Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Oct 13, 2026

Recon

OWASP Amass: enumerate subdomains

Amass is the OWASP project's open-source tool for attack surface mapping and external asset discovery, using open-source information gathering and active reconnaissance techniques to find subdomains, IP addresses and related network assets.

installCGO_ENABLED=0 go install -v github.com/owasp-amass/amass/v5/cmd/amass@latest

Go

Agent
Map an organization's external footprintExtend coverage with active recon and brute forcingResolve and annotate discovered names

overview

What amass does

amass is the OWASP project for attack-surface mapping. Seed a root domain with -d (or a file with -df). It pulls subdomains from many passive sources, can enable active DNS recon, and can brute-force more names against a wordlist.

Depth is the cost. You control resolvers and -dns-qps. Include or exclude sources as needed. -active and -brute reach past passive feeds. A graph directory can persist results across runs.

On Trickest, amass is the discovery stage. It writes a deduplicated name list plus a results folder. Pass that to httpx so later steps work from live hosts. Schedule the run when the surface changes.

source github.com/owasp-amass/amass

use cases

Where amass fits

Map an organization's external footprint

Enumerate subdomains of a root domain from many passive sources at once to scope an engagement or build an asset inventory.

Extend coverage with active recon and brute forcing

Enable active methods and brute forcing against a wordlist to find names that passive sources never returned, expanding the surface.

Resolve and annotate discovered names

Show IP addresses and data sources alongside each name so the output is already enriched for triage and downstream probing.

Feed a probing and scanning pipeline

Pass amass output to httpx and a scanner so the full discovered surface gets classified and tested in one workflow.

reference

amass inputs and flags

37 inputs
NameTypeFlagDescription
domainSTRING-dDomain names separated by commas (can be used multiple times).
domain-listFILE-dfPath to a file providing root domain names.
active-methodsBOOLEAN-activeEnable active recon methods.
bruteforce-flagBOOLEAN-brutePerform brute-force subdomain enumeration.
wordlist-bruteFILE-wPath to a wordlist file for brute forcing.
timeoutSTRING-timeoutNumber of minutes to execute the enumeration.

Showing key inputs. amass exposes 37 inputs in total.

Full flag reference (37 inputs)
NameTypeFlagDescription
portsSTRING-pPorts separated by commas (default: 443)
domainSTRING-dDomain names separated by commas (can be used multiple times)
no-altsBOOLEAN-noaltsDisable generation of altered names
passiveBOOLEAN-passiveDeprecated since passive is the default setting
show-ipBOOLEAN-ipShow the IP addresses for discovered names
timeoutSTRING-timeoutNumber of minutes to execute the enumeration
blacklistSTRING-blBlacklist of subdomain names that will not be investigated
show-ipv4BOOLEAN-ipv4Show the IPv4 addresses for discovered names
show-ipv6BOOLEAN-ipv6Show the IPv6 addresses for discovered names
domain-listFILE-dfPath to a file providing root domain names
active-methodsBOOLEAN-activeEnable active recon methods
wordlist-bruteFILE-wPath to a different wordlist file
bruteforce-flagBOOLEAN-brutePerform brute force subdomain enumeration
ini-config-fileFILE-configPath to the INI configuration file
max-dns-queriesSTRING-max-dns-queriesDeprecated flag to be replaced by dns-qps in version 4.0
no-recursive-bfBOOLEAN-norecursiveTurn off recursive brute forcing
trusted-resolverSTRING-trIP addresses of trusted DNS resolver
exclude-data-fileFILE-efPath to a file providing data sources to exclude
min-for-recursiveSTRING-min-for-recursiveSubdomain labels seen before recursive brute forcing (Default: 1)
print-data-sourcesBOOLEAN-srcPrint data sources for the discovered names
untrusted-resolverSTRING-rIP addresses of untrusted DNS resolver
exclude-source-namesSTRING-excludeData source names separated by commas to be excluded
include-data-sourcesSTRING-includeData source names separated by commas to be included
wordlist-alternationsFILE-awPath to a different wordlist file for alterations
dns-queries-per-secondSTRING-dns-qpsMaximum number of DNS queries per second
trusted-resolvers-fileSTRING-trfPath to a file providing trusted DNS resolvers
graph-database-directoryFOLDER-dirPath to the directory containing the graph database
untrusted-resolvers-fileFILE-rfPath to a file providing untrusted DNS resolvers
include-data-sources-fileFILE-ifPath to a file providing data sources to include
trusted-dns-resolvers-fileFILE-trfPath to a file providing trusted DNS resolvers
blacklisted-subdomains-fileFILE-blfPath to a file providing blacklisted subdomains
no-resolver-rate-monitoringBOOLEAN-noresolvrateDisable resolver rate monitoring
untrusted-dns-resolvers-fileFILE-rfPath to a file providing preferred DNS resolvers
already-known-subdomain-namesFILE-nfPath to a file providing already known subdomain names (from other tools/sources)
no-resolver-reliability-scoreBOOLEAN-noresolvscoreDisable resolver reliability scoring
trusted-dns-max-queries-per-secondSTRING-trqpsMaximum number of DNS queries per second for each trusted resolvers
untrusted-dns-max-queries-per-secondSTRING-rqpsMaximum number of DNS queries per second for untrusted resolvers

