01 · Product name
Amass
OWASP tool for mapping a domain’s attack surface.
Published by OWASP.
In short
Amass is the OWASP project for in-depth attack surface mapping. It enumerates subdomains and related infrastructure from passive sources and, if you turn it on, from active DNS queries and brute force. The CLI is free and open source. Active modes touch the target, so they belong on domains you are authorized to assess.
Product pricing strategy
02
Free
Amass is free. You do not buy a seat to use what the project publishes.
Yes. OWASP Amass is free and open source. Some of its data sources bill separately for their own API keys.
Utility and features
03
Amass is what you run when “a few subdomains” is not the question and “the edge of this organization” is. It pulls from certificate transparency, APIs, web archives, and DNS, then keeps the relationships: which name resolved, which address it shared, which ASN showed up.
- Passive and active. Passive mode uses third-party data. Active mode resolves and can brute force names. Treat those as different jobs with different permissions.
- Data sources. Many sources work without keys. Others return more if you add free or paid API keys. The enum output depends on which keys you configured.
- Output. Names, addresses, and a graph of how they relate. You can write results for a report or hand the names to a scope document.
Passive collection is the default posture for OSINT. Active brute force and DNS resolution against a third party’s zone is a scan. Amass makes both possible, which is useful and easy to misuse. Subfinder is the faster passive companion when you only want names. theHarvester overlaps on emails and hosts but does not try to be a full surface map. SpiderFoot can call similar data through modules if you would rather work in a UI.
- 1
Install the OWASP Amass release, not an old fork with the same name.
- 2
Run a passive enumeration against a domain you are allowed to map.
- 3
Read the name list before any active step. Remove out-of-scope brands that share a string.
- 4
Add API keys only for sources you are allowed to query, then re-run and keep both outputs.
Caveats
04
Amass is a free OWASP reconnaissance tool. Passive collection still touches third-party APIs, and some of those need keys. Active modes are a different decision: they generate traffic against names you resolved. Do not turn a passive brief into an active sweep because the flag exists.
Output is names, not proof a service is vulnerable or even still delegated. Scope is the authorization, not the size of the list. Compare with Subfinder or theHarvester when a single source dominates the result.
Screenshots
05
Potential use cases
06
- You have written authorization for an external look at one domain. Run Amass in a passive mode and keep the enum config you used. The output is hostnames from public sources, not a port scan. Diff it with Subfinder when one list looks noisy. A name is not in scope until the authorization says it is. Do not feed the list straight into an exploit tool.
- An acquisition still has old DNS. Run Amass against the domains the contract names and look for names that share infrastructure with the primary domain. You get a candidate list with sources attached if you asked for them. Pivot a surprising host to Shodan or Censys to see the banner, still without scanning it yourself. Stale certificate names and parked hosts will be in the list. Read them before you call them live assets.
- You want a second collector because the first one missed a name you can see in certificate logs. Re-run with the data sources you actually configured, and record which API keys were set. The delta is the point. Amass does not invent hosts. It repeats what those sources published. Rate limits and key quotas are the providers’, and this listing does not quote them.
Hard cases
The case where the first result is easy to over-read.
The list includes a name nobody authorized
Passive collection follows a certificate or a search hit onto a hostname in a different organization that happens to share a string. That name is not yours to scan, resolve aggressively, or hand to a client as ‘their asset.’ Cut the list back to the domains in the authorization, note the out-of-scope name as a collision, and pivot only inside the boundary you were given.
Questions
Is Amass free?
Yes. OWASP Amass is free and open source. Some of its data sources bill separately for their own API keys.
Is running Amass passive OSINT?
Only the passive mode. Active enumeration and brute force send traffic toward the target. Get authorization before you use them.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
OWASP Amass
https://owasp.org/www-project-amass/Documentation
Amass README
https://github.com/owasp-amass/amass/blob/master/README.md