OWASP Amass Project

• Main
• Road Map and Getting Involved
• Project About

OWASP Amass Project In-depth DNS Enumeration, Attack Surface Mapping and External Asset Discovery! The OWASP Amass Project has developed a tool to help information security professionals perform network mapping of attack surfaces and perform external asset discovery using open source information gathering and active reconnaissance techniques. Description The OWASP Amass project is focused on DNS enumeration and network infrastructure mapping techniques. These techniques include: obtaining subdomain names by scraping web pages, accessing web APIs, querying public databases, recursive brute forcing, crawling web archives, permuting/altering DNS names, reverse DNS sweeping, and querying ASNs and netblocks associated with IP addresses. The information collected during an enumeration is used to build a graph database that maps an organization's presence on the Internet. When the enumeration is complete, an Amass tool is capable of converting the results into several different formats accepted by popular network graph visualization engines. This aids analysts and infosec experts attempting to quickly identify network layout and external networks being utilized by the target organization. The software is implemented in the Go programming language, and is portable across popular operating systems such as Windows, Linux, MacOS, FreeBSD, etc. The command-line tools can be obtained via several mechanisms described on the installation page, such as through a Go development environment, the release binaries, the Snap package manager for Linux systems and various packages maintained by others. Licensing This program is free software: you can redistribute it and/or modify it under the terms of the Apache 2.0 license. OWASP Amass and any contributions are Copyright © by Jeff Foley 2017.

Project Resources [Source Code] [What's New (Revision History)] [Issue Tracker] Project Leader Jeff Foley Classifications

News and Events [31 Jul 2019] OWASP Amass Project shows up in DarkReading "8 Free Tools to Be Showcased at Black Hat and DEF CON" article. [1 Jun 2019] Anthony Rhodes and Jeff Foley talked about advanced features and configuration options of Amass at the Bugcrowd LevelUp 0x04 virtual conference. [8 May 2019] Jeff Foley and Anthony Rhodes talked about Amass at the OWASP Rochester Chapter. [1 May 2019] Jeff Foley talked about "Discovering Exposure on the Internet" on the CSIAC Webinar. [23 Mar 2019] Jeff Foley and Anthony Rhodes talked about Amass at BSidesROC. [8 Feb 2019] Adobe announced its integration of OWASP Amass with their Marinus project on Twitter. [28 Nov 2018] OWASP Seattle Chapter meeting (hosted by T-Mobile) demonstration (remote) of the OWASP Amass project.

How can I participate in the project?

All you have to do is make the Project Leader aware of your available time to contribute to the project. It is also important to let the leader know how you would like to contribute and pitch in to help the project meet its goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leader is key.

If I am not a programmer can I participate in the project?

Yes, you can certainly participate in the project if you are not a programmer. The project needs different skills and expertise at different times during its development. Currently, we are looking for researchers, programmers, writers, and graphic designers. See the Road Map and Getting Involved tab for more details.

Contributors

The Founder and Project Leader:

• Jeff Foley

Contributors that have joined the project include:

• Mikail Tunç

• Wael Nasreddine

• Randall Marsden

• Anthony Rhodes

• Adam Zinger

• Daniel Martin

• Benjamin Murray

• Shane Ditton

• Semtex Oliviero

• Daniel Hauenstein

• John Daniel Leon

• Daniel Miessler

• Kian Jamali

• Nikos Gkogkos

• Jason Haddix

• Julio Hawthorne

Roadmap

As of January, 2019, the highest priorities for the next 6 months are:

• For version 3.0.0, update the user interfaces (UI) available
• Feature enhancement: Allow Amass to connect to proxies
• Feature enhancement: Inform users of what Amass will do once an enumeration is executed
• Feature enhancement: Clean lists of DNS resolvers provided by users
• Continue to update data sources that provide DNS names
• Implement documentation regarding Amass architecture and the enumeration process
• Develop slides and videos to serve as demonstration material

Getting Involved

There are many ways you can support the OWASP Amass project. Below are some of the roles that definitely need additional support:

Coding

We could implement some of the later items on the roadmap sooner if some Go network programmers wanted to join the project.

Testing

Amass leverages concurrency and produces quite a bit of network traffic, which can always use additional testing. Anyone interested in stressing the software and helping to improve its quality is welcome.

Writing

The project could currently use technical writers to join the team in order to capture how the software works.

PROJECT INFO What does this OWASP project offer you?

RELEASE(S) INFO What releases are available for this project?

what is this project? Name: OWASP Amass Purpose: In-depth DNS Enumeration and Network Mapping License: Apache License 2.0 who is working on this project? Project Leader(s): Jeff Foley @ how can you learn more? Project Pamphlet: Not Yet Created Project Presentation: Mailing list: N/A Project Roadmap: Not Yet Created Key Contacts Contact Jeff Foley @ to contribute to this project Contact Jeff Foley @ to review or sponsor this project

current release Not Yet Published last reviewed release Not Yet Reviewed other releases