provocativo_
back to the arsenal
// arsenal·Recon & OSINTIntermediateFOSS

Amass

OWASP project for in-depth attack-surface mapping and subdomain enumeration.

Recon & OSINT

$ amass --help

Amass

// what it is

Description

Go-based subdomain enumerator that combines 80+ passive sources with active brute-forcing, ASN-walking, and certificate-transparency pivots. The bug-bounty community standard for surface mapping.

// use cases

What people use it for

  • Discover subdomains and forgotten assets
  • ASN-walk to find an organization's full IP space
  • Continuous attack-surface monitoring

// commands

The commands you'll type

Passive enumeration

$ amass enum -passive -d target.tld

Active brute + recursive

$ amass enum -active -brute -d target.tld -o subs.txt

// facts

category
Recon & OSINT
platforms
LIN · WIN · MAC
license
FOSS
difficulty
Intermediate

// related in Recon & OSINT