AeonDave Amass
OWASP attack surface mapper — thorough subdomain enumeration via 50+ passive + active sources.
Quick Start
# Passive enumeration (no direct target interaction)
amass enum -passive -d target.com
# Active enumeration (DNS brute force + zone transfer attempts)
amass enum -active -d target.com -brute
# Save results
amass enum -d target.com -o subdomains.txt
# Full enumeration with output files
amass enum -d target.com -brute -o subs.txt -oA results/amass
Subcommands
| Subcommand | Purpose |
|---|---|
enum |
Subdomain enumeration (main use) |
intel |
Gather intel on an org (ASN, CIDRs, root domains) |
viz |
Visualize attack surface (Maltego, Gephi, GraphViz) |
track |
Track changes in attack surface over time |
db |
Interact with local Amass database |
Core Flags (enum)
| Flag | Purpose |
|---|---|
-d <domain> |
Target domain (repeat for multiple) |
-passive |
Passive only (no direct DNS queries to target) |
-active |
Active (DNS queries, zone transfer, cert grabbing) |
-brute |
DNS brute-force with wordlist |
-w <wordlist> |
Custom brute-force wordlist |
-r <resolvers> |
Custom DNS resolvers file |
-o <file> |
Plain text output |
-oA <prefix> |
All output formats (json, txt, etc.) |
-json <file> |
JSON output |
-ip |
Include IP addresses in output |
-src |
Show data source for each result |
-timeout <n> |
Minutes before timeout (default: 30) |
-max-depth <n> |
Max DNS brute-force recursion depth |
-config <file> |
Config file path |
-dir <path> |
Output directory for all files |
-dL <file> |
File with list of domains |
Common Workflows
Passive recon (silent, no DNS to target):
amass enum -passive -d target.com -src -o passive_subs.txt
Active + brute force:
amass enum -active -d target.com -brute -o active_subs.txt
Multiple domains from file:
amass enum -passive -dL domains.txt -o all_subs.txt
D3.js visualization of attack surface:
amass viz -d3 -dir amass_out/ -d target.com
# Opens interactive graph in browser at amass_out/vis/d3.html
With IP resolution:
amass enum -d target.com -ip -o subs_with_ips.txt
Organization intelligence (find all CIDRs + domains):
# Find ASN for organization
amass intel -org "Target Corp"
# Enumerate from ASN
amass intel -asn 12345 -ip
# Enumerate from CIDR
amass intel -cidr 203.0.113.0/24
Config File (API Keys)
# ~/.config/amass/config.ini or /etc/amass/config.ini
[data_sources]
[data_sources.CertSpotter]
[data_sources.CertSpotter.Credentials]
apikey = YOUR_KEY
[data_sources.Shodan]
[data_sources.Shodan.Credentials]
apikey = YOUR_KEY
[data_sources.SecurityTrails]
[data_sources.SecurityTrails.Credentials]
apikey = YOUR_KEY
[data_sources.VirusTotal]
[data_sources.VirusTotal.Credentials]
apikey = YOUR_KEY
[data_sources.Hunter]
[data_sources.Hunter.Credentials]
apikey = YOUR_KEY
Post-Processing
# Sort and deduplicate
sort -u subdomains.txt > unique_subs.txt
# Resolve live hosts (dnsx)
cat unique_subs.txt | dnsx -silent -a -resp > live_hosts.txt
# HTTP probe (httpx)
cat unique_subs.txt | httpx -silent -status-code -title -tech-detect > web_services.txt
# Feed into nmap
nmap -iL unique_subs.txt -sV -p 80,443,8080,8443 --open -T4
Resources
| File | When to load |
|---|---|
references/config.md |
Full config file options, API source list, wordlist recommendations, pipeline with httpx/dnsx |