Amass
Recon / OSINT · Intermediate
Map an organization's external attack surface via subdomain enumeration.
Knowledge reference only. Prefer in-browser Labs first. Use this tool only on systems you own or have written authorization to test.
What to learn
- Passive vs active
- Data sources
- Graph output
Legitimate use
Amass is used legitimately by security teams for authorized testing, defense validation and education.
Official docs →Example commands (lab VMs only)
- amass enum -passive -d example.comPassive enumeration of a domain you are authorized to assess