OWASP Amass Tutorial: Subdomain Enumeration for Bug Hunters

Discovering an organization’s internet-facing assets is one of the first steps in a professional security assessment. Before testing a website for vulnerabilities, security researchers need to understand which domains, subdomains, IP addresses, and services belong to the target. This OWASP Amass tutorial explains how to use Amass for subdomain enumeration, DNS analysis, and external attack surface discovery.

OWASP Amass is an open-source project designed to help security professionals map an organization’s externally exposed infrastructure. It combines information from multiple sources and supports different reconnaissance techniques, including passive intelligence gathering and active DNS enumeration. These capabilities make it useful for penetration testers, bug bounty hunters, and security teams responsible for understanding internet-facing assets.

Modern organizations often operate more than a single public website. They may have APIs, cloud applications, staging environments, authentication portals, legacy systems, and services distributed across different providers. Some assets are not linked from the main website, so discovering them requires a structured reconnaissance process.

In this guide, you will learn what Amass does, how to install it, which commands to use, how passive and active enumeration differ, and how to incorporate the results into an authorized penetration-testing workflow.

What Is OWASP Amass?

OWASP Amass is an open-source attack surface mapping and reconnaissance tool. It helps security professionals collect information about domains, subdomains, DNS infrastructure, and related internet-facing assets.

The project provides several command-line subcommands for different tasks. The intel command gathers organizational intelligence, enum performs enumeration and network mapping, viz generates visualizations, track compares enumeration results, and db manages stored findings in versions that support these workflows. <Cite refs={[“turn745436search2″,”turn745436search0”]}/>

For example, an organization might use the following domain structure:

• www.example.com — public website
• api.example.com — API service
• portal.example.com — customer portal
• dev.example.com — development environment
• status.example.com — service status page

Amass can help researchers discover and organize information about these assets.

However, finding a hostname does not prove that it is online, vulnerable, or in scope for a bug bounty program. Each result needs appropriate validation.

Why Is Amass Important for Bug Bounty Hunting?

Subdomain enumeration helps researchers understand the target’s external attack surface before beginning detailed vulnerability testing.

A company may have multiple applications managed by different teams. These applications may use different technologies, authentication mechanisms, DNS providers, and security configurations.

Discovering Hidden Subdomains

A public website might reveal only a few links, while other subdomains exist in DNS records, certificate data, and public intelligence sources.

For example, discovering api.example.com may give a tester a starting point for authorized API security testing. Finding staging.example.com could identify a separate application that deserves review if it is included in the testing scope.

The hostname itself is not a vulnerability. Its value comes from the additional information it provides about the target’s infrastructure.

Mapping External Infrastructure

Amass can help correlate domain names with DNS information, IP addresses, and other infrastructure data.

This is particularly useful for security teams maintaining an asset inventory. An organization cannot reliably protect an exposed service if its security team does not know the service exists.

Identifying Potential Misconfigurations

Enumeration can reveal older hostnames, unexpected services, or DNS records pointing to external platforms.

For example, a hostname associated with a retired cloud service might deserve further investigation. It is only a potential security concern until the DNS configuration and underlying resource are validated.

For additional background on asset discovery, consult the OWASP Web Security Testing Guide.

How Does Amass Work?

Amass combines information gathering, DNS enumeration, and infrastructure mapping.

A typical workflow follows these stages:

1. Input: Specify an authorized root domain or list of domains.
2. Intelligence gathering: Collect available information from supported sources.
3. Enumeration: Discover domain names and related infrastructure.
4. DNS validation: Where the selected mode performs resolution, check whether names resolve.
5. Data storage: Preserve results for later investigation and comparison.
6. Analysis: Review the findings and decide which assets require further testing.

The exact behavior depends on the subcommand, flags, configuration, data sources, and Amass version.

One important distinction is that passive enumeration relies on existing information, while active enumeration can generate direct DNS queries or use other active techniques. Active techniques should be selected according to the assessment’s authorization and rules of engagement.

Installing OWASP Amass on Kali Linux

The recommended installation method depends on the operating system and Amass release you intend to use.

