OWASP Amass

Overview

OWASP Amass performs attack surface mapping and external asset discovery with open source intelligence and active reconnaissance. This skill covers Amass v5 (v5.1.1 is the latest release checked, April 2026), which is a different tool from v3/v4 in several ways:

• A background engine (REST API on 127.0.0.1:4000) does the work; amass enum starts it automatically if it is not running and talks to it as a client. amass engine runs it by hand.
• enum is passive by default (the -passive flag is deprecated and does nothing). -active adds zone transfer attempts and certificate name grabs.
• Results go to an asset database in the config directory (~/.config/amass on Linux), not to -o/-json files. You read them back with subs, track, viz and assoc.
• The v4 subcommands intel and db and the -json, -o, -asn org lookups of enum/intel are gone. Subcommands now are: enum, subs, track, viz, assoc, engine.

Instructions

Step 1: Install

# Homebrew
brew tap owasp-amass/homebrew-amass && brew install amass