Map an attack surface with OWASP amass

amass is the OWASP project for attack-surface mapping. Given a root domain, it discovers subdomains by combining many passive data sources with active reconnaissance, then can resolve names, show IP addresses, and brute force additional subdomains against a wordlist. The result is a broad, deduplicated picture of an organization's external footprint built from far more sources than any single feed.

Its depth is the trade-off. amass exposes detailed control over DNS resolvers, query rates, recursion, and which data sources to include or exclude, so it rewards tuning on large scopes. Active methods and brute forcing extend coverage past what passive sources alone return, and a graph database directory lets it persist and correlate results across runs.

In a Trickest workflow, amass runs as the discovery stage: give it a domain with -d or a file of domains with -df, and it writes a deduplicated name list plus a results folder. Hand that to a prober like httpx so the rest of the pipeline works from live hosts, and schedule the run to track a changing attack surface.