# Amass

> Use for external asset discovery, subdomain mapping, and ownership-focused reconnaissance during authorized pentests. Trigger on internet-facing scope, domain inventory gaps, external attack surface mapping, and domain relationship review.

- Skill: `timsonner/amass` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/amass`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/amass/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/amass

---


# Amass

## Purpose

Use this skill when the methodology calls for external discovery and attack surface mapping tied to known ownership.

## Phase Fit

- Primary: Discovery and Reconnaissance
- Secondary: Threat Modeling and Test Planning
- Narrow retest use: confirm inventory corrections after remediation

## Use When

- Need to enumerate in-scope domains, subdomains, or related public exposure.
- Need to compare public-facing assets against the approved inventory.
- Need to identify ownership ambiguities before deeper testing.

## Avoid When

- Scope is internal-only.
- Ownership boundaries are unclear.
- Active follow-up would touch vendor or third-party infrastructure without approval.

## Inputs

- Approved root domains, brands, IP ranges, or ASN context
- Known exclusions and third-party assets to avoid
- Required confidence threshold for inventory acceptance

## Procedure

1. Start from approved roots and ownership data.
2. Build a candidate external asset set and label confidence for each entry.
3. Remove duplicates and separate confirmed assets from likely third-party services.
4. Hand confirmed web targets to `httpx` and visual triage to `gowitness`.
5. Preserve source context so findings are defensible in reporting.

## Command Syntax

Replace sample targets with approved in-scope assets.

```bash
# Passive subdomain enumeration
amass enum -d contoso.com -passive -o contoso-subs.txt

# Passive enumeration across multiple approved domains
amass enum -df approved-domains.txt -passive -o contoso-all-subs.txt

# Active enumeration with brute-force and DNS resolution
amass enum -d contoso.com -active -brute -o contoso-active.txt

# Enumeration using API keys defined in config file
amass enum -d contoso.com -config /etc/amass/config.ini -passive -o contoso-api.txt

# Intelligence gathering: WHOIS and ownership
amass intel -whois -d contoso.com

# Visualize discovered relationships
amass viz -d3 -d contoso.com -o contoso-graph.html
```

## Evidence to Capture

- Domain-to-asset mapping
- Newly identified exposed subdomains
- Ownership questions that need client confirmation

## Safety Boundaries

- Do not treat discovered assets as in scope until ownership is confirmed.
- Prefer passive collection first; use active follow-up only when approved.