Attributed metadata history

OWASP Amass: 20 Commands for Attack Surface Mapping and Subdomain Enumeration

OWASP Amass is the most comprehensive tool for attack surface mapping and asset discovery. It goes beyond simple subdomain enumeration by mapping relationships between domains, IP addresses, netblocks, and autonomous systems. Amass integrates with over 50 passive data sources and supports active reconnaissance techniques including DNS brute forcing, zone transfer attempts, and certificate grabbing. This guide covers twenty practical Amass commands, explaining what each does and when to use it during a security assessment. 1. Passive Subdomain Enumeration amass enum -passive -d example.com The -passive flag restricts Amass to querying its numerous data sources without sending any DNS queries to the target. This is the safest starting point for reconnaissance, gathering subdomains from certificate transparency logs, search engines, and public DNS datasets while leaving no trace on the target's infrastructure . 2. Basic Domain Enumeration amass enum -d example.com Running enum without the -passive flag performs standard enumeration, which may include some active DNS resolution to validate discovered names. This balances coverage with reasonable speed, making it a common default for initial reconnaissance . 3. Active Enumeration with DNS Queries amass enum -active -d example.com The -active flag enables active recon methods including direct DNS queries, zone transfer attempts, and certificate grabbing. This reaches beyond passive feeds to discover subdomains that public sources have not indexed, at the cost of generating traffic to the target . 4. Brute Force Subdomain Discovery amass enum -brute -d example.com The -brute flag performs DNS brute forcing using Amass's built-in wordlist. This systematically tests candidate subdomain names by querying DNS. Combined with active enumeration, brute forcing often reveals internal naming conventions and development environments not present in public sources . 5. Brute Force with Custom Wordlist amass enum -brute -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -d example.com The -w flag specifies a custom wordlist for brute forcing. Security-focused wordlists like those from SecLists contain common subdomain prefixes tailored to different industries and naming patterns, significantly improving discovery rates over generic lists . 6. Save Results to Text File amass enum -d example.com -o subdomains.txt The -o flag writes output to a plain text file. Always save enumeration results during assessments to maintain an audit trail and to feed subsequent tools without repeating queries . 7. Save Results in All Formats amass enum -d example.com -oA results/amass The -oA flag writes results in all available formats including JSON, plain text, and graph database entries. This is useful when different downstream tools need different output formats, eliminating the need for multiple runs . 8. Show IP Addresses for Discovered Names amass enum -d example.com -ip The -ip flag includes resolved IP addresses alongside each discovered subdomain. This immediately identifies which subdomains are active and reveals shared hosting, cloud provider IP ranges, and potential infrastructure relationships . 9. Show Data Sources for Each Result amass enum -d example.com -src The -src flag annotates each discovered subdomain with the data source that reported it. A subdomain found by multiple independent sources is more likely to be genuine and active. This helps assess reliability when triaging large result sets . 10. Enumerate Multiple Domains from File amass enum -df domains.txt -o all_subdomains.txt The -df flag reads a list of root domains from a file, one per line. This scales enumeration across large scopes such as bug bounty programs with dozens of in-scope domains or organizations

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.