Amass
OWASP attack-surface discovery framework written in Go that discovers external assets through DNS enumeration and OSINT, licensed under Apache-2.0.
Technical Architecture & Overview
OWASP Amass is an attack-surface intelligence framework that performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques. It combines external data sources, brute force subdomain enumeration, and DNS name alterations, and it stores results in an asset database built on the Open Asset Model. The tool is written in Go and is available as pre-built binaries, a Docker image, and a Homebrew package.
Targeted Technical Use Cases
Enumerate and track externally resolvable names, IP ranges, and network infrastructure associated with an organization over time.
Evaluation & Trade-offs
Core Strengths
- +Integrates external data sources for asset discovery, configured with credentials in a datasources.yaml file.
- +Pre-built binaries are available for Linux, macOS, and Windows.
- +Asset database and Docker support enable scalable, repeatable mapping.
Trade-Offs & Limitations
- -Some data sources require a paid subscription or API key to access advanced features.
- -Brute force subdomain enumeration with large wordlists generates significant DNS traffic and can take time.
- -Focused on DNS, network, and infrastructure discovery rather than social media profiling.
Defensive Security Application
Build an inventory of external attack surface, compare it against authorized assets, and prioritize unauthorized or exposed systems for remediation.
Frequently Asked Questions
What is Amass?→
OWASP Amass is an attack-surface intelligence framework that performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques. It combines external data sources, brute force subdomain enumeration, and DNS name alterations, and it stores results in an asset database built on the Open Asset Model. The tool is written in Go and is available as pre-built binaries, a Docker image, and a Homebrew package.
What is Amass used for?→
Enumerate and track externally resolvable names, IP ranges, and network infrastructure associated with an organization over time.
What are the strengths of Amass?→
- +Integrates external data sources for asset discovery, configured with credentials in a datasources.yaml file.
- +Pre-built binaries are available for Linux, macOS, and Windows.
- +Asset database and Docker support enable scalable, repeatable mapping.
What are the limitations of Amass?→
- +Some data sources require a paid subscription or API key to access advanced features.
- +Brute force subdomain enumeration with large wordlists generates significant DNS traffic and can take time.
- +Focused on DNS, network, and infrastructure discovery rather than social media profiling.
How is Amass used defensively?→
Build an inventory of external attack surface, compare it against authorized assets, and prioritize unauthorized or exposed systems for remediation.