OWASP Amass
Category: Subdomain Enumeration & DNS
Language: Go
Type: Active & Passive
📘 Definition & Purpose
OWASP Amass is an in-depth asset mapping and domain tracking engine. It excels at active and passive subdomain collection, ASN correlation, and DNS resolution.
🧪 Core Mechanics
Amass uses advanced DNS harvesting, scraping, and APIs. It combines techniques like:
- Active Subdomain Bruteforcing: Querying combinations of words from wordlists.
- DNS Alteration & Permutation: Generating subdomains based on existing names (e.g.
dev.target.com->dev-test.target.com). - Reverse DNS Sweeping: Scanning IP ranges and resolving them back to hostnames.
🚀 Usage & Cheat Sheet
# Passive subdomain enumeration
amass enum -passive -d target.com -o passive_subs.txt
# Active subdomain discovery including bruteforcing and IP sweeps
amass enum -active -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -o active_subs.txt
# ASN discovery to identify target's IP spaces
amass intel -org "Target Corp"
# IP range mapping to locate targets associated with ASN
amass intel -asn 12345 -o asn_ips.txt
🔗 Integration
This tool is utilized across the: