OWASP Amass

The subs command is used to analyze and present discovered subdomains and associated data from the Amass graph database. It allows you to filter by domain, view IP addresses (IPv4/IPv6), and generate ASN (Autonomous System Number) summaries.

Key capabilities include:

• Listing discovered names.
• Showing associated IP addresses.
• Providing an ASN table summary.
• Outputting results to a file or terminal.
• Using a configuration file or directory to define scope and database location.

The Amass engine determines its logging destination based on the provided flags and environment:

1. Explicit Log Directory: If the --log-dir flag is provided, the engine creates a file logger in that directory using a filename format of amass_engine_YYYY-MM-DDTHH:MM:SS.log.
2. Syslog: If no directory is specified, the engine attempts to use a Syslog logger.
3. Default Output Directory: If Syslog is unavailable, the engine falls back to the directory defined by the config.OutputDirectory setting, creating a file logger there.
4. Stdout: If all other methods fail, the engine defaults to a text-based logger writing to os.Stdout.

The oam_i2y component is a utility designed to migrate legacy Amass INI configuration files into the modern YAML format. It parses an existing INI file and generates two separate YAML files: a main configuration file and a data sources file.

To use this tool, you must provide the path to your existing INI file using the -ini flag. You can optionally specify the output filenames for the resulting YAML files.

# Basic usage (uses default filenames oam_config.yaml and oam_datasources.yaml)
./oam_i2y -ini path/to/your_config.ini

# Custom output filenames
./oam_i2y -ini path/to/your_config.ini -cf custom_config.yaml -df custom_datasources.yaml

The viz command analyzes Open Asset Management (OAM) data to generate graph visualizations in various formats. You must specify at least one output format and at least one root domain.

Usage Pattern: -d3|-dot|-gexf [options] -d domain

Core Requirements:

• You must select at least one output format: -d3, -dot, or -gexf.
• You must provide at least one domain using -d or via a domain file using -df.

# Example: Generate a D3 HTML visualization for a domain
amass viz -d3 -d example.com

# Example: Generate DOT and GEXF files for multiple domains using a file
amass viz -dot -gexf -df domains.txt -o ./output_dir

Amass is a command-line tool for attack surface mapping and asset discovery. It operates using a subcommand-based architecture. The general syntax is:

amass [options] [subcommand] [subcommand-options]

Global Flags

• -h, --help: Show the program usage message and available subcommands.
• --version: Print the Amass version number.

Available Subcommands

Each subcommand performs a specific part of the discovery workflow:

• assoc: Association-based discovery.
• engine: Manage the Amass engine.
• enum: Perform enumeration (requires the engine to be running).
• subs: Subdomain discovery.
• track: Track changes in the asset landscape.
• viz: Visualization of discovered assets.

amass [assoc|engine|enum|subs|track|viz] [options]

The track command analyzes Open Asset Model (OAM) data stored in a graph database to identify assets that have been newly discovered for specific domains. It can filter results based on a timestamp to focus on recent changes.

Usage Pattern: track [options] [-since 'MM/DD HH:MM:SS YYYY TZ'] -d domain

Time Format: When using the -since flag, use the format: 01/02 15:04:05 2006 MST (e.g., 04/06 12:00:00 2026 UTC).

# Example: Track new assets for example.com discovered since April 6th, 2026
track -d example.com -since '04/06 00:00:00 2026 UTC'

Amass uses .ini files to manage complex configurations such as scope, data sources, credentials, and graph databases. The Config.LoadSettings(path string) method parses these files. The parser is case-insensitive and supports shadowed keys (where multiple keys with the same name can be provided to create a list).

Key operational modes can be set in the default section using the mode key:

• passive: Only access data sources for names and return results.
• active: Enables active enumeration techniques like zone transfers.

// Example of how the configuration is loaded in code
err := config.LoadSettings("config.ini")

If you encounter issues with installation or usage, the recommended way to get help is by joining the official Discord server.

Note: Do not open GitHub issues for support requests or general questions.

DNS resolvers used for enumeration are defined in the [resolvers] section. Use the resolver key to provide a list of DNS server addresses.

Example Structure:

[resolvers]
resolver = 8.8.8.8
resolver = 1.1.1.1