The OWASP Amass Project performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques.
Information Gathering Techniques Used:
|DNS||Brute forcing, Reverse DNS sweeping, NSEC zone walking, Zone transfers, FQDN alterations/permutations, FQDN Similarity-based Guessing|
|Scraping||Ask, Baidu, Bing, BuiltWith, DNSDumpster, DuckDuckGo, HackerOne, IPv4Info, RapidDNS, Riddler, SiteDossier, Yahoo|
|Certificates||Active pulls (optional), Censys, CertSpotter, Crtsh, FacebookCT, GoogleCT|
|APIs||AlienVault, Anubis, BinaryEdge, BGPView, BufferOver, C99, Chaos, CIRCL, Cloudflare, CommonCrawl, DNSDB, GitHub, HackerTarget, Hunter, IPinfo, Mnemonic, NetworksDB, PassiveTotal, RADb, ReconDev, Robtex, SecurityTrails, ShadowServer, Shodan, SonarSearch, Spyse, Sublist3rAPI, TeamCymru, ThreatBook, ThreatCrowd, ThreatMiner, Twitter, Umbrella, URLScan, VirusTotal, WhoisXMLAPI, ZETAlytics, ZoomEye|
|Web Archives||ArchiveIt, ArchiveToday, Wayback|
You can find some additional installation variations in the Installation Guide.
- Simply unzip the package
- Put the precompiled binary into your path
- Start using OWASP Amass!
brew tap caffix/amass brew install amass
sudo snap install amass
- Install Docker
- Pull the Docker image by running
docker pull caffix/amass
docker run -v OUTPUT_DIR_PATH:/.config/amass/ caffix/amass enum -share -d example.com
The volume argument allows the Amass graph database to persist between executions and output files to be accessed on the host system. The first field (left of the colon) of the volume option is the amass output directory that is external to Docker, while the second field is the path, internal to Docker, where amass will write the output files.
- Install Go and setup your Go workspace
- Download OWASP Amass by running
go get -v github.com/OWASP/Amass/v3/...
- At this point, the binary should be in
Use the Installation Guide to get started.
Go to the User’s Guide for additional information.
See the Tutorial for example usage.
See the Amass Scripting Engine Manual for greater control over your enumeration process.