R-AMA
Amass
Attack-surface mapping and discovery of domains, ASNs, and infrastructure.
OVERVIEW
Amass combines passive sources (certificate transparency, search engines, third-party APIs) with active DNS resolution to build a map of subdomains, IPs, and ASNs tied to an organization.
The intel mode also runs the process in reverse: starting from an IP, ASN, or org name, it helps surface related domains that may not have been in the originally documented scope.
USE CASES
Practical use cases
- 01
Initial subdomain discovery before web testing starts.
- 02
Mapping ASNs and third-party infrastructure tied to the target.
- 03
Expanding the documented scope with assets the client didn't list.
- 04
Building the base host list to hand off to web enumeration tools.
QUICK START
When scope is a domain or organization and you need a passive/active inventory before touching applications.
- Run passive mode first so you don't generate active traffic against third parties.
- Review the results and confirm which subdomains are actually in scope.
- If scope allows, run active mode with your own resolvers to confirm liveness.
- Export the final list as input for Gobuster, Nuclei, or other tools.
root@itspentest:~# amass enum -passive -d target.com -o subdomains.txtBEFORE YOU RUN IT
What to check before running it
Active mode generates real network traffic against third-party infrastructure — stay within the signed scope.
Many passive sources need your own API keys for full coverage; without them results are partial.
Discovered ASNs may belong to shared cloud providers, not just the client — verify ownership before scanning.