PAGES
← all tools
◆ Reconnaissance & OSINT

amass

v5.1.1 open-source

1 more tool, grouped by what they do.

Software Supply Chain Security

OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Amass performs network mapping of attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. and external asset discovery using open source information gathering and active reconnaissance techniques.

source ↗ website ↗ rss ↗ What is a cyber toolchain?

Summary

amass is an open-source reconnaissance command-line tool that maps attack surfaces and discovers external assets using both open-source information gathering and active techniques like DNS and WHOIS lookups. It runs from the command line, or as separate engine and CLI binaries, with a Docker image bundling everything, so it fits into scripted recon pipelines rather than requiring a hosted console. It is aimed at red teamers, penetration testers, and bug bounty hunters who need to enumerate subdomains and related domains before deeper testing, and it sits in the attack-surface management and OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. space alongside other subdomain enumeration tools, without the README naming a specific rival. As an OWASP flagship project first committed in 2017, it remains active, with 79 contributors, 318 commits in the past year, and a release 136 days ago.

OWASP Amass performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques.

How amass helps

Which subdomains and hosts belong to a target I'm about to test?

runs open-source information gathering and active DNS lookups against a domain and returns the subdomains and hosts it can confirm are tied to it

Which parts of my discovered attack surface trace back to the same organization?

groups discovered assets by organization during the discovery process, deduplicating entries so shared infrastructure isn't listed as separate unrelated targets

Which other domains are connected to a target through registration data?

performs WHOIS lookups to surface related domains sharing registration details, without sending traffic to the target's live infrastructure

Can I map a target's surface without touching its infrastructure directly?

offers a passive-only mode that relies purely on OSINT sources, so no active DNS or network probing reaches the target during enumeration

Which live services on discovered hosts can I fingerprint before deeper testing?

applies JARM fingerprinting during reconnaissance so TLS-service fingerprints are attached to discovered hosts for later correlation

Is a scan's discovery quietly following leads outside the domain I gave it?

applies scope expansion rules by default to pull in related assets, and a rigid mode is available when the answer needs to stay confined to the exact scope given

all 8 features, with the evidence for each →

Languages

Not documented

Features

8 capabilities across 3 capability groups · 1 backed by code, an API document or a real run

Built from amass's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • amass covers 3 of the 13 network discovery and scanning capabilities we track.

What amass offers you

  • Command-line interface1
Subdomain enumeration 2 features Network discovery and scanning since 2022
Subdomain enumeration shipped Enumerates subdomains for a given domain. 12 releases · 2 other sources · first seen Apr 2022

Shared capability: Subdomain enumeration

release 12 total

docs

  • Performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques.

example

  • Enumerate subdomains for a domain amass enum -d example.com
Passive-only OSINT mode verified Restricts enumeration to passive OSINT sources, with an option to disable automatic scope expansion. 2 releases · 2 other sources · first seen Mar 2023

Shared capability: Subdomain enumeration

Also counts toward: Command-line interface

release

  • Enhanced dynamic scope expansion rules for broader, more accurate target coverage. v5.1.1 · Apr 2026 · source · release history
  • The Google Certificate Transparency data source integration is removed. v3.22.0 · Mar 2023 · source · release history

command line

example

  • Passive-only OSINT enumeration amass enum -passive -d example.com
Attack surface inventory 2 features Network discovery and scanning since 2022
Search-based asset discovery shipped Discovers assets using search engine data sources. 5 releases · first seen Sep 2022

Shared capability: Attack surface inventory

release

Related domain discovery via WHOIS shipped Discovers related domains by querying WHOIS data. 2 releases · 1 other source · first seen Sep 2022

Shared capability: Attack surface inventory

release

example

  • Discover related domains via WHOIS amass intel -d example.com -whois
Service and version detection 1 feature Network discovery and scanning since 2025
JARM fingerprinting shipped Collects JARM fingerprints for discovered assets to identify SSL/TLS stack configurations. 1 release · first seen Aug 2025

Shared capability: Service and version detection

release

Other / not yet classified 3 features Features we have not matched to a capability yet. A suggested match is marked.
Direct data persistence shipped suggested Writes discovered assets directly to the data store. 6 releases · first seen Mar 2023

Suggested capability: Attack surface inventory. This is our guess, not confirmed.

release

  • Dispatcher now has a durable backlog plus a bounded in-memory work queue, preventing job loss under load. v5.1.1 · Apr 2026 · source · release history
  • Uses the new Asset Database schema (asset-db v0.24.4) with schema changes that impact performance; existing databases may require migration. v5.1.1 · Apr 2026 · source · release history
  • Updated asset-db to v0.24.4 with schema changes that improve database performance. v5.1.1 · Apr 2026 · source · release history
  • Adds database caching layer (asset-db cache) to speed up asset association lookups. v5.0.0 · Aug 2025 · source · release history
  • New assoc tool now uses database caching for association queries. v5.0.0 · Aug 2025 · source · release history
  • Writes discoveries directly to the data store. v3.22.0 · Mar 2023 · source · release history
Organization enrichment via GLEIF and Aviato shipped suggested Enriches discovered assets with organization data using GLEIF fuzzy completion and Aviato plugin handlers. 3 releases · first seen Aug 2025

Suggested capability: Attack surface inventory. This is our guess, not confirmed.

release

  • Updated HTTP probe transport for improved network reconnaissance handling. v5.1.1 · Apr 2026 · source · release history
  • Updates GLEIF fuzzy completions API usage for organization enrichment. v5.0.0 · Aug 2025 · source · release history
  • Adds Aviato plugin handler for company enrichment. v5.0.0 · Aug 2025 · source · release history
Data source capability checking shipped Enables conditional logic based on the requests supported by specific data sources. 1 release · first seen May 2023

release

  • data sources can now be checked for requests they support, enabling conditional logic based on data source capabilities. v3.23.2 · May 2023 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for amass, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail amass puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Website history

dependencytrack.org, every change

OWASP's home page and 2 more pages as they looked each month from August 2021 to October 2026: 15 renders, 0 changes of tagline or palette. Step through them, play them, or put any two months side by side.

