amass
Discover subdomains, IP ranges, ASNs, and related domains to map attack surface deep. Combines passive OSINT and active DNS brute-force for thorough enumeration.
Instructions
Comprehensive network mapping and attack surface discovery using OSINT and active techniques. Discovers subdomains, IP ranges, ASNs, and related domains. Use for deep domain mapping — combines passive (OSINT) and active (DNS brute-force) methods. More thorough than subfinder but slower. Use subfinder for quick passive-only results. Output: discovered assets with their sources and relationships.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Mode: 'enum' for subdomain enumeration (default), 'intel' for OSINT on IP ranges/ASNs | |
| opts | No | Additional amass options (e.g. '-active' to enable active DNS brute-force) | |
| domain | Yes | Target domain (e.g. example.com) |