amass

name	amass
description	Use this skill when the user wants to map attack surfaces, discover subdomains, or perform OSINT reconnaissance on a target domain — enumerate DNS records, find related assets, and build an external asset inventory.

amass Plugin

OWASP Amass performs in-depth attack surface mapping and external asset discovery using OSINT and active recon techniques. Ideal for security assessments, bug bounty recon, and infrastructure inventory.

Installation

go install github.com/owasp-amass/amass/v5@master
# or
brew install amass

Basic Usage

# Passive subdomain enumeration (no direct contact with target)
amass enum -passive -d example.com

# Active enumeration with DNS brute-force
amass enum -active -d example.com

# Save results to a file
amass enum -d example.com -o results.txt

# Intel mode — gather info about an organization
amass intel -org "Example Corp"

Common Patterns

# Enumerate multiple domains
amass enum -d example.com -d example.org

# Use custom resolvers for faster DNS lookups
amass enum -d example.com -r 8.8.8.8,1.1.1.1

# Visualize the attack surface (requires graph output)
amass enum -d example.com -oA amass_output/

Usage Examples

• "Find all subdomains of example.com"
• "Run passive OSINT recon on this domain"
• "Discover external assets for this organization"

SuperCLI

sc amass _ _ enum -passive -d example.com
sc plugins learn amass