The Amass tool performs scraping of data sources, recursive brute forcing, crawling of web archives, permuting and altering of names and reverse DNS sweeping to obtain additional subdomain names. Additionally, Amass uses the IP addresses obtained during resolution to discover associated netblocks and ASNs. All the information is then used to build maps of the target networks.
How to Install
Prebuilt
A precompiled version is available for each release.
If your operating environment supports Snap, you can click here to install, or perform the following from the command-line:
$ sudo snap install amass$ sudo snap install --edge amassFrom Source
If you would prefer to build your own binary from the latest version of the source code, make sure you have a correctly configured Go >= 1.10 environment. More information about how to achieve this can be found on the golang website. Then, take the following steps:
- Download amass:
$ go get -u github.com/caffix/amass- Several wordlists can be found in the following directory:
$ ls $GOPATH/src/github.com/caffix/amass/wordlists/Using the Tool
The most basic use of the tool, which includes reverse DNS lookups and name alterations:
$ amass -d example.com$ amass -d example1.com,example2.com -d example3.com$ amass -nodns -d example.com$ amass -df domains.txt$ amass -v -ip -brute -min-for-recursive 3 -d example.com
[Google] www.example.com
[VirusTotal] ns.example.com
...
13139 names discovered - archive: 171, cert: 2671, scrape: 6290, brute: 991, dns: 250, alt: 2766$ amass -ip -d example.com$ amass -ip -o out.txt -d example.com$ amass -log amass.log -d example.com$ amass -json out.txt -d example.com$ amass -visjs vis.html -d example.com$ amass -graphistry network.json -d example.com$ amass -gephi network.gexf -d example.com$ amass -v -ip -oA amass_scan -d example.com$ amass -neo4j neo4j:DoNotUseThisPassword@localhost:7687 -d example.com$ amass -v -d example.com -r 8.8.8.8,1.1.1.1$ amass -v -d example.com -rf data/resolvers.txt$ amass -bl blah.example.com -d example.com$ amass -blf data/blacklist.txt -d example.com$ amass -noalts -d example.com$ amass -active -d example.com net -p 80,443,8080Have amass perform brute force subdomain enumeration as well:
$ amass -brute -d example.com$ amass -brute -norecursive -d example.com$ amass -brute -min-for-recursive 3 -d example.com$ amass -brute -w wordlist.txt -d example.com$ amass -freq 120 -d example.com$ amass -whois -d example.com$ amass -whois -l -d example.comNetwork/Infrastructure Options
Caution: If you use these options, amass will attempt to reach out to every IP address within the identified infrastructure and obtain names from TLS certificates. This is "loud" and can reveal your reconnaissance activities to the organization being investigated.
All the flags shown here require the 'net' subcommand to be specified first.
To discover all domains hosted within target ASNs, use the following option:
$ amass net -asn 13374,14618$ amass net -cidr 192.184.113.0/24,104.154.0.0/15$ amass net -addr 192.168.1.44,192.168.2.1-64$ amass net -cidr 192.168.1.0/24 -p 80,443,8080Integrating Amass into Your Work
If you are using the amass package within your own Go code, be sure to properly seed the default pseudo-random number generator:
import(
"fmt"
"math/rand"
"time"
"github.com/caffix/amass/amass"
)
func main() {
output := make(chan *amass.AmassOutput)
go func() {
for result := range output {
fmt.Println(result.Name)
}
}()
// Seed the default pseudo-random number generator
rand.Seed(time.Now().UTC().UnixNano())
// Setup the most basic amass configuration
config := amass.CustomConfig(&amass.AmassConfig{Output: output})
config.AddDomains([]string{"example.com"})
// Begin the enumeration process
amass.StartEnumeration(config)
}Settings for the Amass Maltego Local Transform
- Setup a new local transform within Maltego:
- Configure the local transform to properly execute the go program:
- Go into the Transform Manager, and disable the debug info option:
