OWASP Amass Guide
A comprehensive guide to mastering OWASP Amass for OSINT investigations
Core Concepts
Amass operates through several subcommands. `amass intel` discovers root domains associated with an organization. `amass enum` is the core enumeration engine using both passive (querying third-party sources) and active (DNS brute-forcing) techniques. All findings are stored in a graph database.
Installation
Download pre-compiled binaries from the GitHub releases page, or build from source if you have Go installed. It is also included in security-focused Linux distributions like Kali Linux.
Step-by-Step Usage Guide
Initial Intelligence Gathering
Find all root domains associated with a target organization.
Command: `amass intel -org "OWASP"`
This queries data sources to find domains registered by the organization.
Passive Enumeration
Perform a fast, non-intrusive scan using only third-party data sources. This is safe and avoids direct contact with the target.
Command: `amass enum -passive -d owasp.org`
Add the `-src` flag to see which sources provided which names.
Active Enumeration
Enable active techniques like DNS brute-forcing. This is more comprehensive but "noisier" and should only be done with permission.
**Basic Active Scan:** `amass enum -active -d owasp.org`
**With Brute-Forcing:** `amass enum -active -brute -w /path/to/wordlist.txt -d owasp.org`
Configuring API Keys
Many of Amass's passive data sources require API keys for full functionality. Add these to a configuration file (`config.ini`).
Command with config: `amass enum -passive -config /path/to/config.ini -d owasp.org`
Database Management
Amass stores results in a project directory.
**Specify Project:** `amass enum -d owasp.org -dir owasp_project`
**List Names:** `amass db -dir owasp_project -names -d owasp.org`
**Show Summary:** `amass db -dir owasp_project -summary`
Practical Tips
Always verify Amass's findings with tools like `dig` or `nslookup`. Passive sources can sometimes provide outdated information. Use the database feature to track changes over time.
Legal Considerations
Passive reconnaissance is generally legal. Active scanning (brute-forcing, zone transfers) without permission can be illegal. Always get written authorization for active techniques.