Recon
OWASP Amass: enumerate subdomains
Multi-source subdomain discovery; hand names to httpx.
overview
What amass does
amass is the OWASP project for attack-surface mapping. Seed a root domain with -d (or a file with -df). It pulls subdomains from many passive sources, can enable active DNS recon, and can brute-force more names against a wordlist.
Depth is the cost. You control resolvers and -dns-qps. Include or exclude sources as needed. -active and -brute reach past passive feeds. A graph directory can persist results across runs.
On Trickest, amass is the discovery stage. It writes a deduplicated name list plus a results folder. Pass that to httpx so later steps work from live hosts. Schedule the run when the surface changes.
source github.com/owasp-amass/amass
use cases
Where amass fits
Map an organization's external footprint
Enumerate subdomains of a root domain from many passive sources at once to scope an engagement or build an asset inventory.
Extend coverage with active recon and brute forcing
Enable active methods and brute forcing against a wordlist to find names that passive sources never returned, expanding the surface.
Resolve and annotate discovered names
Show IP addresses and data sources alongside each name so the output is already enriched for triage and downstream probing.
Feed a probing and scanning pipeline
Pass amass output to httpx and a scanner so the full discovered surface gets classified and tested in one workflow.
reference
amass inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain names separated by commas (can be used multiple times). |
| domain-list | FILE | -df | Path to a file providing root domain names. |
| active-methods | BOOLEAN | -active | Enable active recon methods. |
| bruteforce-flag | BOOLEAN | -brute | Perform brute-force subdomain enumeration. |
| wordlist-brute | FILE | -w | Path to a wordlist file for brute forcing. |
| show-ip | BOOLEAN | -ip | Show the IP addresses for discovered names. |
| print-data-sources | BOOLEAN | -src | Print the data source next to each discovered name. |
| timeout | STRING | -timeout | Number of minutes to execute the enumeration. |
Showing key inputs. amass exposes 37 inputs in total.
Full flag reference (37 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| ports | STRING | -p | Ports separated by commas (default: 443) |
| domain | STRING | -d | Domain names separated by commas (can be used multiple times) |
| no-alts | BOOLEAN | -noalts | Disable generation of altered names |
| passive | BOOLEAN | -passive | Deprecated since passive is the default setting |
| show-ip | BOOLEAN | -ip | Show the IP addresses for discovered names |
| timeout | STRING | -timeout | Number of minutes to execute the enumeration |
| blacklist | STRING | -bl | Blacklist of subdomain names that will not be investigated |
| show-ipv4 | BOOLEAN | -ipv4 | Show the IPv4 addresses for discovered names |
| show-ipv6 | BOOLEAN | -ipv6 | Show the IPv6 addresses for discovered names |
| domain-list | FILE | -df | Path to a file providing root domain names |
| active-methods | BOOLEAN | -active | Enable active recon methods |
| wordlist-brute | FILE | -w | Path to a different wordlist file |
| bruteforce-flag | BOOLEAN | -brute | Perform brute force subdomain enumeration |
| ini-config-file | FILE | -config | Path to the INI configuration file |
| max-dns-queries | STRING | -max-dns-queries | Deprecated flag to be replaced by dns-qps in version 4.0 |
| no-recursive-bf | BOOLEAN | -norecursive | Turn off recursive brute forcing |
| trusted-resolver | STRING | -tr | IP addresses of trusted DNS resolver |
| exclude-data-file | FILE | -ef | Path to a file providing data sources to exclude |
| min-for-recursive | STRING | -min-for-recursive | Subdomain labels seen before recursive brute forcing (Default: 1) |
| print-data-sources | BOOLEAN | -src | Print data sources for the discovered names |
| untrusted-resolver | STRING | -r | IP addresses of untrusted DNS resolver |
| exclude-source-names | STRING | -exclude | Data source names separated by commas to be excluded |
| include-data-sources | STRING | -include | Data source names separated by commas to be included |
| wordlist-alternations | FILE | -aw | Path to a different wordlist file for alterations |
| dns-queries-per-second | STRING | -dns-qps | Maximum number of DNS queries per second |
| trusted-resolvers-file | STRING | -trf | Path to a file providing trusted DNS resolvers |
| graph-database-directory | FOLDER | -dir | Path to the directory containing the graph database |
| untrusted-resolvers-file | FILE | -rf | Path to a file providing untrusted DNS resolvers |
| include-data-sources-file | FILE | -if | Path to a file providing data sources to include |
| trusted-dns-resolvers-file | FILE | -trf | Path to a file providing trusted DNS resolvers |
| blacklisted-subdomains-file | FILE | -blf | Path to a file providing blacklisted subdomains |
| no-resolver-rate-monitoring | BOOLEAN | -noresolvrate | Disable resolver rate monitoring |
| untrusted-dns-resolvers-file | FILE | -rf | Path to a file providing preferred DNS resolvers |
| already-known-subdomain-names | FILE | -nf | Path to a file providing already known subdomain names (from other tools/sources) |
| no-resolver-reliability-score | BOOLEAN | -noresolvscore | Disable resolver reliability scoring |
| trusted-dns-max-queries-per-second | STRING | -trqps | Maximum number of DNS queries per second for each trusted resolvers |
| untrusted-dns-max-queries-per-second | STRING | -rqps | Maximum number of DNS queries per second for untrusted resolvers |
example
Run amass
# active recon: brute forcing, IP addresses, and data sources for a root domainamass enum -d example.com -active -brute -ip -src[Crtsh] www.example.com 203.0.113.10[DNSHistory] api.example.com 203.0.113.24[HackerTarget] mail.example.com 203.0.113.24[Brute Forcing] dev.example.com 203.0.113.61[Alterations] staging-api.example.com 203.0.113.61[RapidDNS] vpn.example.com 203.0.113.88[Crtsh] cdn.example.com 203.0.113.102guidance
Choosing amass
Use amass when you want deep, multi-source subdomain discovery and are willing to tune it. For a fast, purely passive first pass, subfinder is quicker. amass finds names, so follow it with httpx to learn which are live.
subfinder
Faster passive-only discovery. amass goes deeper with active methods and brute forcing.
amass-intel
The intel subcommand for org, ASN, and CIDR discovery rather than subdomains.
assetfinder
Lightweight passive finder. amass queries more sources and adds active recon.
puredns
Resolves and brute-forces names with wildcard filtering. amass discovers and correlates from many sources; pipeline often runs amass then puredns then httpx.
workflows
Workflows using amass
Subdomain Enumeration
Find every subdomain of a domain from passive sources and certificate transparency, then resolve and probe the hosts that answer.
Website Screenshot & Visual Recon
Screenshot every live web server across a domain's subdomains, ordered so the forgotten dashboard and the staging copy of production surface first.
faq
amass questions
related
More Recon tools
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
cloudlist
List assets from multiple cloud providers in one inventory.
Run amass yourself
A domain feeds amass, which maps the subdomain surface and passes the names to httpx so only live hosts land as output.
Facts on this page come from the live Trickest tool library.