Recon
Map organization-owned domains before subdomain enum
OWASP Amass intel: map an organization's root domains and ranges.
overview
What amass-intel does
Run amass-intel first to set engagement scope. It works outward from an organization via -org, -asn, -cidr, -addr, or -d, and returns root domains and network blocks rather than subdomains of one seed.
Operators use it when the seed list may be incomplete. -whois pivots seed domains through reverse whois; ASN and CIDR inputs turn a known block into names hosted on it. Optional -active attempts certificate name grabs; -ip attaches resolved addresses.
Feed discovered roots into amass or subfinder next. asnmap is a tighter alternative when you only need ASN and CIDR mapping. Trickest runs amass-intel as a managed Recon node with file and folder outputs.
source github.com/OWASP/Amass
use cases
Where amass-intel fits
Discover the domains an organization owns
Search by company name to surface root domains tied to the target, establishing scope before any subdomain enumeration begins.
Pivot from an ASN or CIDR to domains
Feed a known ASN or network block and amass-intel returns the domains hosted on it, turning a network range into enumeration targets.
Find related domains via reverse whois
Run provided domains through reverse whois to find other domains registered to the same entity, widening the scope organically.
Expand IP ranges into name lists
Pass -addr or -cidr ranges and collect the domains that resolve onto those blocks, so network ownership becomes a subdomain target list.
reference
amass-intel inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| org | STRING | -org | Search string matched against AS description information. |
| asn | STRING | -asn | ASNs separated by commas. |
| cidr | STRING | -cidr | CIDRs separated by commas. |
| addr | STRING | -addr | IPs and ranges (192.168.1.1-254) separated by commas. |
| domains | STRING | -d | Domain names separated by commas. |
| whois | BOOLEAN | -whois | Run all provided domains through reverse whois. |
| active | BOOLEAN | -active | Attempt certificate name grabs. |
| ip | BOOLEAN | -ip | Show the IP addresses for discovered names. |
Showing key inputs. amass-intel exposes 25 inputs in total.
Full flag reference (25 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| ip | BOOLEAN | -ip | Show the IP addresses for discovered names |
| asn | STRING | -asn | ASNs separated by commas |
| org | STRING | -org | Search string provided against AS description information |
| src | BOOLEAN | -src | Print data sources for the discovered names |
| addr | STRING | -addr | IPs and ranges (192.168.1.1-254) separated by commas |
| cidr | STRING | -cidr | CIDRs separated by commas |
| demo | BOOLEAN | -demo | Censor output to make it suitable for demonstrations |
| ipv4 | BOOLEAN | -ipv4 | Show the IPv4 addresses for discovered names |
| ipv6 | BOOLEAN | -ipv6 | Show the IPv6 addresses for discovered names |
| list | BOOLEAN | -list | Print additional information |
| ports | STRING | -p | Ports separated by commas (default: 80, 443) |
| whois | BOOLEAN | -whois | All provided domains are run through reverse whois |
| active | BOOLEAN | -active | Attempt certificate name grabs |
| config | FILE | -config | Path to the INI configuration file |
| domains | STRING | -d | Domain names separated by commas |
| exclude | STRING | -exclude | Data source names separated by commas to be excluded |
| include | STRING | -include | Data source names separated by commas to be included |
| timeout | STRING | -timeout | Number of minutes to let enumeration run before quitting |
| verbose | STRING | -v | Output status / debug / troubleshooting info |
| resolvers | STRING | -r | IP addresses of preferred DNS resolvers |
| domains-file | FILE | -df | Path to a file providing root domain names |
| exclude-file | FILE | -ef | Path to a file providing data sources to exclude |
| include-file | FILE | -if | Path to a file providing data sources to include |
| resolvers-file | FILE | -rf | Path to a file providing preferred DNS resolvers |
| max-dns-queries | STRING | -max-dns-queries | Maximum number of concurrent DNS queries |
example
Run amass-intel
# amass-intel: map org scope from ASN and reverse whois seedsamass intel -org "Example" -asn 64500 -d example.com -whois -ipexample.comwww.example.commail.example.comapi.example.comcdn.example.comvpn.example.comstaging.example.comdev.example.comguidance
Choosing amass-intel
Use at the start of an engagement to map what an organization owns, before subdomain enumeration. It finds root domains and ranges, not subdomains. Feed output into amass or subfinder. Prefer asnmap when you only need ASN and CIDR blocks.
amass
Enumeration subcommand for subdomains. Run amass-intel first to find the domains it should target.
asnmap
Maps an organization to ASNs and CIDR ranges quickly. Prefer for network-block pivots without full intel sources.
amass-json
Enumeration with JSON output. Use downstream once intel has set the scope.
faq
amass-intel questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
cloudlist
List assets from multiple cloud providers in one inventory.
Run amass-intel yourself
An organization name feeds amass-intel, which finds the root domains it owns and passes them to subfinder for subdomain enumeration.
Facts on this page come from the live Trickest tool library.