Recon
OWASP Amass
Attack-surface mapper for subdomain enumeration, ASN mapping, and OSINT on in-scope domains.
What it is
Amass combines passive sources and optional active enumeration to build a picture of domains, names, and infrastructure. Prefer passive mode first on client brands; switch to active only when the RoE allows DNS queries against production name servers.
Reach for it when
External or web kickoff when the client has given apex domains and you need a defensible inventory before scanning.
Watch-outs
Active brute-forcing can generate noisy DNS and hit rate limits at registrars. Stay inside named domains; do not walk to acquisitions or customers unless they are in the RoE. Store results as engagement evidence, not in a personal cloud.
Typical invocation
amass enum -passive -d northwindhealth.example -o recon/amass.txt
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- subfinder
Passive subdomain discovery from OSINT sources for in-scope apex domains.
- httpx
HTTP probe to confirm live web services, titles, status codes, and tech from a host list.
- Shodan
Internet-wide service search for banners, certs, and known exposures on in-scope IPs and orgs.
- katana
Crawler for JavaScript-heavy web apps and APIs to build an authorized URL inventory.