Amass: Complete Guide to Subdomain Enumeration and Attack Surface Mapping Using Kali Linux

Abdul Wahab Junaid

1 year ago

amass is OWASP’s flagship in-depth attack surface mapping and asset discovery tool, written in Go. It is widely regarded as one of the most powerful subdomain enumeration and network mapping tools available, combining active techniques (DNS brute forcing, zone transfers, permutation scanning) with passive techniques (querying dozens of third-party data sources like Certificate Transparency logs, Shodan, VirusTotal, and SecurityTrails). Amass also builds a graph database of relationships between discovered assets, allowing testers to visualize how subdomains, IP addresses, ASNs, and organizations interconnect.

Installation

Amass is pre-installed on Kali Linux. Manual installation options:

# Kali/Debian
sudo apt update && sudo apt install amass -y

# Via Go (any platform with Go installed)
go install -v github.com/owasp-amass/amass/v4/...@master

# Via Snap
sudo snap install amass

# Docker
docker pull caffix/amass

Verify installation:

amass -version

Syntax

amass [SUBCOMMAND] [OPTIONS]

Amass operates via subcommands: enum, intel, viz, track, db.

Command-Line Options

amass enum (the primary subdomain enumeration subcommand):

Flag	Description
`-d DOMAIN`	Target domain(s) to enumerate
`-df FILE`	File containing a list of domains
`-passive`	Passive-only mode (no active DNS resolution, fastest, stealthiest)
`-active`	Enable active techniques including certificate grabbing and DNS zone checks
`-brute`	Enable brute-force subdomain guessing using a wordlist
`-w FILE`	Wordlist file to use for brute forcing
`-min-for-recursive NUM`	Minimum discoveries before recursive brute forcing kicks in
`-o FILE`	Output discovered names to a text file
`-json FILE`	Output results in JSON format
`-src`	Show the data source that found each result
`-ip`	Show IP addresses along with discovered names
`-config FILE`	Use a custom configuration file (for API keys, data source settings)
`-r SERVER`	Specify custom resolvers to use
`-timeout MIN`	Set a maximum runtime for the enumeration in minutes
`-exclude SOURCE`	Exclude specific data sources from the scan
`-include SOURCE`	Restrict the scan to only specific data sources
`-list`	List all available data sources

amass intel:

Flag	Description
`-org NAME`	Discover domains associated with an organization name
`-asn NUM`	Discover domains/netblocks associated with an ASN
`-cidr CIDR`	Discover domains within a given CIDR range
`-whois`	Use reverse WHOIS to find additional related domains

amass viz:

Flag	Description
`-d3`	Generate an interactive D3.js HTML visualization
`-gexf`	Export graph data in GEXF format (for Gephi)
`-dot`	Export in Graphviz DOT format

Basic Usage

amass enum -d example.com

Expected output:

www.example.com
mail.example.com
ftp.example.com
dev.example.com
OWASP Amass v4.2.0
[+] 4 names discovered - cert: 2, dns: 1, scrape: 1

Practical Examples

Example 1 — Passive-only enumeration (fast, stealthy)

amass enum -passive -d example.com

www.example.com
mail.example.com
api.example.com

Example 2 — Active enumeration with brute forcing

amass enum -active -brute -w /usr/share/wordlists/amass/subdomains-top1mil-5000.txt -d example.com

www.example.com
staging.example.com
internal.example.com
[+] 15 names discovered

Example 3 — Show IP addresses alongside discovered subdomains

amass enum -d example.com -ip

www.example.com [93.184.216.34]
mail.example.com [93.184.216.35]

