The OWASP Amass tool suite obtains subdomain names by scraping data sources, recursive brute forcing, crawling web archives, permuting/altering names and reverse DNS sweeping. Additionally, Amass uses the IP addresses obtained during resolution to discover associated netblocks and ASNs. All the information is then used to build maps of the target networks.
Information Gathering Techniques Used:
- DNS: Basic enumeration, Brute forcing (upon request), Reverse DNS sweeping, Subdomain name alterations/permutations, Zone transfers (upon request)
- Scraping: Ask, Baidu, Bing, CommonCrawl, DNSDB, DNSDumpster, DNSTable, Dogpile, Exalead, FindSubdomains, Google, IPv4Info, Netcraft, PTRArchive, Riddler, SiteDossier, ThreatCrowd, VirusTotal, Yahoo
- Certificates: Active pulls (upon request), Censys, CertDB, CertSpotter, Crtsh, Entrust
- APIs: BinaryEdge, BufferOver, CIRCL, HackerTarget, PassiveTotal, Robtex, SecurityTrails, Shodan, Twitter, Umbrella, URLScan
- Web Archives: ArchiveIt, ArchiveToday, Arquivo, LoCArchive, OpenUKArchive, UKGovArchive, Wayback
How to Install
A precompiled version is available for each release.
If your operating environment supports Snap, you can click here to install, or perform the following from the command-line:
sudo snap install amass
sudo apt install snapd
sudo systemctl start snapd
sudo systemctl enable snapd
sudo systemctl start apparmor
sudo systemctl enable apparmor
sudo snap refresh
brew tap caffix/amass
brew install amass
- Build the Docker image:
sudo docker build -t amass https://github.com/OWASP/Amass.git
- Run the Docker image:
sudo docker run amass --passive -d example.com
/wordlists/within the docker container. For example, to use
sudo docker run amass -w /wordlists/all.txt -d example.com
If you prefer to build your own binary from the latest release of the source code, make sure you have a correctly configured Go >= 1.10 environment. More information about how to achieve this can be found on the golang website. Then, take the following steps:
- Download OWASP Amass:
go get -u github.com/OWASP/Amass/...
- If you wish to rebuild the binaries from the source code:
go install ./...
- Several wordlists can be found in the following directory:
Go to the User's Guide for additional information.