amass_enum
Discover subdomains and map an organization's attack surface by enumerating DNS records, IPs, and ASN data. Use passive mode for low-impact scans or active mode for deeper DNS brute-forcing.
Instructions
Enumerate subdomains and map attack surface using Amass.
Args: domain: Target domain to enumerate (e.g. example.com). mode: Enumeration mode — passive (no direct interaction), active (DNS brute-force + zone walk). timeout: Override default scan timeout in seconds.
Returns: Structured results with discovered subdomains, IPs, and ASN info.
Note: - Active mode sends DNS queries directly to target's nameservers. - Target must be in tengu.toml [targets].allowed_hosts.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | passive | |
| domain | Yes | ||
| timeout | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||