This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Amass Project"

From OWASP
Jump to: navigation, search
(→‎News and Events)
(→‎OWASP Amass Project)
 
(33 intermediate revisions by the same user not shown)
Line 7: Line 7:
 
==OWASP Amass Project==
 
==OWASP Amass Project==
  
−
In-depth DNS Enumeration and Network Mapping written in Go!
+
In-depth DNS Enumeration, Attack Surface Mapping and External Asset Discovery!
  
−
The OWASP Amass project was originally created when the project lead was showing organizations what they look like on the Internet, and he noticed that the tools available were returning incomplete results relative to what could be discovered manually. With the identification of this gap in capabilities for security experts, the Amass project was born.
+
The OWASP Amass Project has developed a tool to help information security professionals perform network mapping of attack surfaces and perform external asset discovery using open source information gathering and active reconnaissance techniques.
  
 
==Description==
 
==Description==
  
−
The OWASP Amass project is focused on DNS enumeration and network infrastructure mapping techniques. These techniques include: obtaining subdomain names by scraping web pages, accessing web APIs, recursive brute forcing, crawling web archives, permuting/altering names, reverse DNS sweeping, and querying ASNs and netblocks associated with IP addresses. The information collected during an enumeration is used to build a network map of an organization's presence on the Internet.
+
The OWASP Amass project is focused on DNS enumeration and network infrastructure mapping techniques. These techniques include: obtaining subdomain names by scraping web pages, accessing web APIs, querying public databases, recursive brute forcing, crawling web archives, permuting/altering DNS names, reverse DNS sweeping, and querying ASNs and netblocks associated with IP addresses. The information collected during an enumeration is used to build a graph database that maps an organization's presence on the Internet.
  
−
Amass reaches out to over 30 passive data sources to learn about the DNS namespace of a target domain. By default, Amass validates all the names by performing DNS queries across a pool of DNS resolvers, which spreads out the activity generated by the enumeration. For all IP addresses collected during this process, Amass queries for associated netblocks and ASNs. As additional data sources become available to provide visibility of the Internet, implementations can quickly be developed within Amass due to the simple interfaces worked into the design.
+
When the enumeration is complete, an Amass tool is capable of converting the results into several different formats accepted by popular network graph visualization engines. This aids analysts and infosec experts attempting to quickly identify network layout and external networks being utilized by the target organization.
  
−
When the enumeration is complete, an Amass suite tool is capable of converting the results into several different formats accepted by popular network graph visualization engines. This aids analysts and infosec experts attempting to quickly identify network layout and external networks being utilized by the target organization.
+
The software is implemented in the Go programming language, and is portable across popular operating systems such as Windows, Linux, MacOS, FreeBSD, etc. The command-line tools can be obtained via several mechanisms described on the installation page, such as through a Go development environment, the release binaries, the Snap package manager for Linux systems and various packages maintained by others.
−
 
 
−
If users wish to maintain the information collected by the Amass software, data handlers interface with storage systems, such as [https://neo4j.com/ Neo4j]. Additional handlers can easily be implemented in order to support other databases or even custom solutions.
 
−
 
 
−
The project has software deliverables that are implemented in the Go programming language. These deliverables include command-line tools, a local transform for [https://www.paterva.com/web7/buy/maltego-clients.php Maltego], and a Go package that can be imported into other software projects. The software is portable across popular operating systems such as Windows, Linux, MacOS, FreeBSD, etc. The command-line tools can be obtained via several mechanisms described on the installation page, such as through a Go development environment, the release binaries and the Snap package manager for Linux systems.
 
  
 
==Licensing==
 
==Licensing==
Line 51: Line 47:
 
   | colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
 
   | colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
 
   |-
 
   |-
−
   | rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
+
   | rowspan="2" align="center" valign="top" width="50%" | [[File:Midlevel_projects.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Lab_Projects|Lab Project]]
 
   | align="center" valign="top" width="50%" | [[File:Owasp-builders-small.png|link=Builders]]   
 
   | align="center" valign="top" width="50%" | [[File:Owasp-builders-small.png|link=Builders]]   
 
   |-
 
   |-
Line 60: Line 56:
 
== News and Events ==
 
== News and Events ==
  
−
* [28 Nov 2018] Demonstrated the OWASP Amass project remotely at the OWASP Seattle Chapter meeting.
+
* [31 Jul 2019] OWASP Amass Project shows up in DarkReading "8 Free Tools to Be Showcased at Black Hat and DEF CON" article.
  