Start with the official OWASP Amass GitHub repository and its release instructions. OWASP also provides an overview of Amass and its use in security testing. <Cite refs={[“turn745436search2″,”turn745436search0”]}/>

Check Whether Amass Is Installed

On Kali Linux, open a terminal and run:

amass -version

If your installed version does not recognize that option, try:

amass -help

You can also check whether the executable is available:

which amass

If the command is missing, install a compatible release using the official installation instructions or your distribution’s package manager where available.

Verify the Command-Line Options

Amass has changed across major versions, so verify the installed version before following a tutorial written for another release.

Run:

amass enum -help

This displays the options supported by your installed enumeration command.

Checking the local help output before running a complex command can save time and prevent confusion caused by outdated examples.

Basic Amass Subdomain Enumeration

The basic enumeration command is:

amass enum -d example.com

Replace example.com with a domain that you are authorized to assess.

The enum subcommand performs enumeration, while -d specifies the target domain.

The results may include names such as:

www.example.com
api.example.com
mail.example.com
docs.example.com
status.example.com

These are illustrative examples, not actual scan results.

The number of discovered subdomains depends on the target, available sources, configuration, and enumeration method.

Save the Results to a File

For a basic text output file, use:

amass enum -d example.com -o amass-results.txt

Saving the results makes it easier to review the findings, compare enumeration runs, and document your reconnaissance process.

Include IP Address Information

You can request IP address information with the -ip option in versions that support it:

amass enum -d example.com -ip

This can help connect discovered hostnames with their resolved addresses.

An IP address may host several domains, and infrastructure providers may serve unrelated customers from shared address ranges. Do not assume that every service on a shared IP belongs to your target.

Passive vs Active Enumeration

Understanding this difference is essential for responsible reconnaissance.

Passive Enumeration

Passive enumeration gathers information from existing data sources rather than deliberately probing every discovered hostname.

In versions that support the -passive flag, you can run:

amass enum -passive -d example.com

Passive mode is useful when you want to collect publicly available information before interacting directly with target infrastructure.

It may be quicker and generate less direct traffic to the target. However, passive results may contain stale or unverified hostnames.

Also, passive enumeration can still involve requests to third-party data providers. It should not be described as completely interaction-free.

Active Enumeration

Active enumeration can involve DNS resolution, brute forcing, and other techniques that interact directly with DNS infrastructure or target services.

For versions supporting the following options, an example is:

amass enum -active -d example.com

The -active option enables specific active reconnaissance methods in versions that support it. It does not necessarily enable every possible enumeration technique.

For example, DNS brute forcing may require the additional -brute option and an appropriate wordlist:

amass enum -brute -w subdomains.txt -d example.com

Use active techniques only when they are permitted by the relevant authorization and testing policy. Always check the help output for the installed version.

Using Amass for Organizational Intelligence

The intel subcommand can help researchers investigate an organization’s internet presence and discover related domain information.

For example:

amass intel -d example.com

Depending on the installed version and configured sources, you may be able to explore additional options involving organization names, autonomous system numbers (ASNs), IP ranges, or reverse WHOIS information.

An ASN identifies a network operated under a particular autonomous system. ASN information can help researchers understand network ownership and relationships, but it does not establish that every associated address is in scope.

For a broader investigation, you may see options such as:

amass intel -help

This is the best place to confirm which intelligence options your version supports.

Enumerating Multiple Domains

Security assessments sometimes cover multiple root domains.

Create a file named domains.txt:

example.com
example.org
example.net

In Amass versions supporting the -df option, you can supply the list:

amass enum -df domains.txt

This allows the tool to process multiple domain inputs without requiring you to type a separate command for every domain.

Before running the enumeration, verify that each domain is explicitly authorized. A shared corporate brand or common ownership does not automatically place every related domain or third-party service within scope.

Using Wordlists for DNS Brute Forcing

A wordlist contains possible hostname labels that a tool can test.

For example, a list might contain:

api
dev
stage
staging
admin
portal
test

These labels represent common naming patterns rather than confirmed subdomains.

