Amass

Amass

Purpose

Use this skill when the methodology calls for external discovery and attack surface mapping tied to known ownership.

Phase Fit

• Primary: Discovery and Reconnaissance
• Secondary: Threat Modeling and Test Planning
• Narrow retest use: confirm inventory corrections after remediation

Use When

• Need to enumerate in-scope domains, subdomains, or related public exposure.
• Need to compare public-facing assets against the approved inventory.
• Need to identify ownership ambiguities before deeper testing.

Avoid When

• Scope is internal-only.
• Ownership boundaries are unclear.
• Active follow-up would touch vendor or third-party infrastructure without approval.

Inputs

• Approved root domains, brands, IP ranges, or ASN context
• Known exclusions and third-party assets to avoid
• Required confidence threshold for inventory acceptance

Procedure

1. Start from approved roots and ownership data.
2. Build a candidate external asset set and label confidence for each entry.
3. Remove duplicates and separate confirmed assets from likely third-party services.
4. Hand confirmed web targets to httpx and visual triage to gowitness.
5. Preserve source context so findings are defensible in reporting.

Command Syntax

Replace sample targets with approved in-scope assets.

# Passive subdomain enumeration
amass enum -d contoso.com -passive -o contoso-subs.txt

# Passive enumeration across multiple approved domains
amass enum -df approved-domains.txt -passive -o contoso-all-subs.txt

# Active enumeration with brute-force and DNS resolution
amass enum -d contoso.com -active -brute -o contoso-active.txt

# Enumeration using API keys defined in config file
amass enum -d contoso.com -config /etc/amass/config.ini -passive -o contoso-api.txt

# Intelligence gathering: WHOIS and ownership
amass intel -whois -d contoso.com

# Visualize discovered relationships
amass viz -d3 -d contoso.com -o contoso-graph.html

Evidence to Capture

• Domain-to-asset mapping
• Newly identified exposed subdomains
• Ownership questions that need client confirmation

Safety Boundaries

• Do not treat discovered assets as in scope until ownership is confirmed.
• Prefer passive collection first; use active follow-up only when approved.