Amass: map owned domains, netblocks, and ASNs as one graph

How Amass differs from a name list

Amass also collects subdomains, but it stores what it finds in a graph database: names, the addresses they resolved to, the netblocks those addresses sit in, and the autonomous systems that announce them. That graph answers questions a flat list cannot, such as which of your hostnames sit on a cloud range you never contracted.

Passive mode only queries data sources. Active mode adds DNS brute forcing, zone transfer attempts, and certificate grabs from live hosts, which belongs only in a scoped engagement.

Collecting in passive mode

Version 4 keeps results in an asset database under ~/.config/amass. The enum subcommand fills it; reporting subcommands read it back. Subcommand names have shifted between v4 releases, so check amass -h for the version you installed. The config file holds data source keys and should not be committed.

amass enum -passive -d hackblue-lab.org -timeout 20

# read back names and addresses (v4.2 and later)
amass subs -names -d hackblue-lab.org
amass subs -show -ip -d hackblue-lab.org

Reading the address view

The -ip view prints each name with its addresses. Grouping by the first two octets, or looking the addresses up with whois, shows which provider hosts each one.

api.hackblue-lab.org 203.0.113.24
staging.hackblue-lab.org 198.51.100.7
www.hackblue-lab.org 203.0.113.10,203.0.113.11
legacy-ftp.hackblue-lab.org 192.0.2.45

whois 192.0.2.45 | grep -iE 'orgname|netname'

Worked review: an address outside every contract

Three providers appear in the contract register. legacy-ftp resolves into a fourth, a small hosting company. The owner turns out to be a contractor who set it up for a file exchange in 2021. It still answers on port 21.

The review produces two tickets. Network owners confirm and shut down the host. The asset register gains a column for “who pays for this”, because the record existed only in the contractor’s memory.