Website history is included with Researcher and Business.

See plans →

Releases

Show

6 entries

  1. April 20261
  3. August 20251
  5. May 20231
  7. March 20231
  9. September 20221
  11. April 20221
    Show

    6 entries

    1. v5.1.1 Apr 7, 2026 · release notes

      Amass v5.1.1 ships a new engine REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. server, durable dispatcher backlog, and asset-db schema improvements for better performance.

      └──▷ GET THIS VERSION 
      $ git clone --branch v5.1.1 https://github.com/OWASP/Amass.git
# already have the repo? check out this version:
$ git checkout v5.1.1
      • Dispatcher now has a durable backlog plus a bounded in-memory work queue, preventing job loss under load.
      • Enhanced dynamic scope expansion rules for broader, more accurate target coverage.
      • Updated asset-db to v0.24.4 with schema changes that improve database performance.
      • Updated HTTP probe transport for improved network reconnaissance handling.

      4 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !Uses the new Asset Database schema (asset-db v0.24.4) with schema changes that impact performance; existing databases may require migration.
    2. v5.0.0 Aug 3, 2025 · release notes

      Amass v5 overhauls the architecture: new engine binary, SQLite-backed session queue, database caching, and Docker image ships all executables.

      └──▷ GET THIS VERSION 
      $ git clone --branch v5.0.0 https://github.com/OWASP/Amass.git
# already have the repo? check out this version:
$ git checkout v5.0.0
      • Adds a standalone engine binary (engine) as a separate executable alongside the main amass CLI.
      • Implements SQLite-backed session entity queue for improved enumeration state management.
      • Adds database caching layer (asset-db cache) to speed up asset association lookups.
      • Docker image now ships all project executables, including the engine binary.
      • New assoc tool now uses database caching for association queries.
      +8 more show less
      • Updates enum subcommand to produce structured logs.
      • Adds Organization deduplication during discovery.
      • Adds support for regex value matching in triples.
      • Adds JARM fingerprinting implementation.
      • Updates GLEIF fuzzy completions API usage for organization enrichment.
      • Adds Aviato plugin handler for company enrichment.
      • New DNS TXTDNS TXTA DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. record service discovery handler and plugin.
      • Supports OAM v0.14 and asset-db v0.19 data model and schema.

      13 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !The subs and emails subcommands have been removed.
      • !The embedded collection engine has been removed; the engine now runs as a separate binary.
      • !The enum subcommand has been separated into its own client subcommand.
      • !Syslogd support has been removed.
    3. v3.23.2 May 9, 2023 · release notes

      Amass v3.23.2 switches enumeration graph storage to in-memory DB and adds source request capability checks

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.23.2 https://github.com/OWASP/Amass.git
# already have the repo? check out this version:
$ git checkout v3.23.2
      • enumerations use the in-memory graph database for faster processing by eliminating disk-based graph storage during runs.
      • data sources can now be checked for requests they support, enabling conditional logic based on data source capabilities.

      2 details in Everything

    4. v3.22.0 Mar 8, 2023 · release notes

      Adds grep.app search API data source, moves active techniques to scripting engine, and improves performance.

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.22.0 https://github.com/OWASP/Amass.git
# already have the repo? check out this version:
$ git checkout v3.22.0
      • Adds grep.app as a new data source for enumeration.
      • Writes discoveries directly to the data store.
      • Updates ShadowServer, TeamCymru, and Farsight DNSDB integrations.

      3 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !The Google Certificate TransparencyCertificate TransparencyA public, append-only log system maintained by various operators (Google runs several) that records every TLS certificate issued, letting anyone audit CAs for misissued or rogue certificates. data source integration is removed.
      • !The Twitter integration and associated dependencies are removed.
      • !Support for Snapcraft and Cloudflare is removed.
    5. v3.20.0 Sep 23, 2022 · release notes

      Amass v3.20.0 adds BeVigil, Yandex, Netlas, ASNLookup, BidDataCloud, FullHunt, Google, PSBDMP, PublicWWW and DNSHistory data sources

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.20.0 https://github.com/OWASP/Amass.git
# already have the repo? check out this version:
$ git checkout v3.20.0
      • Adds BeVigil as a new data source for asset discovery
      • Adds Yandex as a new data source for asset discovery
      • Adds Netlas as a new data source for asset discovery
      • Adds ASNLookup as a new data source for ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. information retrieval
      • Adds Google as a new data source for search-based discovery
      +1 more show less
      • Adds DNSHistory as a new data source for historical DNS records

      6 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !FullHunt integration now requires an API key
    6. v3.19.2 Apr 16, 2022 · release notes

      amass v3.19.2 adds -prefix support to the viz command and removes the dns subcommand.

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.19.2 https://github.com/OWASP/Amass.git
# already have the repo? check out this version:
$ git checkout v3.19.2
      • The dns subcommand has been removed

      1 detail in Everything

      └──▷ BREAKING ON UPGRADE
      • !The dns subcommand is no longer available; scripts using it will fail.

    Project health

    Issue, contributor and maintainer activity in OWASP/Amass, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 2 −2 vs prior 12 months
    2. Maintainers 1 +0 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog not measured open issues today
    1. Issues opened / month not measured
    2. Open backlog not measured
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 15,197
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback