Recon
Emit Amass subdomain records as structured JSON
OWASP Amass enumeration that emits structured JSON.
overview
What amass-json does
Slot amass-json when the next stage needs fields, not lines. Feed -d or -df and get FILE plus FOLDER of JSON records with name metadata ready for JQ, tables, or joins.
Reach for it when plain amass text forces a custom parser. Same -passive, -active, -brute, -w, and -timeout controls; only the emit format changes.
Prefer standard amass when a flat name list is enough. Prefer subfinder for lighter passive discovery with its own JSON mode. Bound long -active or -brute runs with -timeout.
source github.com/OWASP/Amass
use cases
Where amass-json fits
Discover subdomains as structured data
Enumerate a domain and emit JSON so each name and its metadata become records the next node can parse, filter, and join instead of plain text.
Run a quiet passive-only enumeration
Use -passive to map the surface from data sources alone without sending active traffic, then read the JSON for triage.
Feed a JSON-aware pipeline
Route amass-json output through JQ or into a table so downstream filtering, deduplication, and correlation work on fields rather than lines.
Brute force and resolve in one pass
Combine -brute with a wordlist via -w and -ip to expand coverage and attach addresses to discovered names in the same JSON stream.
reference
amass-json inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain names separated by commas (can be used multiple times) |
| domain-list | FILE | -df | Path to a file providing root domain names |
| passive | BOOLEAN | -passive | A purely passive mode of execution |
| active-methods | BOOLEAN | -active | Enable active recon methods |
| bruteforce-flag | BOOLEAN | -brute | Perform brute force subdomain enumeration |
| wordlist-brute | FILE | -w | Path to a different wordlist file |
| show-ip | BOOLEAN | -ip | Show the IP addresses for discovered names |
| timeout | STRING | -timeout | Number of minutes to execute the enumeration |
Showing key inputs. amass-json exposes 37 inputs in total.
Full flag reference (37 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| ports | STRING | -p | Ports separated by commas (default: 443) |
| domain | STRING | -d | Domain names separated by commas (can be used multiple times) |
| no-alts | BOOLEAN | -noalts | Disable generation of altered names |
| passive | BOOLEAN | -passive | A purely passive mode of execution |
| show-ip | BOOLEAN | -ip | Show the IP addresses for discovered names |
| timeout | STRING | -timeout | Number of minutes to execute the enumeration |
| blacklist | STRING | -bl | Blacklist of subdomain names that will not be investigated |
| show-ipv4 | BOOLEAN | -ipv4 | Show the IPv4 addresses for discovered names |
| show-ipv6 | BOOLEAN | -ipv6 | Show the IPv6 addresses for discovered names |
| domain-list | FILE | -df | Path to a file providing root domain names |
| active-methods | BOOLEAN | -active | Enable active recon methods |
| wordlist-brute | FILE | -w | Path to a different wordlist file |
| bruteforce-flag | BOOLEAN | -brute | Perform brute force subdomain enumeration |
| ini-config-file | FILE | -config | Path to the INI configuration file |
| max-dns-queries | STRING | -max-dns-queries | Deprecated flag to be replaced by dns-qps in version 4.0 |
| no-recursive-bf | BOOLEAN | -norecursive | Turn off recursive brute forcing |
| trusted-resolver | STRING | -tr | IP addresses of trusted DNS resolver |
| exclude-data-file | FILE | -ef | Path to a file providing data sources to exclude |
| min-for-recursive | STRING | -min-for-recursive | Subdomain labels seen before recursive brute forcing (Default: 1) |
| print-data-sources | BOOLEAN | -src | Print data sources for the discovered names |
| untrusted-resolver | STRING | -r | IP addresses of untrusted DNS resolver |
| exclude-source-names | STRING | -exclude | Data source names separated by commas to be excluded |
| include-data-sources | STRING | -include | Data source names separated by commas to be included |
| wordlist-alternations | FILE | -aw | Path to a different wordlist file for alterations |
| dns-queries-per-second | STRING | -dns-qps | Maximum number of DNS queries per second |
| trusted-resolvers-file | STRING | -trf | Path to a file providing trusted DNS resolvers |
| graph-database-directory | FOLDER | -dir | Path to the directory containing the graph database |
| untrusted-resolvers-file | FILE | -rf | Path to a file providing untrusted DNS resolvers |
| include-data-sources-file | FILE | -if | Path to a file providing data sources to include |
| trusted-dns-resolvers-file | FILE | -trf | Path to a file providing trusted DNS resolvers |
| blacklisted-subdomains-file | FILE | -blf | Path to a file providing blacklisted subdomains |
| no-resolver-rate-monitoring | BOOLEAN | -noresolvrate | Disable resolver rate monitoring |
| untrusted-dns-resolvers-file | FILE | -rf | Path to a file providing preferred DNS resolvers |
| already-known-subdomain-names | FILE | -nf | Path to a file providing already known subdomain names (from other tools/sources) |
| no-resolver-reliability-score | BOOLEAN | -noresolvscore | Disable resolver reliability scoring |
| trusted-dns-max-queries-per-second | STRING | -trqps | Maximum number of DNS queries per second for each trusted resolvers |
| untrusted-dns-max-queries-per-second | STRING | -rqps | Maximum number of DNS queries per second for untrusted resolvers |
example
Run amass-json
# amass-json: passive enumeration with IPs for a root domainamass enum -d example.com -passive -ipwww.example.comapi.example.commail.example.comdev.example.comstaging.example.comvpn.example.comcdn.example.comapp.example.comguidance
Choosing amass-json
Use amass-json when you want Amass-grade subdomain discovery and need structured JSON for downstream parse. If a flat text list is enough, standard amass is simpler. Follow with a prober for live hosts.
amass
Same enumeration with plain-text output. Use when downstream nodes do not need JSON.
subfinder
Lighter passive discovery with its own JSON mode. Choose when you skip active methods.
amass-intel
Intel subcommand for org, ASN, and CIDR discovery. Run first to set scope.
faq
amass-json questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run amass-json yourself
A domain feeds amass-json, which enumerates subdomains as JSON and passes the names to httpx so only live hosts land as output.
Facts on this page come from the live Trickest tool library.