Amass versions supporting DNS brute forcing can use a wordlist to test candidate names:

amass enum -brute -w subdomains.txt -d example.com

The tool may discover additional hostnames that do not appear in passive data sources.

However, brute forcing can produce many DNS queries. Keep the wordlist focused, respect resolver limits, and follow the engagement’s testing restrictions.

A large wordlist does not guarantee better results. A carefully chosen list based on the target’s technology and known naming conventions may be more useful.

Understanding Amass Output

Enumeration results are leads that require interpretation.

Consider this illustrative output:

api.example.com
dev.example.com
mail.example.com
portal.example.com

Each hostname suggests a different area for investigation.

• api.example.com may expose API endpoints.
• dev.example.com may host a development application.
• mail.example.com may relate to email infrastructure.
• portal.example.com may provide a user-facing application.

These names do not prove that any service is accessible or vulnerable.

Identify Which Hosts Resolve

A discovered hostname might no longer have a valid DNS record.

Use an appropriate DNS tool to investigate a specific name:

dig api.example.com

Review the DNS response and determine whether the name resolves to an address or points to another resource.

Preserve Useful Evidence

Record the enumeration date, tool version, configuration, data sources, and output file.

This information helps you reproduce the process and distinguish newly discovered assets from results that were already known.

Visualizing the Attack Surface

Amass has supported visualization capabilities that help turn enumeration results into domain and infrastructure relationship graphs.

Depending on your version and stored data, the viz subcommand can produce output for visualization tools or web-based graph views.

Start by checking:

amass viz -help

In versions that support D3.js output, a command may look like:

amass viz -d3 -d example.com

Visualization options and database requirements vary between versions. Follow the documentation that matches your installation.

A graph can help analysts identify clusters of subdomains, infrastructure relationships, and areas where further investigation may be useful.

It is a way to organize information, not proof that two assets share the same owner or security boundary.

Amass vs Other Reconnaissance Tools

Amass is one of several tools that security researchers use to map external assets.

Tool	Primary use
OWASP Amass	Attack surface mapping and domain enumeration
Subfinder	Passive subdomain enumeration
DNS utilities such as dig	DNS record inspection
HTTP probing tools	Identifying responding web services
FFUF	Web content discovery and input fuzzing
Nmap	Authorized port and service scanning

These tools complement one another.

For example, Subfinder may quickly collect passive subdomain results, while Amass can support broader infrastructure mapping and additional enumeration workflows. DNS utilities can validate individual records, and an HTTP probing tool can determine whether an in-scope hostname responds to web requests.

The best choice depends on the assessment’s objectives, constraints, and target environment.

A Practical Amass Workflow for Bug Hunters

Consider an authorized bug bounty assessment for example.com.

The goal is to identify relevant assets without exceeding the program’s scope.

Step 1: Review the Scope

Read the program policy and confirm which domains, IP ranges, and services are included.

Record any excluded infrastructure and restrictions on automation.

Step 2: Start With Passive Enumeration

Where supported by the installed version, run:

amass enum -passive -d example.com -o passive-results.txt

This creates a baseline from available passive information.

Step 3: Review and Organize Results

Inspect the output:

cat passive-results.txt

Remove duplicate entries if necessary and classify the hostnames according to their apparent purpose.

Step 4: Validate DNS Information

Use DNS utilities to check whether important hostnames resolve.

Do not assume that an old record or a missing DNS response automatically indicates a security issue.

Step 5: Perform Approved Active Testing

If the program permits it, use appropriate tools to identify responding web services and examine the applications.

Keep request rates within the stated limits and avoid testing excluded or third-party assets.

Step 6: Investigate and Document Findings

Prioritize assets based on their role, exposure, and relevance to the authorized assessment.

Record the evidence for any potential vulnerability, validate the behavior, and follow the program’s reporting requirements.

For additional “https://vuln.pentesthint.com/” hands-on labs, practice reconnaissance techniques in controlled environments before using them in professional engagements.

Common Amass Mistakes

Assuming Every Result Is Live

Passive sources can contain historical or stale data. Verify the relevant DNS records before treating a hostname as an active service.

