Skip to content

Commit

Permalink
added and updated informational files
Browse files Browse the repository at this point in the history
  • Loading branch information
caffix committed Sep 28, 2017
1 parent 059eb5f commit 8b5646c
Show file tree
Hide file tree
Showing 2 changed files with 113 additions and 1 deletion.
6 changes: 5 additions & 1 deletion LICENSE
@@ -1,3 +1,7 @@
Copyright 2017 Jeff Foley. All rights reserved.
License: Apache2.0


Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
Expand Down Expand Up @@ -186,7 +190,7 @@
same "printed page" as the copyright notice for easier
identification within third-party archives.

Copyright {yyyy} {name of copyright owner}
Copyright 2017 Jeff Foley

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
Expand Down
108 changes: 108 additions & 0 deletions README.md
@@ -0,0 +1,108 @@
# Subdomain and Host Enumeration

### Obtain a large number of names without revealing your location to the target organization

[![](https://img.shields.io/badge/go-1.8-blue.svg)](https://github.com/moovweb/gvm) [![License](https://img.shields.io/hexpm/l/plug.svg)](https://www.apache.org/licenses/LICENSE-2.0)


The amass tool does not only search a few Internet data sources and then perform brute force subdomain enumeration, but also searches a web archive, in order to obtain web pages from the target organization without them being aware of it! Searching these web pages reveals additional subdomains and host names not likely to be provided by a namelist file. All three methods can be employed together by amass, and have shown to be complementary.


## Install

1. Download [amass](https://github.com/caffix/amass):
```
$ go get -u github.com/caffix/amass
```


2. Several wordlists can be found in the following directory:
```
$ ls $GOPATH/src/github.com/caffix/amass/wordlists
```


3. Build the amass binary:
```
$ go build -o $GOPATH/bin/amass $GOPATH/src/github.com/caffix/amass/main.go
```


## Running amass

The most basic use of the tool:
```
$ amass example.com
```


Get amass provide summary information:
```
$ amass -v example.com
```


Have amass print IP addresses with the discovered names:
```
$ amass -ip example.com
```


Allow amass to included additional domains in the search using reverse whois information:
```
$ amass -whois example.com
```


You can have amass list out all the domains discovered with reverse whois before performing the enumeration:
```
$ amass -whois -list example.com
```


Have amass perform brute force subdomain enumeration as well:
```
$ amass -brute wordlist_filepath.txt example.com
```


Add some additional domains to the search:
```
$ amass example.com example1.com example2.com
```

In the above example, the domains example1.com and example2.com are simply appended to the list potentially provided by the reverse whois information.


All these options can be used together:
```
$ amass -v -ip -whois -brute wordlist_filepath.txt example.com example1.com
```

**Be sure that the target domain is the last parameter provided to amass.**


## Settings for the amass Maltego Local Transform

1. Setup a new local transform within Maltego:

![alt text](https://github.com/caffix/amass/blob/master/examples/maltegosetup1.png "Setup")


2. Configure the local transform to properly execute the go program:

![alt text](https://github.com/caffix/amass/blob/master/examples/maltegosetup2.png "Configure")


3. Go into the Transform Manager, and disable the **debug info** option:

![alt text](https://github.com/caffix/amass/blob/master/examples/maltegosetup3.png "Disable Debug")


## Let me know what you think

**NOTE: Still under development.**

**Author: Jeff Foley / @jeff_foley**

**Company: ClaritySec, Inc. / @claritysecinc**

0 comments on commit 8b5646c

Please sign in to comment.