−
* [18 Nov 2018] The Nix package manager added the OWASP Amass project to its package collection.
+
* [1 Jun 2019] Anthony Rhodes and Jeff Foley talked about advanced features and configuration options of Amass at the Bugcrowd LevelUp 0x04 virtual conference.
  
−
* [18 Oct 2018] DragonFly BSD added the OWASP Amass project to DPorts package management.
+
* [8 May 2019] Jeff Foley and Anthony Rhodes talked about Amass at the OWASP Rochester Chapter.
  
−
* [12 Oct 2018] OWASP showcased the Amass project at AppSec USA 2018.
+
* [1 May 2019] Jeff Foley talked about "Discovering Exposure on the Internet" on the CSIAC Webinar.
  
−
* [11 Sep 2018] FreeBSD added the OWASP Amass project to the Ports package collection.
+
* [23 Mar 2019] Jeff Foley and Anthony Rhodes talked about Amass at BSidesROC.
  
−
* [10 Sep 2018] OWASP Amass project was added to the Arch Linux User Repository (AUR).
+
* [8 Feb 2019] Adobe announced its integration of OWASP Amass with their Marinus project on Twitter.
  
−
* [6 Sep 2018] OWASP London Chapter meeting (hosted by Facebook) lightning talk (remote) to introduce the OWASP Amass project.
+
* [28 Nov 2018] OWASP Seattle Chapter meeting (hosted by T-Mobile) demonstration (remote) of the OWASP Amass project.
−
 
 
−
* [4 Jul 2018] OWASP announced acceptance of the Amass project on Twitter.
 
  
 
|}
 
|}
Line 88: Line 82:
 
==Contributors==
 
==Contributors==
  
−
The first contributors to the project were:
+
The Founder and Project Leader:
  
 
* '''Jeff Foley'''
 
* '''Jeff Foley'''
  
  
−
Additional contributors that have joined the project include:
+
Contributors that have joined the project include:
  
 
* '''Mikail Tunç'''
 
* '''Mikail Tunç'''
  
 
* '''Wael Nasreddine'''
 
* '''Wael Nasreddine'''
 +
 +
* '''Randall Marsden'''
 +
 +
* '''Anthony Rhodes'''
 +
 +
* '''Adam Zinger'''
 +
 +
* '''Daniel Martin'''
 +
 +
* '''Benjamin Murray'''
 +
 +
* '''Shane Ditton'''
 +
 +
* '''Semtex Oliviero'''
 +
 +
* '''Daniel Hauenstein'''
 +
 +
* '''John Daniel Leon'''
 +
 +
* '''Daniel Miessler'''
 +
 +
* '''Kian Jamali'''
 +
 +
* '''Nikos Gkogkos'''
 +
 +
* '''Jason Haddix'''
 +
 +
* '''Julio Hawthorne'''
  
 
= Road Map and Getting Involved =
 
= Road Map and Getting Involved =
Line 103: Line 125:
 
==Roadmap==
 
==Roadmap==
  
−
As of <strong>July, 2018, the highest priorities for the next 12 months</strong> are:
+
As of <strong>January, 2019, the highest priorities for the next 6 months</strong> are:
 +
 
 +
* For version 3.0.0, update the user interfaces (UI) available
 
* Feature enhancement: Allow Amass to connect to proxies
 
* Feature enhancement: Allow Amass to connect to proxies
 
* Feature enhancement: Inform users of what Amass will do once an enumeration is executed
 
* Feature enhancement: Inform users of what Amass will do once an enumeration is executed
−
* Feature enhancement: Add additional constraints to the enumeration process
+
* Feature enhancement: Clean lists of DNS resolvers provided by users
 
* Continue to update data sources that provide DNS names
 
* Continue to update data sources that provide DNS names
−
* Implement additional data handlers that save information gathered into various data stores
 
 
* Implement documentation regarding Amass architecture and the enumeration process
 
* Implement documentation regarding Amass architecture and the enumeration process
 
