third parties that should not be scanned .
15. Exclude Data Sources
amass enum -d example.com -exclude crtsh
The -exclude flag prevents Amass from querying specific data sources. This is useful when a source is rate-limited, unreliable, or when you want to avoid a particular provider for operational or policy reasons .
16. Organization Intelligence Gathering
amass intel -org "Target Corporation"
The intel subcommand gathers intelligence about an organization rather than a specific domain. This discovers ASNs and CIDR ranges associated with the organization, expanding the attack surface beyond known domains to IP space the organization owns .
17. Reverse WHOIS Lookup
amass intel -whois -d example.com
The -whois flag with the intel subcommand performs reverse WHOIS lookups to find other domains registered by the same organization. This reveals additional root domains that may not be obvious from the primary domain alone .
18. Enumerate from ASN
amass intel -asn 12345 -ip
The -asn flag enumerates root domains and IP addresses belonging to a specific Autonomous System Number. Combined with -ip, this maps all IP ranges and associated domains for that ASN, providing a complete picture of the organization's infrastructure .
19. View Enumeration History
amass db -list
The db subcommand interacts with Amass's local graph database. The -list flag shows all previous enumerations stored in the database. This allows you to review past scans without re-running them and to identify which enumeration to visualize or track .
20. Track Changes Over Time
amass track -d example.com -history
The track subcommand compares enumerations that included the same target, showing what has changed between scans. The -history flag displays differences across all enumeration pairs. This is essential for continuous monitoring of an organization's attack surface and identifying newly exposed assets .
Explore More Tools
For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:
https://github.com/yogsec/Hacking-Tools/
Stay connected for more security content and updates:
Top comments (0)