OWASP Amass
Amass is now an OWASP project and the OWASP GitHub organization repository is where all further development and releases will take place.
The OWASP Amass tool suite obtains subdomain names by scraping data sources, recursive brute forcing, crawling web archives, permuting/altering names and reverse DNS sweeping. Additionally, Amass uses the IP addresses obtained during resolution to discover associated netblocks and ASNs. All the information is then used to build maps of the target networks.
Information Gathering Techniques Used:
- DNS: Basic enumeration, Brute forcing (upon request), Reverse DNS sweeping, Subdomain name alterations/permutations, Zone transfers (upon request)
- Scraping: Ask, Baidu, Bing, CommonCrawl, DNSDB, DNSDumpster, DNSTable, Dogpile, Exalead, FindSubdomains, Google, IPv4Info, Netcraft, PTRArchive, Riddler, SiteDossier, ThreatCrowd, VirusTotal, Yahoo
- Certificates: Active pulls (upon request), Censys, CertDB, CertSpotter, Crtsh, Entrust
- APIs: BinaryEdge, BufferOver, CIRCL, HackerTarget, PassiveTotal, Robtex, SecurityTrails, Shodan, Twitter, Umbrella, URLScan
- Web Archives: ArchiveIt, ArchiveToday, Arquivo, LoCArchive, OpenUKArchive, UKGovArchive, Wayback
Go to the User's Guide for additional information.
Join our Discord server:
This project improves thanks to all the people who contribute:
- OWASP Amass – DNS Enumeration and Network Mapping
- Pose a Threat: How Perceptual Analysis Helps Bug Hunters
- A penetration tester’s guide to subdomain enumeration
- Abusing access control on a large online e-commerce site to register as supplier
- Black Hat Training, Making the Cloud Rain Shells!: Discovery and Recon
- Subdomains Enumeration Cheat Sheet
- Search subdomains and build graphs of network structure with Amass
- Getting started in Bug Bounty
- Source code disclosure via exposed .git folder
- Amass, the best application to search for subdomains
- Subdomain Takeover: Finding Candidates
- Paul's Security Weekly #564: Technical Segment - Bug Bounty Hunting
- The Bug Hunters Methodology v3(ish)
- Doing Recon the Correct Way
- Discovering subdomains
- Best Hacking Tools List for Hackers & Security Professionals 2018
- Amass - Subdomain Enumeration Tool
- Subdomain enumeration
- Asset Discovery: Doing Reconnaissance the Hard Way
- Project Sonar: An Underrated Source of Internet-wide Data
- Go is for everyone
- Top Five Ways the Red Team breached the External Perimeter