# Amass

> Use this skill when the user wants to map attack surfaces, discover subdomains, or perform OSINT reconnaissance on a target domain — enumerate DNS records, find related assets, and build an external asset inventory.

- Skill: `javimosch/amass` (Agent Skill)
- Install (CLI): `npx skillmds@latest add javimosch/amass`
- Raw SKILL.md: https://api.skillmd.com/api/skills/javimosch/amass/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: javimosch (https://skillmd.com/u/javimosch)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/javimosch/amass

---


# amass Plugin

OWASP Amass performs in-depth attack surface mapping and external asset discovery using OSINT and active recon techniques. Ideal for security assessments, bug bounty recon, and infrastructure inventory.

## Installation

```bash
go install github.com/owasp-amass/amass/v5@master
# or
brew install amass
```

## Basic Usage

```bash
# Passive subdomain enumeration (no direct contact with target)
amass enum -passive -d example.com

# Active enumeration with DNS brute-force
amass enum -active -d example.com

# Save results to a file
amass enum -d example.com -o results.txt

# Intel mode — gather info about an organization
amass intel -org "Example Corp"
```

## Common Patterns

```bash
# Enumerate multiple domains
amass enum -d example.com -d example.org

# Use custom resolvers for faster DNS lookups
amass enum -d example.com -r 8.8.8.8,1.1.1.1

# Visualize the attack surface (requires graph output)
amass enum -d example.com -oA amass_output/
```

## Usage Examples

- "Find all subdomains of example.com"
- "Run passive OSINT recon on this domain"
- "Discover external assets for this organization"

## SuperCLI

```bash
sc amass _ _ enum -passive -d example.com
sc plugins learn amass
```