loading
Loading content
loading
Recon
OWASP Amass intel: map an organization's root domains and ranges.
overview
Run amass-intel first to set engagement scope. It works outward from an organization via -org, -asn, -cidr, -addr, or -d, and returns root domains and network blocks rather than subdomains of one seed.
Operators use it when the seed list may be incomplete. -whois pivots seed domains through reverse whois; ASN and CIDR inputs turn a known block into names hosted on it. Optional -active attempts certificate name grabs; -ip attaches resolved addresses.
Feed discovered roots into amass or subfinder next. asnmap is a tighter alternative when you only need ASN and CIDR mapping. Trickest runs amass-intel as a managed Recon node with file and folder outputs.
source github.com/OWASP/Amass
use cases
Search by company name to surface root domains tied to the target, establishing scope before any subdomain enumeration begins.
Feed a known ASN or network block and amass-intel returns the domains hosted on it, turning a network range into enumeration targets.
Run provided domains through reverse whois to find other domains registered to the same entity, widening the scope organically.
Pass -addr or -cidr ranges and collect the domains that resolve onto those blocks, so network ownership becomes a subdomain target list.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| org | STRING | -org | Search string matched against AS description information. |
| asn | STRING | -asn | ASNs separated by commas. |
| cidr | STRING | -cidr | CIDRs separated by commas. |
| addr | STRING | -addr | IPs and ranges (192.168.1.1-254) separated by commas. |
| domains | STRING | -d | Domain names separated by commas. |
| whois | BOOLEAN | -whois | Run all provided domains through reverse whois. |
| active | BOOLEAN | -active | Attempt certificate name grabs. |
| ip | BOOLEAN | -ip | Show the IP addresses for discovered names. |
Showing key inputs. amass-intel exposes 25 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| ip | BOOLEAN | -ip | Show the IP addresses for discovered names |
| asn | STRING | -asn | ASNs separated by commas |
| org | STRING | -org | Search string provided against AS description information |
| src | BOOLEAN | -src | Print data sources for the discovered names |
| addr | STRING | -addr | IPs and ranges (192.168.1.1-254) separated by commas |
| cidr | STRING | -cidr | CIDRs separated by commas |
| demo | BOOLEAN | -demo | Censor output to make it suitable for demonstrations |
| ipv4 | BOOLEAN | -ipv4 | Show the IPv4 addresses for discovered names |
| ipv6 | BOOLEAN | -ipv6 | Show the IPv6 addresses for discovered names |
| list | BOOLEAN | -list | Print additional information |
| ports | STRING | -p | Ports separated by commas (default: 80, 443) |
| whois | BOOLEAN | -whois | All provided domains are run through reverse whois |
| active | BOOLEAN | -active | Attempt certificate name grabs |
| config | FILE | -config | Path to the INI configuration file |
| domains | STRING | -d | Domain names separated by commas |
| exclude | STRING | -exclude | Data source names separated by commas to be excluded |
| include | STRING | -include | Data source names separated by commas to be included |
| timeout | STRING | -timeout | Number of minutes to let enumeration run before quitting |
| verbose | STRING | -v | Output status / debug / troubleshooting info |
| resolvers | STRING | -r | IP addresses of preferred DNS resolvers |
| domains-file | FILE | -df | Path to a file providing root domain names |
| exclude-file | FILE | -ef | Path to a file providing data sources to exclude |
| include-file | FILE | -if | Path to a file providing data sources to include |
| resolvers-file | FILE | -rf | Path to a file providing preferred DNS resolvers |
| max-dns-queries | STRING | -max-dns-queries | Maximum number of concurrent DNS queries |
example
# amass-intel: map org scope from ASN and reverse whois seedsamass intel -org "Example" -asn 64500 -d example.com -whois -ipexample.comwww.example.commail.example.comapi.example.comcdn.example.comvpn.example.comstaging.example.comdev.example.comguidance
Use at the start of an engagement to map what an organization owns, before subdomain enumeration. It finds root domains and ranges, not subdomains. Feed output into amass or subfinder. Prefer asnmap when you only need ASN and CIDR blocks.
Enumeration subcommand for subdomains. Run amass-intel first to find the domains it should target.
Maps an organization to ASNs and CIDR ranges quickly. Prefer for network-block pivots without full intel sources.
Enumeration with JSON output. Use downstream once intel has set the scope.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
An organization name feeds amass-intel, which finds the root domains it owns and passes them to subfinder for subdomain enumeration.
Facts on this page come from the live Trickest tool library.