Attributed metadata history
Up to 100 retained publisher events per page for f8c7490b5493770be8c7e5127a5a3db710eed7733c692288fef26c2393ca8fb7. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_6dc544294b7f21f98a
observed · 2026-10-14 11:03:02 UTC
OWASP Amass is the most comprehensive tool for attack surface mapping and asset discovery. It goes beyond simple subdomain enumeration by mapping relationships between domains, IP addresses, netblocks, and autonomous systems. Amass integrates with over 50 passive data sources and supports active reconnaissance techniques including DNS brute forcing, zone transfer attempts, and certificate grabbing. This guide covers twenty practical Amass commands, explaining what each does and when to use it during a security assessment. 1. Passive Subdomain Enumeration amass enum -passive -d example.com The -passive flag restricts Amass to querying its numerous data sources without sending any DNS queries to the target. This is the safest starting point for reconnaissance, gathering subdomains from certificate transparency logs, search engines, and public DNS datasets while leaving no trace on the target's infrastructure . 2. Basic Domain Enumeration amass enum -d example.com Running enum without the -passive flag performs standard enumeration, which may include some active DNS resolution to validate discovered names. This balances coverage with reasona
Fingerprint: 93ddd1431a3be1f4d14e14fe2d331d6a6a29752873887831f39ea9b793d30e49
intelligence_src_6dc544294b7f21f98a
observed · 2026-10-12 11:01:03 UTC
available
Fingerprint: 2faf9469031bd0e00603457ab86d15e2040aea06ef98482184945872c5cb389f