Difference between revisions of "OWASP Amass Project"

OWASP Amass Project

In-depth DNS Enumeration and Network Mapping!

The OWASP Amass project was originally created when the project leader was showing organizations what they look like on the Internet, and he noticed that the tools available were returning incomplete results relative to what could be discovered manually. With the identification of this gap in capabilities for security experts, the Amass project was born.

Description

The OWASP Amass project is focused on DNS enumeration and network infrastructure mapping techniques. These techniques include: obtaining subdomain names by scraping web pages, accessing web APIs, querying public databases, recursive brute forcing, crawling web archives, permuting/altering DNS names, reverse DNS sweeping, and querying ASNs and netblocks associated with IP addresses. The information collected during an enumeration is used to build a graph database that maps an organization's presence on the Internet.

When the enumeration is complete, an Amass tool is capable of converting the results into several different formats accepted by popular network graph visualization engines. This aids analysts and infosec experts attempting to quickly identify network layout and external networks being utilized by the target organization.

The software is implemented in the Go programming language, and is portable across popular operating systems such as Windows, Linux, MacOS, FreeBSD, etc. The command-line tools can be obtained via several mechanisms described on the installation page, such as through a Go development environment, the release binaries, the Snap package manager for Linux systems and various packages maintained by others.

Licensing

This program is free software: you can redistribute it and/or modify it under the terms of the Apache 2.0 license. OWASP Amass and any contributions are Copyright © by Jeff Foley 2017.

Project Resources

[Source Code]

[What's New (Revision History)]

[Issue Tracker]

Project Leader

Jeff Foley

Classifications

News and Events

• [1 Jun 2019] Jeff Foley and Anthony Rhodes talked about advanced features and configuration options of Amass at the Bugcrowd LevelUp 0x04 virtual conference.

• [8 May 2019] Jeff Foley and Anthony Rhodes talked about Amass at the OWASP Rochester Chapter.

• [1 May 2019] Jeff Foley talked about "Discovering Exposure on the Internet" on the CSIAC Webinar.

• [23 Mar 2019] Jeff Foley and Anthony Rhodes talked about Amass at BSidesROC.

• [8 Feb 2019] Adobe announced its integration of OWASP Amass with their Marinus project on Twitter.

• [28 Nov 2018] OWASP Seattle Chapter meeting (hosted by T-Mobile) demonstration (remote) of the OWASP Amass project.