Enter a target
Accepted input: Domain.
fleet module
OWASP Amass OSINT search
Maps a domain's attack surface by discovering subdomains and related infrastructure. Results land in a Command One case with their source and confidence, alongside the rest of your investigation. Part of Subdomain finder · all tools.
public sources only · free registration
how it works
From domain to evidence
Run the module
The job is sent to a live worker. If no worker can run it, you are not charged.
Review results
Subdomains, addresses and infrastructure relationships.
Verify and export
Link findings in CommandDeck, add notes and export a PDF or CSV case report.
related modules
Pair OWASP Amass with
Combining modules gives independent sources that confirm or rule out a lead.
Domain Recon
Quick passive look at a domain's DNS, mail setup and certificate surface.
theHarvester
Gathers emails, hostnames and subdomains for a domain from public sources.
Sublist3r
Passive subdomain enumeration using search engines and public datasets.
recon-ng
Modular reconnaissance framework that gathers hosts and contacts for a domain.
bbot
Recursive attack-surface scanner that keeps expanding from each new discovery.
git-hound
Searches public GitHub code for leaked secrets and references to a domain or identifier.
questions
OWASP Amass questions
What does OWASP Amass find?
Subdomains, addresses and infrastructure relationships.
What do I need to start a OWASP Amass search?
Domain. Command One only runs a module against targets it accepts.
What are the limits of OWASP Amass?
Use only on domains you own or are authorised to assess.
How much does OWASP Amass cost?
Registration is free. The module uses credits from your daily allowance or purchased balance. Current costs are listed on the credits page, and you are only charged when the module can actually run.
Try OWASP Amass in a case
Create a free account to run available modules. For lawful research and authorised assessments only.