Skip to content
Deepak Gupta markRecon Atlas

Subdomain discovery

OWASP Amass

Maps an organization's external attack surface from open sources, with optional zone transfers, certificate grabs and DNS brute force.

Passive and active modesScope a pentestAudit your own exposure

15k stars · last push November 11, 2026 · v5.1.3 · Apache-2.0

GitHub repositoryOfficial docs

What it finds

Amass maps external assets such as subdomains, IP ranges and ASNs, storing them in an asset database built on the Open Asset Model. It draws on data source plugins (API integrations, web scrapers, WHOIS/RDAP lookups) and can add active techniques. Version 5 splits work between the amass client and a collection engine.

  • subdomains
  • IP addresses
  • ASNs
  • netblocks

Does it touch the target?

Has a passive mode and active modes. The active modes need the owner's permission.

README: "performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques." In the enum CLI source, -passive is "Deprecated since passive is the default setting"; -active will "Attempt zone transfers and certificate name grabs"; -brute will "Execute brute forcing after searches".

API keys: Docs: credentialed sources are configured in datasources.yaml, and "Some data sources require a paid subscription or API key to access advanced features"; 38 listed sources need credentials.

Install

Install with go
CGO_ENABLED=0 go install -v github.com/owasp-amass/amass/v5/cmd/amass@main

From the project's documentation

Install with package
brew tap owasp-amass/homebrew-amass
brew install amass

From the project's documentation

Install with docker
docker pull owaspamass/amass:latest

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Enumerate a domain with the official Docker image, keeping config outside the container
docker run --rm -it -v ~/.config/amass:/.config/amass amass:latest enum -d example.com

From the project's documentation

Run an active enumeration in the Docker Compose setup
docker compose run --rm enum -active -d example.com

From the project's documentation

Limits the project documents

  • 38 of the documented data sources require credentials (docs, Available Data Sources).
  • The enum CLI reports that ports can only be scanned in active mode.
  • Street address parsing requires building with libpostal and CGO enabled (docs, Getting Started).

Deepak's take

Analysis, not documentation

Use it when
Use it when you want a persistent, queryable map of your domains, IP ranges and ASNs that you track over time, not a one-off list.
Skip it when
Skip it for a fast single-domain subdomain pass, where subfinder is lighter. The engine and database setup is heavier than a single binary.
What it will miss
In default passive mode it will not find names absent from its data sources unless you enable brute forcing or alterations.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Licence: Apache-2.0. OWASP Amass is a trademark or project name of its owners; this library is not affiliated with it.