example

Run amass

amass · command
# active recon and brute forcing for a root domain
amass enum -d example.com -active -brute
sample output
www.example.com (FQDN) --> a_record --> 203.0.113.10 (IPAddress)
api.example.com (FQDN) --> cname_record --> api.example-cdn.net (FQDN)
api.example-cdn.net (FQDN) --> a_record --> 203.0.113.24 (IPAddress)
example.com (FQDN) --> ns_record --> ns1.example.net (FQDN)
example.com (FQDN) --> mx_record --> mail.example.com (FQDN)
dev.example.com (FQDN) --> a_record --> 203.0.113.61 (IPAddress)

guidance

Choosing amass

Use amass when you want deep, multi-source subdomain discovery and are willing to tune it. For a fast, purely passive first pass, subfinder is quicker. amass finds names, so follow it with httpx to learn which are live.

subfinder

Faster passive-only discovery. amass goes deeper with active methods and brute forcing.

amass-intel

The intel subcommand for org, ASN, and CIDR discovery rather than subdomains.

assetfinder

Lightweight passive finder. amass queries more sources and adds active recon.

puredns

Resolves and brute-forces names with wildcard filtering. amass discovers and correlates from many sources; pipeline often runs amass then puredns then httpx.

workflows

Workflows using amass

2 workflows

  1. Subdomain Enumeration

    Find every subdomain of a domain from passive sources and certificate transparency, then resolve and probe the hosts that answer.

  2. Website Screenshot & Visual Recon

    Screenshot every live web server across a domain's subdomains, ordered so the forgotten dashboard and the staging copy of production surface first.

faq

amass questions

Pass the root domain. amass treats `-d` as the seed and enumerates beneath it. Repeat `-d` or use `-df` for several roots. A subdomain seed only narrows the zone.

Both. Passive sources run by default. `-active` and `-brute` widen coverage past feeds alone. Cap rate with `-dns-qps` when the scope is sensitive.

Enable `-brute` and point `-w` at a wordlist. `-alts` permutes known names, with `-aw` as its wordlist. `-norecursive` turns off recursive brute forcing. `-min-for-recursive` sets the label threshold.

subfinder is faster for a passive first pass. amass goes deeper with active methods, brute force, and source control. Follow either with httpx for live hosts.

Current Amass (v5) is one binary with subcommands: `amass enum` starts a collection session against `-d` domains, `amass subs` prints the names and addresses found, `amass track` shows newly discovered assets, `amass viz` renders graphs, `amass assoc` walks asset relationships, and `amass engine` runs the collection engine. Run `amass <subcommand> -h` for each one's flags; the older `amass intel` subcommand was dropped in v5.

In v5, `amass enum` stores results in its asset database (the `-dir` directory, by default the Amass config directory), and you print them afterwards with `amass subs -names -d example.com`, adding `-ip` for addresses or `-o file.txt` to save the output. In v4.x (the version the Trickest node runs), `amass enum -o file.txt` saves the terminal output, which lists relations such as `www.example.com (FQDN) --> a_record --> 203.0.113.10 (IPAddress)` rather than one name per line.

related

More Recon tools

  1. amass-intel

    OWASP Amass intel: map an organization's root domains and ranges.

  2. assetfinder

    Find domains and subdomains potentially related to a given domain.

  3. bbot

    Modular OSINT recon that chains modules from a seed target.

  4. bevigil

    CLI client for the BeVigil OSINT API, keyed by domain or app package.

  5. cloud-enum

    Multi-cloud public name enumeration for AWS, Azure, and GCP.

  6. cloudlist

    List assets from multiple cloud providers in one inventory.

Run amass yourself

A domain feeds amass, which maps the subdomain surface and passes the names to httpx so only live hosts land as output.

Open amass in the libraryView the workflow

Facts on this page come from the live Trickest tool library.