Amass

OWASP attack surface mapper — thorough subdomain enumeration via 50+ passive + active sources.

Quick Start

# Passive enumeration (no direct target interaction)
amass enum -passive -d target.com

# Active enumeration (DNS brute force + zone transfer attempts)
amass enum -active -d target.com -brute

# Save results
amass enum -d target.com -o subdomains.txt

# Full enumeration with output files
amass enum -d target.com -brute -o subs.txt -oA results/amass