OWASP Amass: Map an Organisation's Attack Surface (GitHub, Scanned)

Amass maps what an organisation exposes on the internet. Give it a root domain and it pulls names from certificate transparency logs, passive DNS services, web archives, search engines and dozens of keyed APIs, resolves them, and follows the links outward: from subdomains to IP addresses, netblocks, autonomous systems, TLS certificates, WHOIS and RDAP records and the companies behind them. Everything lands in an asset database (SQLite by default, PostgreSQL or Neo4j for bigger jobs) using the Open Asset Model, so later commands can list subdomains, show associations, track what changed between runs or export a graph.

It goes deeper than single-purpose subdomain finders, at the price of being heavier. Version 5 splits the work into a collection engine and small client commands: amass enum starts the engine in the background, and amass subs, assoc, track and viz read the results. Passive collection is the default; zone-transfer attempts, certificate grabs and DNS brute forcing are opt-in flags.

Amass is an OWASP Flagship project, started by Jeff Foley in 2017 and Apache 2.0 licensed (GitHub shows the licence as Other because a copyright line sits above the Apache text). It has about 15,400 stars, 75 contributors and 22 releases, and v5.1.3 shipped on 25 October 2026, the same day as the last push.

• Repository: github.com/owasp-amass/amass
• Licence: custom (Other)
• Language: Go. Stars: 15.4K. Forks: 2,202. Last push: Oct 25, 2026.
• Scan: safe, Oct 28, 2026, commit a284d25

Who it is for

Security teams and consultants building an inventory of their own or a client's external assets, bug bounty hunters working inside a programme's published scope, and researchers who want recon results in a database they can query rather than a text file.

Getting started

1. Install with Homebrew (or go install github.com/owasp-amass/amass/v5/cmd/amass@main, or the owaspamass/amass Docker image)

brew tap owasp-amass/homebrew-amass && brew install amass

2. Run a passive enumeration of a domain you are authorised to map

amass enum -d example.com

3. List the subdomains it found from the asset database

amass subs -names -d example.com

Many data sources only return results with API keys, set in datasources.yaml in the Amass config folder. The -active and -brute flags send traffic to the target's own name servers and hosts, so use them only with permission. The engine that amass enum starts keeps running in the background and listens on port 4000.

Safety scan

We cloned owasp-amass/amass at commit a284d25 on Oct 28, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets, no pattern hits, no install hooks and no committed binaries across 224 files and about 37,000 lines of Go. The network hosts the scan lists are the data sources themselves: crt.sh, the Wayback Machine, HackerTarget, SecurityTrails, VirusTotal, GLEIF, RDAP and others.
• The engine's HTTP API (engine/api/server/server.go) binds to :4000, meaning all interfaces, and has no authentication: anyone who can reach that port can list sessions, read their logs and start enumerations that use your API keys. The client talks to 127.0.0.1, so on a laptop on a shared network, block port 4000 or stop the engine when you are done.
• Three plugins go beyond infrastructure: Hunter.io and Prospeo look up email addresses at a domain, and Aviato lists a company's employees. Each runs only with that service's API key in your config, but it is worth knowing an organisation map can include people, which brings privacy obligations.
• go.mod has 92 packages and 4 known advisories, none rated critical or high: an edwards25519 edge case, two golang.org/x/net HTML parser issues and the deprecated openpgp package in golang.org/x/crypto. All are indirect and none sits on a path an attacker controls in normal use.
• Four workflows, none using pull_request_target; the 7 third-party action uses are pinned to tags, not commits. Licence and contributing guide present, but no security policy, Dependabot or CodeQL, which is part of why its OpenSSF Scorecard is a low 3.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Go 36K, YAML 1,131, Markdown 77, HTML 48.

Questions

Is OWASP Amass free?

Yes. Amass is Apache 2.0 licensed and free for any use, commercial included. Many of the data sources it queries are paid or have free tiers with low limits, so the depth of results depends on which API keys you add.

Is it legal to run Amass against a domain?

Passive mode only reads public records about a domain, much like searching certificate logs yourself, but mapping an organisation you have no relationship with can still breach a bug bounty programme's rules or a contract. Active and brute-force modes contact the target's systems directly: use them on your own assets or with written permission. Results that include people's names or emails fall under data protection law.

How is Amass different from subfinder?

subfinder does one job, fast: it asks passive sources for subdomains and prints them. Amass builds a graph of an organisation, linking names to IPs, netblocks, ASNs, certificates and companies, stores it in a database and can track changes over time. Many people run subfinder for speed and Amass when they need the wider picture.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.