Amass Subdomain MapperStep-by-step reference: use OWASP Amass for in-depth attack surface mapping and subdomain enumeration. Educational purposes only.FAQ

What is OWASP Amass?

OWASP Amass is an open-source network mapping and attack surface discovery tool. It performs in-depth subdomain enumeration, DNS resolution, scraping, and graph-database modeling of network perimeters.

Is using Amass legal?

Yes, Amass itself is a legitimate open-source security tool. However, running active enumeration or assessing targets without explicit authorization is prohibited. Always ensure you own the domain or have written authorization.

How does Amass differ from other subdomain finders?

Amass combines extensive passive data source aggregation with active DNS resolution, scraping, ASN mapping, and an embedded graph database engine to maintain a comprehensive topology of external assets.

What is the difference between active and passive mode?

Passive enumeration collects data purely from third-party sources (like Certificate Transparency logs, DNS databases, search engines) without contacting the target. Active mode performs DNS resolution, brute-forcing, and zone transfers directly.

How do I run basic subdomain enumeration in Amass?

Run `amass enum -d example.com`. You can scan multiple domains with `amass enum -df targets.txt` or inspect results stored in the graph database with `amass db -d example.com -enum`.

What is the Amass graph database?

Amass automatically stores discovery findings (domains, IP addresses, netblocks, ASNs) in a graph database. The `amass db` command lets you query, summarize, and track changes across assessments.

How can site owners protect against subdomain enumeration?

Maintain a strict inventory of all DNS records, remove dangling DNS pointers (to prevent subdomain takeovers), protect internal/staging domains behind VPNs or zero-trust access, and perform regular attack surface audits.

All tools · Sitemap · Games