AMASS

OWASP Amass is an open-source, versatile Attack Surface Intelligence platform designed to comprehensively map an organization’s footprint. Built for flexibility and depth, Amass combines advanced data collection, network mapping, and OSINT capabilities to deliver detailed insights into physical and digital assets.

Overview

Amass extends far beyond basic subdomain enumeration, offering a comprehensive, automated approach to information gathering that reveals the full scope of an organization’s infrastructure. Since the initial release, AMASS supports and promotes the Open Asset Model (OAM), which you can learn about on this Phillip Wylie Show episode.

Key Value
Name AMASS
Project URL https://owasp.org/www-project-amass/
Source Repos https://github.com/owasp-amass/
Documentation https://owasp-amass.github.io/docs/
Author Jeff Foley, #OWASP
Category #osint, #software

Description

Documentation

Components

Setup

Running AMASS in Docker

Docker complexities

While AMASS runs fine in a docker container and this can be used for a “cleaner” or maybe more portable usage, Docker adds some complexities in terms of volume mapping for the configuration and database storage locations.

AMASS runs in a single docker container.

  1. OLD WAY Pull the Docker image by ~~running `docker pull caffix/amass:latest
  2. NEW Amass now maintains Dockerfile and docker compose methods for operating with Docker, so use this from the official repositories

Configuration

The configuration file is used to store common settings, defaults, and API keys.

Wordlists

Wordlists are used for efficient subdomain enumeration

Updating

Docker

You have one of two options:
3. Use the official docker image and update it with
docker pull caffix/amass:latest
4. Pull the latest files from the GitHub repository and build the image yourself with docker build . inside the repo

Kali

Amass is installed via apt on #Kali. Since Kali is a rolling distro, use apt update && apt upgrade to install new versions.

Detailed information about the currently-installed version can be viewed with apt info amass. See an example in the examples folder of the Amass repository.

Using Snapd

1. sudo apt install snapd
Once that is done then you will check to see if the snapd service is running :

  1. Start the snapd service
  2. service snapd start

Now install using snap
sudo snap install

When executing, make sure to use the snap environment
/snap/bin/

Configuration

Prior to version 4.x, Amass used/supported an .ini file. For versions 4 and later, the tool's configuration file has moved to a #YAML format for the configuration. If you have an older Amass configuration, use the oam_i2y tool to convert the .ini to .yml.

Usage

Running via Docker
3. Run docker run -v OUTPUT_DIR_PATH:/.config/amass/ caffix/amass enum -d example.com

Tips and tricks

Getting Started

Examples

amass -dir ~/Documents/amass -config ~/.config/amass/amass.ini -w l /usr/share/wordlists/amass/subdomains-top1mil-20000.txt -d example.com

Docker with custom config file and wordlists on host
docker run -it --rm -v /home/ktneely/Nextcloud/Documents/Investigations/amass/:/.config/amass -v /home/ktneely/dev/amass/examples/wordlists/:/usr/share/amass/wordlists/ amass:latest enum -config /.config/amass/amass.ini -d siliconvalleybank.xyz

No docker custom config and data directory
amass enum -config /mnt/c/Users/ktnee/Nextcloud/Documents/Investigations/2023-03-13-SVB/amass.ini -dir /mnt/c/Users/ktnee/Nextcloud/Documents/Investigations/2023-03-13-SVB/ -rqps 5 -dns-qps 160 -exclude CommonCrawl,BufferOver -df /mnt/c/Users/ktnee/Nextcloud/Documents/Investigations/2023-03-13-SVB/svb-domains.list

amass enum -dir /mnt/c/Users/ktnee/Nextcloud/Documents/Investigations/2023-03-13-SVB/ -brute -w /usr/share/wordlists/amass/fierce_hostlist.txt -rqps 5 -dns-qps 160 -exclude CommonCrawl,BufferOver -df /mnt/c/Users/ktnee/Nextcloud/Documents/Investigations/2023-03-13-SVB/svb-domains.list

How Amass fits in an Intel workflow

Use-case 1: Research an organization

Amass lets you start from scratch. Really from scratch, allowing the researcher to simply enter the organization's name on the command line. The intel subcommand enables the researcher to quickly broaden their investigation surface area.

amass intel -config ~/.config/amass/amass.ini -org uber

Use-case 2: Research an interesting domain for other uses

While ressearching, the analyst may want to understand the breadth of use for a domain of interest.

Note: Data locations

By default, Amass data is stored in ~/.config/amass.

  • Use -dir /pathto/directory to specify a specific location for this search when using a local install
  • Use volume redirects -v to specify a local directory on your host for use by the container
  1. Generate some intel about the domain
    amass intel -config ~/.config/amass/amass.ini -d example.com
  2. Run the domain through Amass' enum function
    amass enum -config ~/.config/amass/amass.ini -d example.com
  3. Review the results
    • Local install: amass db -config ~/.config/amass/amass.ini -d example.com -show
    • Docker
  4. Print out all the discovered FQDNs related to the domain of interest
    • Local install:
    • Docker: docker run -it --rm -v ~/Documents/Investigations/amass/:/.config/amass -v ~/home/ktneely~/dev/amass/examples/wordlists/:/usr/share/amass/wordlists/ caffix/amass:latest db -config /.config/amass/amass.ini -d siliconvalleybank.xyz -names
Note: Formatting Output

use -nocolor to print results without formatting so they can be piped to other tools

Use-case 3: Run discovered domains through Nuclei

Todo

incorporate httprobe into this workflow
REQUIREMENT: install httprobe with sudo apt install httprobe

  1. Perform the steps in Use-case 2
  2. Save the names to a file
    amass db -config ~/.config/amass/amass.ini -d example.com -names -nocolor > sites.lst
  3. Run Nuclei against the list of FQDNs
    nuclei --tags tech,takeovery

Reference Articles