Example 4 — Show which data source found each result

amass enum -d example.com -src

crtsh: dev.example.com
virustotal: api.example.com
censys: staging.example.com

Example 5 — Output results to a JSON file for later processing

amass enum -d example.com -json amass_results.json

[+] Results written to amass_results.json

Example 6 — Intel mode: discover domains by organization name

amass intel -org "Example Corp"

example.com
example-corp.net
examplecorp.io

Example 7 — Intel mode: discover domains within an ASN

amass intel -asn 15169

google.com
googleapis.com
gstatic.com

Example 8 — Multiple domains from a file

cat domains.txt
# example.com
# example.org

amass enum -df domains.txt -o all_subdomains.txt

www.example.com
www.example.org
mail.example.org

Example 9 — Generate a visual HTML graph of discovered assets

amass viz -d3 -d example.com

[+] amass_d3.html created — open in a browser to explore the asset graph

Example 10 — Limit scan runtime for large domains

amass enum -d example.com -timeout 15

[*] Enumeration will stop after 15 minutes...
[+] 42 names discovered

Common Use Cases

Comprehensive passive + active subdomain enumeration for bug bounty and penetration testing scope expansion.
Discovering an organization’s full external attack surface, including forgotten/legacy subdomains found only via Certificate Transparency logs.
Mapping relationships between domains, IP netblocks, and ASNs owned by a target organization (intel mode).
Visualizing an organization’s infrastructure graph to identify pivot points and shared hosting relationships.
Continuous asset monitoring over time using amass track to detect newly added subdomains.

Automation with Bash

Automated recon pipeline: Amass enumeration feeding into a live-host check:

#!/bin/bash
# amass_pipeline.sh
DOMAIN=$1
amass enum -passive -d "$DOMAIN" -o "${DOMAIN}_subs.txt"

echo "[*] Checking for live hosts..."
while IFS= read -r sub; do
    if curl -s -o /dev/null -w "%{http_code}" "https://$sub" | grep -qE "^[23]"; then
        echo "[LIVE] https://$sub"
    fi
done < "${DOMAIN}_subs.txt"

Scheduled asset-monitoring via cron (daily diff of newly discovered subdomains):

#!/bin/bash
# amass_monitor.sh
DOMAIN=$1
DATE=$(date +%F)
amass enum -passive -d "$DOMAIN" -o "amass_${DATE}.txt"

PREV=$(ls -t amass_*.txt 2>/dev/null | sed -n 2p)
if [ -n "$PREV" ]; then
    echo "[*] New subdomains since last scan:"
    comm -13 <(sort "$PREV") <(sort "amass_${DATE}.txt")
fi

Tips and Best Practices

Start with -passive mode to stay stealthy and fast; only escalate to -active/-brute once you have explicit authorization for active techniques.
Populate ~/.config/amass/config.ini with API keys for services like SecurityTrails, Censys, and Shodan — passive results improve dramatically with authenticated API access versus free/anonymous rate limits.
Use -src during your first scan of a new target to learn which data sources are most productive for that industry/region.
For very large domains, use -timeout to bound scan duration and avoid runaway scans that could impact shared infrastructure.
Feed Amass output directly into httpx or nmap for the next phase (live host/service detection) rather than manually curating lists.

Troubleshooting

Problem	Cause	Fix
Very few results in passive mode	Missing API keys for premium data sources	Configure `config.ini` with valid API keys for VirusTotal, SecurityTrails, Censys, etc.
Scan runs extremely long / never finishes	Active brute forcing against a domain with wildcard DNS or very large wordlist	Add `-timeout`, reduce wordlist size, or switch back to `-passive`
`-brute` produces many false positives	Wildcard DNS resolution on target domain	Amass has built-in wildcard detection, but verify manually with `dig` on suspicious results
Rate-limited by a data source	Free-tier API limits exceeded	Add paid/authenticated API keys, or exclude that source with `-exclude`
`amass viz` HTML graph is empty/broken	No prior `enum` results stored in the local Amass graph database	Run `amass enum` first (Amass persists prior scan data automatically) before running `viz`

References

Official GitHub repository: https://github.com/owasp-amass/amass
OWASP Amass project page: https://owasp.org/www-project-amass/
Kali Linux tool page: https://www.kali.org/tools/amass/
Amass user guide/wiki: https://github.com/owasp-amass/amass/wiki