Running Brute Force Without Planning

Large wordlists can generate substantial DNS traffic. Choose suitable inputs and use only the methods permitted by the assessment.

Ignoring Version Differences

Command-line options can differ across major releases. Use the help output and official documentation for your installed version.

Treating Discovery as a Vulnerability

A hostname, IP address, or DNS record is not automatically a security finding. Investigate the underlying behavior before making a claim.

Ignoring Scope Restrictions

Do not test unrelated domains simply because they appear in enumeration results. Confirm authorization before active follow-up testing.

Failing to Save Results

Without saved outputs and notes, it becomes harder to reproduce scans, compare changes, or explain the methodology in a report.

Best Practices for Professional Reconnaissance

A reliable Amass workflow should follow several principles:

• Begin with a clearly defined scope.
• Use passive enumeration when appropriate.
• Configure data sources carefully.
• Keep API credentials private.
• Use targeted wordlists for active enumeration.
• Respect DNS resolver limits and testing restrictions.
• Preserve logs and output files.
• Validate DNS and service availability independently.
• Investigate potential findings manually.
• Report evidence accurately without exaggerating impact.

Professional reconnaissance is not a race to collect the largest possible list. It is the process of building a useful, accurate picture of the target’s externally exposed assets.

Learning Amass for a Cybersecurity Career

Amass is useful for penetration testers, bug bounty hunters, security analysts, and attack surface management teams.

To use it effectively, build a foundation in:

1. DNS records and resolution.
2. Domain names and subdomain structures.
3. HTTP, HTTPS, and TLS certificates.
4. Linux command-line tools.
5. Passive and active reconnaissance.
6. Cloud infrastructure fundamentals.
7. Vulnerability validation and reporting.
8. Rules of engagement and responsible testing.

If you want to strengthen these skills, explore “https://academy.pentesthint.com/” practical cyber security learning and use authorized labs to apply what you learn.

The long-term goal is to understand why an asset matters, not just which command discovered it.

FAQs

What is OWASP Amass used for?

OWASP Amass is used for external attack surface mapping, subdomain enumeration, DNS analysis, and organizational reconnaissance. It helps security teams identify and organize information about internet-facing assets.

Is Amass free to use?

Amass is an open-source project. However, some external data sources may require API credentials or separate subscriptions, depending on the provider and configuration.

What is the basic Amass command?

A basic enumeration command is:

amass enum -d example.com

Replace the example domain with a domain you are authorized to assess. Check the installed version’s help output for supported options.

What is the difference between passive and active enumeration in Amass?

Passive enumeration gathers existing information from supported sources. Active enumeration can perform direct DNS queries and other interactions to discover or validate assets. The appropriate mode depends on the assessment’s authorization and objectives.

Can Amass find all subdomains?

No. Results depend on the data sources, configuration, target, and techniques used. No single enumeration tool guarantees a complete inventory of every subdomain.

Is Amass available on Kali Linux?

Amass may be available through Kali’s package repositories, depending on the distribution version. Check the installed package availability and the official Amass installation instructions before choosing an installation method.

What is the difference between Amass and Subfinder?

Subfinder focuses on passive subdomain enumeration. Amass supports a broader attack surface mapping workflow, including organizational intelligence, enumeration, and visualization capabilities. Their features can overlap, and the best tool depends on the task.

Can I use Amass for bug bounty hunting?

Yes, when you use it within the program’s authorized scope and follow its rules. Review restrictions on automation and active reconnaissance before running enumeration techniques that generate direct traffic.

Conclusion

OWASP Amass is a valuable tool for understanding an organization’s external attack surface. It can help researchers collect subdomain information, investigate DNS infrastructure, map relationships between assets, and organize results for further analysis.

The key is to combine enumeration with validation. Use passive techniques to build an initial picture, choose active methods carefully, verify relevant hostnames, and investigate potential weaknesses before reporting them.

Remember the basic workflow: discover, organize, validate, investigate, and document.

To continue learning penetration testing and reconnaissance, visit “https://pentesthint.com/” PentestHint and explore its cybersecurity resources. Consistent practice in authorized environments will help you turn enumeration results into meaningful security assessments.