amass Cheatsheet

← Back to cheatsheets

← Home

Amass is an OWASP project for in-depth attack surface mapping and asset discovery using open source information gathering and active reconnaissance techniques.

Subcommands

• amass intel - Discover targets for enumeration

• amass enum - Perform subdomain enumeration

• amass viz - Visualize enumeration results

• amass track - Track differences between enumerations

• amass db - Manage the graph database

Intel Subcommand

• amass intel -d <domain> - Basic intel gathering

• amass intel -whois -d <domain> - Reverse WHOIS lookup

• amass intel -org <organization> - Find ASNs by organization

• amass intel -asn <asn> - Get info about an ASN

• amass intel -ip <ip> - Discover domains from IP

• amass intel -cidr <cidr> - Discover domains from CIDR

Enum Subcommand - Basic

• amass enum -d <domain> - Basic passive enumeration

• amass enum -passive -d <domain> - Passive only (no DNS resolution)

• amass enum -active -d <domain> - Active enumeration (zone transfers, etc.)

• amass enum -brute -d <domain> - Brute force subdomain enumeration

• amass enum -d <domain> -o output.txt - Save results to file

Enum Subcommand - Advanced

• amass enum -d <domain> -src - Show data sources

• amass enum -d <domain> -ip - Show IP addresses

• amass enum -d <domain> -ipv4 - Show only IPv4 addresses

• amass enum -d <domain> -ipv6 - Show only IPv6 addresses

• amass enum -d <domain> -r <resolver> - Use custom resolver

• amass enum -d <domain> -rf resolvers.txt - Use resolver file

• amass enum -d <domain> -w wordlist.txt - Custom wordlist for brute

• amass enum -d <domain> -max-dns-queries 200 - Limit DNS queries/sec

Configuration

• amass enum -config config.ini -d <domain> - Use config file

• amass enum -list - List all data sources

Config File Location

• ~/.config/amass/config.yaml - Default config location
• ~/.config/amass/datasources.yaml - Data sources config

Example datasources.yaml

datasources:
  - name: SecurityTrails
    creds:
      apikey: your_api_key_here
  - name: Shodan
    creds:
      apikey: your_api_key_here

Database Operations

• amass db -list - List all enumerations

• amass db -d <domain> -show - Show stored data for domain

• amass db -d <domain> -names - List discovered names

• amass db -d <domain> -ip - Show IP addresses

Visualization

• amass viz -d <domain> -d3 - Generate D3.js visualization

• amass viz -d <domain> -gexf - Generate GEXF file (Gephi)

• amass viz -d <domain> -graphistry - Generate Graphistry JSON

• amass viz -d <domain> -maltego - Generate Maltego output

Tracking Changes

• amass track -d <domain> - Track differences between runs

• amass track -d <domain> -history - Show enumeration history

• amass track -d <domain> -since "2024-01-01" - Changes since date

Common Examples

Full Passive Enumeration

amass enum -passive -d example.com -src -ip -o results.txt

Passive enumeration showing sources and IPs.

Aggressive Active Scan

amass enum -active -brute -d example.com -w wordlist.txt -o results.txt

Active scan with brute forcing.

Quick Reconnaissance

amass intel -whois -d example.com

Discover related domains via WHOIS.

Tips

• Use API keys in config for better results (SecurityTrails, Shodan, etc.)

• Start with passive enumeration to avoid detection

• Use -src to understand where data comes from

• Combine with other tools like subfinder for comprehensive coverage

• Use custom resolvers to avoid rate limiting

• The database persists data between runs for tracking

• Always get authorization before scanning targets you don't own

← Back to cheatsheets

← Home