Amass

Introduction

Amass is an open-source reconnaissance tool that helps collect information on a target. It focuses on domain information gathering and network mapping to identify potential vulnerabilities. Amass can be used in various contexts such as cybersecurity research, network security assessment, and business risk management.

In this blog, we will discuss how to install and use Amass.

Installing Amass

Amass can be installed on different platforms such as Linux, macOS, and Windows. Here’s how to install Amass on Linux:

1. Download the latest Amass release from the official website.
2. Extract the downloaded package to a directory of your choice.
3. Open the terminal and navigate to the extracted directory.
4. Run the following command to install Amass:

sudo ./amass_linux_amd64 -version

If the installation is successful, you should see the version of Amass installed.

Using Amass

Now that you have installed Amass, let’s see how to use it.

1. Enumerating subdomains: Amass can be used to enumerate subdomains of a domain. To do this, run the following command:

amass enum -d example.com

This command will scan the subdomains of example.com and display the results on the terminal.

2. Gathering information from other sources: Amass can also gather information from other sources such as certificate transparency logs and web archives. To do this, use the appropriate flags with the amass enum command. For example, to gather information from certificate transparency logs, run the following command:

amass enum -d example.com -active -brute -w /path/to/wordlist -sources crtsh

This command will use brute force to discover active subdomains of example.com and gather information from crt.sh.

3. Outputting results: By default, Amass outputs results to the terminal. However, you can also output the results to a file using the -o flag. For example, to output the results to a CSV file, run the following command

amass enum -d example.com -o results.csv

Conclusion

Amass is a powerful reconnaissance tool that can be used to gather information on a target. It supports various sources of information such as DNS, whois, SSL/TLS certificates, and web pages. With Amass, you can easily enumerate subdomains and map network activity to identify potential vulnerabilities. By following the steps outlined in this blog, you should now be able to install and use Amass to improve your cybersecurity research and network security assessment efforts.