The OWASP Amass tool suite obtains subdomain names by scraping data sources, recursive brute forcing, crawling web archives, permuting/altering names and reverse DNS sweeping. Additionally, Amass uses the IP addresses obtained during resolution to discover associated netblocks and ASNs. All the information is then used to build maps of the target networks.

Information Gathering Techniques Used:

• DNS: Basic enumeration, Brute forcing (upon request), Reverse DNS sweeping, Subdomain name alterations/permutations, Zone transfers (upon request)
• Scraping: Ask, Baidu, Bing, CommonCrawl, DNSDumpster, DNSTable, Dogpile, Exalead, FindSubdomains, Google, IPv4Info, Netcraft, PTRArchive, Riddler, SiteDossier, Yahoo
• Certificates: Active pulls (upon request), Censys, CertDB, CertSpotter, Crtsh, Entrust
• APIs: AlienVault, BinaryEdge, BufferOver, CIRCL, DNSDB, HackerTarget, PassiveTotal, Robtex, SecurityTrails, Shodan, ThreatCrowd, Twitter, Umbrella, URLScan, VirusTotal
• Web Archives: ArchiveIt, ArchiveToday, Arquivo, LoCArchive, OpenUKArchive, UKGovArchive, Wayback

A precompiled version is available for each release.

If your operating environment supports Snap, you can click here to install, or perform the following from the command-line:

sudo snap install amass

On Kali, follow these steps to install Snap and Amass + use AppArmor (for autoload):

sudo apt install snapd
sudo systemctl start snapd
sudo systemctl enable snapd
sudo systemctl start apparmor
sudo systemctl enable apparmor

Add the Snap bin directory to your PATH:

export PATH=$PATH:/snap/bin

Periodically, execute the following command to update all your snap packages:

sudo snap refresh

For Homebrew on Mac, the following two commands will install Amass into your macOS environment:

brew tap caffix/amass
brew install amass

1. Build the Docker image:

sudo docker build -t amass https://github.com/OWASP/Amass.git

2. Run the Docker image:

sudo docker run amass --passive -d example.com

The wordlists maintained in the Amass git repository are available in /wordlists/ within the docker container. For example, to use all.txt:

sudo docker run amass -w /wordlists/all.txt -d example.com

If you prefer to build your own binary from the latest release of the source code, make sure you have a correctly configured Go >= 1.10 environment. More information about how to achieve this can be found on the golang website. Then, take the following steps:

1. Download OWASP Amass:

go get -u github.com/OWASP/Amass/...

2. If you wish to rebuild the binaries from the source code:

cd $GOPATH/src/github.com/OWASP/Amass

go install ./...

At this point, the binaries should be in $GOPATH/bin.

3. Several wordlists can be found in the following directory:

ls $GOPATH/src/github.com/OWASP/Amass/wordlists/

Go to the User's Guide for additional information.

Join our Discord server:

• OWASP: Caffix
• GitHub: @caffix

This project improves thanks to all the people who contribute:

• Top 7 Subdomain Scanner Tools: Find Subdomains in Seconds
• Cyber Talent Gap: How to Do More With Less
• My Recon Process — DNS Enumeration
• Week in OSINT #2019–16: From OSINT for pentesting, to OCR and OWASP
• Stop Using Python for Subdomain Enumeration
• My Personal OSINT Techniques, Part 1 of 2: Key & Layer, Contingency Seeding
• Subdomain Enumeration Tools – 2019 Update
• Leaked Salesforce API access token at IDEA.com
• Week in OSINT #2019–11: This time a collection of mostly tools and sites
• Bug Hunting Methodology (part-1)
• 100 ways to discover (part 1)
• Pose a Threat: How Perceptual Analysis Helps Bug Hunters
• A penetration tester’s guide to subdomain enumeration
• Abusing access control on a large online e-commerce site to register as supplier
• Black Hat Training, Making the Cloud Rain Shells!: Discovery and Recon
• Subdomains Enumeration Cheat Sheet
• Search subdomains and build graphs of network structure with Amass
• Getting started in Bug Bounty
• Source code disclosure via exposed .git folder
• Amass, the best application to search for subdomains
• Subdomain Takeover: Finding Candidates
• Paul's Security Weekly #564: Technical Segment - Bug Bounty Hunting
• The Bug Hunters Methodology v3(ish)
• Doing Recon the Correct Way
• Discovering subdomains
• Asset Discovery: Doing Reconnaissance the Hard Way
• Project Sonar: An Underrated Source of Internet-wide Data
• Top Five Ways the Red Team breached the External Perimeter