OWASP Amass
In-depth attack-surface mapping & subdomain enumeration.
KaliParrotlow
pkg: amass
Amass maps external assets using passive sources and active resolution, producing the most complete subdomain picture of any single tool.
Syntax
amass enum [-passive] -d {domain}
Example
amass enum -passive -d example.com
Passively enumerates subdomains from dozens of data sources without touching the target.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
amass
Usage examples
amass enum -passive -d target.tld
Passive subdomain enumeration.
amass enum -active -brute -d target.tld -o subs.txt
Active + brute-force, saved to a file.
Advantages
- Best-in-class subdomain coverage
- Passive and active modes
- Graph database of relationships
Disadvantages
- Active mode is noisy and slow
- Some sources require API keys
- Large output needs triage
Tags
#subdomains#attack-surface
Official docs: Amass ↗
Related commands
Frequently asked questions
What is OWASP Amass used for?
Amass maps external assets using passive sources and active resolution, producing the most complete subdomain picture of any single tool.
What is an example OWASP Amass command?
A common example is: amass enum -passive -d example.com — Passively enumerates subdomains from dozens of data sources without touching the target.
Is OWASP Amass part of Kali Linux?
Yes. OWASP Amass ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install amass.
What category of security tool is OWASP Amass?
OWASP Amass is a Information Gathering tool with a low-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.