* Develop slides and videos to serve as demonstration material
 
* Develop slides and videos to serve as demonstration material
Line 130: Line 153:
 
{{Template:Project About
 
{{Template:Project About
 
| project_name =OWASP Amass
 
| project_name =OWASP Amass
−
| project_description = In-depth DNS Enumeration and Network Mapping written in Go
+
| project_description = In-depth DNS Enumeration and Network Mapping
 
| project_license = Apache License 2.0
 
| project_license = Apache License 2.0
 
| leader_name1 = Jeff Foley
 
| leader_name1 = Jeff Foley

Latest revision as of 01:42, 5 August 2019

OWASP Project Header.jpg

OWASP Amass Project

In-depth DNS Enumeration, Attack Surface Mapping and External Asset Discovery!

The OWASP Amass Project has developed a tool to help information security professionals perform network mapping of attack surfaces and perform external asset discovery using open source information gathering and active reconnaissance techniques.

Description

The OWASP Amass project is focused on DNS enumeration and network infrastructure mapping techniques. These techniques include: obtaining subdomain names by scraping web pages, accessing web APIs, querying public databases, recursive brute forcing, crawling web archives, permuting/altering DNS names, reverse DNS sweeping, and querying ASNs and netblocks associated with IP addresses. The information collected during an enumeration is used to build a graph database that maps an organization's presence on the Internet.

When the enumeration is complete, an Amass tool is capable of converting the results into several different formats accepted by popular network graph visualization engines. This aids analysts and infosec experts attempting to quickly identify network layout and external networks being utilized by the target organization.

The software is implemented in the Go programming language, and is portable across popular operating systems such as Windows, Linux, MacOS, FreeBSD, etc. The command-line tools can be obtained via several mechanisms described on the installation page, such as through a Go development environment, the release binaries, the Snap package manager for Linux systems and various packages maintained by others.

Licensing

This program is free software: you can redistribute it and/or modify it under the terms of the Apache 2.0 license. OWASP Amass and any contributions are Copyright © by Jeff Foley 2017.

Project Resources

[Source Code]

[What's New (Revision History)]

[Issue Tracker]

Project Leader

Jeff Foley

All your systems2.png

Classifications

Project Type Files TOOL.jpg
Lab Project Owasp-builders-small.png

News and Events

  • [31 Jul 2019] OWASP Amass Project shows up in DarkReading "8 Free Tools to Be Showcased at Black Hat and DEF CON" article.
  • [1 Jun 2019] Anthony Rhodes and Jeff Foley talked about advanced features and configuration options of Amass at the Bugcrowd LevelUp 0x04 virtual conference.
  • [8 May 2019] Jeff Foley and Anthony Rhodes talked about Amass at the OWASP Rochester Chapter.
  • [1 May 2019] Jeff Foley talked about "Discovering Exposure on the Internet" on the CSIAC Webinar.
  • [23 Mar 2019] Jeff Foley and Anthony Rhodes talked about Amass at BSidesROC.
  • [8 Feb 2019] Adobe announced its integration of OWASP Amass with their Marinus project on Twitter.
  • [28 Nov 2018] OWASP Seattle Chapter meeting (hosted by T-Mobile) demonstration (remote) of the OWASP Amass project.

How can I participate in the project?

All you have to do is make the Project Leader aware of your available time to contribute to the project. It is also important to let the leader know how you would like to contribute and pitch in to help the project meet its goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leader is key.

If I am not a programmer can I participate in the project?

Yes, you can certainly participate in the project if you are not a programmer. The project needs different skills and expertise at different times during its development. Currently, we are looking for researchers, programmers, writers, and graphic designers. See the Road Map and Getting Involved tab for more details.

Contributors

The Founder and Project Leader:

  • Jeff Foley


Contributors that have joined the project include:

  • Mikail Tunç
  • Wael Nasreddine
  • Randall Marsden
  • Anthony Rhodes
  • Adam Zinger
  • Daniel Martin
  • Benjamin Murray
  • Shane Ditton
  • Semtex Oliviero
  • Daniel Hauenstein
  • John Daniel Leon
  • Daniel Miessler
  • Kian Jamali
  • Nikos Gkogkos
  • Jason Haddix
  • Julio Hawthorne

Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Amass_Project&oldid=253524"