Amass
OWASP attack-surface discovery framework written in Go that discovers external assets through DNS enumeration and OSINT, licensed under Apache-2.0.
Technical Architecture & Overview
OWASP Amass is an attack-surface intelligence framework that maps an organization's external footprint from subdomains, IP ranges, netblocks, and autonomous system numbers. It combines passive OSINT, DNS brute force, web archive and API queries, and reverse-DNS sweeps, and it stores results in an asset database built on the Open Asset Model. The tool is written in Go and is available as pre-built binaries, a Docker image, and via package managers.
Targeted Technical Use Cases
Enumerate and track all externally resolvable names, IP ranges, and network infrastructure associated with an organization over time.
Evaluation & Trade-offs
Core Strengths
- +Supports more than 30 passive data sources for DNS and infrastructure discovery.
- +Pre-built binaries are available for Linux, macOS, Windows, and BSD.
- +Asset database and Docker support enable scalable, repeatable mapping.
Trade-Offs & Limitations
- -Comprehensive results depend on multiple API keys and active DNS resolvers.
- -Large enumerations can generate significant DNS traffic and take time.
- -Focused on network and DNS data; does not collect email or social profiles.
Defensive Security Application
Build an inventory of external attack surface, compare it against authorized assets, and prioritize unauthorized or exposed systems for remediation.
Frequently Asked Questions
What is Amass?→
OWASP Amass is an attack-surface intelligence framework that maps an organization's external footprint from subdomains, IP ranges, netblocks, and autonomous system numbers. It combines passive OSINT, DNS brute force, web archive and API queries, and reverse-DNS sweeps, and it stores results in an asset database built on the Open Asset Model. The tool is written in Go and is available as pre-built binaries, a Docker image, and via package managers.
What is Amass used for?→
Enumerate and track all externally resolvable names, IP ranges, and network infrastructure associated with an organization over time.
What are the strengths of Amass?→
- +Supports more than 30 passive data sources for DNS and infrastructure discovery.
- +Pre-built binaries are available for Linux, macOS, Windows, and BSD.
- +Asset database and Docker support enable scalable, repeatable mapping.
What are the limitations of Amass?→
- +Comprehensive results depend on multiple API keys and active DNS resolvers.
- +Large enumerations can generate significant DNS traffic and take time.
- +Focused on network and DNS data; does not collect email or social profiles.
How is Amass used defensively?→
Build an inventory of external attack surface, compare it against authorized assets, and prioritize unauthorized or exposed systems for remediation.