Amass

Amass is a comprehensive open-source subdomain enumeration and network mapping tool developed by OWASP. It uses a combination of passive data collection from public sources and active DNS techniques to discover an organization's attack surface. As of 2026, the project has reached version 5.1.1, which introduced a new Asset Database with schema changes impacting performance, a restructured client-engine architecture allowing the engine to run as a detached service, and a completed engine REST API. The platform integrates with over 50 data sources for information gathering, including APIs such as Shodan, VirusTotal, SecurityTrails, Censys, and BinaryEdge, along with certificate transparency logs, DNS databases, routing data, web archives, and WHOIS records. Amass supports passive enumeration without direct target interaction, active DNS resolution and zone transfer attempts, and DNS brute-forcing with custom wordlists. The intel subcommand gathers organizational intelligence including ASN, CIDR blocks, and root domains, while visualization capabilities generate interactive graphs for stakeholder communication. Amass v5 removed several user-facing commands including db, track, and viz from the core binary, shifting the expectation toward direct interaction with the asset database and custom scripting for monitoring and integration. The tool supports multiple output formats including plain text, JSON, and all-format output for integration with tools like Nmap, Burp, and Masscan. Real-world applications include bug bounty reconnaissance for discovering forgotten subdomains and staging environments, red team engagements for mapping external presence before exploitation, and defensive security for identifying rogue or outdated infrastructure. Amass is significantly slower than alternatives like Subfinder but provides more thorough coverage through active techniques.