amass
In-depth attack-surface mapping and asset discovery. Slower and heavier than subfinder but finds more via active enumeration and its graph DB.
Tags: subdomains, passive, active, owasp, graph
- Category
- recon
- Maintenance signal
- active
Project repository · Documentation
Use this when: Intake. Use this on a root you are allowed to resolve. The output is a host list, not a finding.
Install
go
go install -v github.com/owasp-amass/amass/v4/...@masterbrew
brew install amasssnap
sudo snap install amassCommand templates
Passive enum
amass enum -passive -d {domain} -o {output}Active + brute
amass enum -active -brute -d {domain} -o {output}