amass

by owasp-amass

13.7Kstars

2.1Kforks

225watchers

Updated 5 months ago

About

OWASP Amass is a powerful tool for in-depth attack surface mapping and external asset discovery using open source intelligence and active reconnaissance.

In-depth attack surface mapping and asset discovery

Primary Use Case

Security professionals and network defenders use Amass to identify and map an organization's external network assets and attack surfaces. It helps uncover vulnerabilities and potential entry points by aggregating data from multiple sources and performing active network reconnaissance.

Key Features

Comprehensive network mapping of attack surfaces
External asset discovery using open source intelligence
Active reconnaissance techniques integration
Supports installation via Go and Docker
Extensive documentation and community support
Open source with Apache 2.0 license
Continuous integration with testing and code coverage
Community engagement through Discord and contribution guidelines

Installation

Install Go from https://golang.org/dl/ if not already installed
Use 'go install' to install Amass (specific command not provided but implied)
Alternatively, pull the Docker image using 'docker pull owaspamass/amass'
Refer to the Amass Docs repository for additional installation instructions

Usage

>_ amass enum -d example.com

Performs enumeration to discover subdomains and external assets related to example.com

>_ amass -h

Displays help information and available commands for Amass

Security Frameworks

Reconnaissance

Discovery

Collection

Initial Access

Execution

Usage Insights

Integrate Amass with vulnerability scanners to automate attack surface discovery and vulnerability correlation.
Use Amass in purple team exercises to simulate attacker reconnaissance and improve defender detection capabilities.
Leverage Amass for continuous external asset monitoring to detect unauthorized exposure or shadow IT.
Chain Amass outputs with automated exploitation frameworks like Metasploit for streamlined red team operations.
Incorporate Amass into CI/CD pipelines for early detection of exposed assets during development and deployment.