security enabled verified medium v1.0.0

amass

In-depth DNS enumeration, subdomain discovery, and attack surface mapping tool from the OWASP project.

📋 Live Preview

amass enum -d {domain} -o {output}

🌍 domain → example.com 🌍 output → amass-results.txt

amass enum -d {domain} -o {output}

Sandbox: execFile · Timeout: 3600s

Capabilities

network.discovery.dns

network.discovery.subdomain

security.fingerprint.certificate

security.recon.attack-surface

network.discovery.host

Parameters

Name	Type	Required	Default	Description	Aliases
`domain`	string	No	-	Target domain name	`-d`, `--domain`
`flag-dL`	file	No	-	File containing list of domains	`-dL`, `--list`
`config`	file	No	-	Configuration file	`-config`
`flag-o`	string	No	-	Output file for discovered subdomains	`-o`, `--output`
`flag-json`	boolean	No	-	JSON output format	`-json`
`flag-dir`	string	No	-	Output directory for multiple domains	`-dir`
`flag-nf`	boolean	No	-	Do not include the domain root in output	`-nf`, `--no-root-domain`
`flag-r`	string	No	-	IP address of trusted DNS resolver	`-r`, `--resolver`
`flag-rf`	file	No	-	File containing list of DNS resolvers	`-rf`, `--resolver-file`
`active`	boolean	No	-	Perform active enumeration (DNS queries, zone transfer)	`-active`
`flag-bl`	boolean	No	-	Blacklist ASN from the enumeration	`-bl`, `--blacklist`
`flag-blf`	file	No	-	File containing blacklist data	`-blf`, `--blacklist-file`
`brute`	boolean	No	-	Enable brute forcing of subdomains	`-brute`
`flag-w`	file	No	-	Wordlist file for brute forcing	`-w`, `--wordlist`
`flag-aw`	file	No	-	Additional wordlist for alterations	`-aw`, `--alt-wordlist`
`flag-src`	boolean	No	-	Print source for each discovered subdomain	`-src`
`flag-ip`	boolean	No	-	Show IP addresses for discovered names	`-ip`
`flag-org`	boolean	No	-	Show organization information	`-org`
`flag-asn`	boolean	No	-	Show ASN data	`-asn`
`flag-time`	integer	No	-	Maximum execution time in minutes	`-time`
`flag-max-dns-queries`	integer	No	-	Maximum DNS queries per minute	`-max-dns-queries`
`h`	boolean	No	-	Show the program usage message	`-h`
`help`	boolean	No	-	Show the program usage message	`-help`

Artifacts

Type	Description	MIME	Schema	Trust
`security.recon.subdomain.list`	List of discovered subdomains	text/plain	-	verified
`security.recon.graph`	Graph visualization of domain relationships	text/html	-	community

Contract

Inputs

network.target.domain

Target domain name

Outputs

security.recon.subdomain.list

Discovered subdomains

security.recon.graph

Visual relationship graph

Side effects: network_trafficnetwork_traffic

Workflow Edges

Produces

security.recon.subdomain.listsecurity.recon.graph

Consumes

network.target.domain

Resource Profile

Resource	Value
CPU	medium
Memory	256 MB
Network	medium
Disk I/O	low

Examples

Basic subdomain enumeration

amass enum -d example.com

Enumeration with active techniques

amass enum -d example.com -active

Brute force subdomains with custom wordlist

amass enum -d example.com -brute -w /usr/share/wordlists/subdomains.txt

Save results to file

amass enum -d example.com -o results.txt

JSON output for programmatic processing

amass enum -d example.com -json results.json

Use a specific DNS resolver

amass enum -d example.com -r 8.8.8.8

Enumerate across multiple domains from a file

amass enum -dL domains.txt

Visualize results as a graph

amass viz -d example.com -o graph.html

Track new subdomains over time

amass track -d example.com

Documentation

Amass — Attack Surface Mapping & Asset Discovery

Amass is the OWASP project's premier tool for in-depth DNS enumeration, subdomain discovery, and external attack surface mapping. It uses a wide range of techniques including DNS zone transfers, certificate transparency logs, search engine scraping, and brute forcing.

Enumeration Modes

Mode	Command	Description
Subdomain enumeration	`amass enum -d example.com`	Passive and active subdomain discovery
Visualize	`amass viz -d example.com`	Generate HTML graph of relationships
Track	`amass track -d example.com`	Identify new assets over time
Database	`amass db -d example.com`	Interact with the local Amass database

Data Sources

Amass queries dozens of sources including:

Certificate Transparency logs (crt.sh, CertSpotter, Google)
Search engines (Bing, Google, Yahoo, Shodan)
DNS datasets (DNSDumpster, Riddler, PTR archives)
Threat intelligence (AlienVault OTX, VirusTotal)
ASN/Whois data (RADIUS, TeamCymru, BGPTools)

Output

# List subdomains
amass enum -d example.com

# With IP addresses and sources
amass enum -d example.com -ip -src

# Full JSON output for pipeline processing
amass enum -d example.com -json results.json

Related Tools

subfinderassetfinderdnsenumfierce