本文へ移動
cccskills
無料GitHub で公開

amass

OWASP Amass maps an organization's external attack surface: it finds subdomains, IP addresses, netblocks and ASNs from passive sources and active DNS techniques and stores them in an asset database. Use when: comprehensive subdomain enumeration, attack surface discovery, finding forgotten hosts before a pentest, tracking newly appeared assets, building a graph of target infrastructure.

TerminalSkills/skills
インストール方法を見る

含まれるファイル（2）

  • SKILL.md8.0 KB
  • _scores.json2.1 KB

SKILL.md（原文）

インストールする前に、エージェントに与えられる指示の中身を確認できます。

OWASP Amass

Overview

OWASP Amass performs attack surface mapping and external asset discovery with open source intelligence and active reconnaissance. This skill covers Amass v5 (v5.1.1 is the latest release checked, April 2026), which is a different tool from v3/v4 in several ways:

  • A background engine (REST API on 127.0.0.1:4000) does the work; amass enum starts it automatically if it is not running and talks to it as a client. amass engine runs it by hand.
  • enum is passive by default (the -passive flag is deprecated and does nothing). -active adds zone transfer attempts and certificate name grabs.
  • Results go to an asset database in the config directory (~/.config/amass on Linux), not to -o/-json files. You read them back with subs, track, viz and assoc.
  • The v4 subcommands intel and db and the -json, -o, -asn org lookups of enum/intel are gone. Subcommands now are: enum, subs, track, viz, assoc, engine.

Instructions

Step 1: Install

# Homebrew
brew tap owasp-amass/homebrew-amass && brew install amass

# Go (needs Go 1.26+)
CGO_ENABLED=0 go install -v github.com/owasp-amass/amass/v5/cmd/amass@main

# Release archive, verified against the published checksums
curl -fsSLO https://github.com/owasp-amass/amass/releases/download/v5.1.1/amass_linux_amd64.tar.gz
curl -fsSLO https://github.com/owasp-amass/amass/releases/download/v5.1.1/amass_checksums.txt
sha256sum --ignore-missing -c amass_checksums.txt
tar -xzf amass_linux_amd64.tar.gz

# Docker
docker pull owaspamass/amass:latest
docker run --rm -v ~/.config/amass:/.config/amass owaspamass/amass:latest enum -d northwind-labs.io

amass --version

Release archives exist for linux (amd64, arm64, 386, armv6, armv7), darwin and windows; check the actual file names in the release page before downloading.

Step 2: Passive enumeration (no direct contact with the target)

amass enum -d northwind-labs.io                    # passive is the default
amass enum -d northwind-labs.io,northwind-labs.com # several domains
amass enum -df domains.txt -nocolor -silent        # domains from a file
amass enum -list                                   # list available data sources
amass enum -d northwind-labs.io -include Shodan,VirusTotal -exclude Ahrefs

Step 3: Active enumeration (touches the target's DNS and TLS)

amass enum -active -d northwind-labs.io -p 80,443,8443
amass enum -d northwind-labs.io -brute -w ./subdomains-top1mil-5000.txt
amass enum -d northwind-labs.io -brute -alts -max-depth 3
amass enum -d northwind-labs.io -r 8.8.8.8,1.1.1.1 -timeout 60
amass enum -d northwind-labs.io -rigid           # do not expand scope to related domains

-brute uses a built-in short wordlist unless -w is given. -alts generates altered names (-aw for a custom list). -timeout is minutes without progress before the run stops (default 30).

Step 4: Seed with ASNs, CIDRs and addresses

v5 has no intel command; ranges are scope seeds for enum:

amass enum -asn 64496 -cidr 198.51.100.0/24
amass enum -addr 198.51.100.1-254 -d northwind-labs.io

Finding an organization's ASNs and ranges now has to be done with another source (RIR/RDAP, BGP lookups); Amass also records ASNs and netblocks it meets during enumeration, shown by subs.

Step 5: Read results from the database

amass subs -d northwind-labs.io -names -nocolor            # discovered names only
amass subs -d northwind-labs.io -names -o northwind-names.txt
amass subs -d northwind-labs.io -ip                        # names with addresses
amass subs -d northwind-labs.io -summary                   # ASN table summary
amass subs -d northwind-labs.io -show                      # full results

Step 6: Track new assets over time

amass enum -d northwind-labs.io                            # run again on a schedule
amass track -d northwind-labs.io -since "09/01 00:00:00 2026 UTC"

-since uses the format MM/DD HH:MM:SS YYYY TZ; track lists assets first seen after that moment.

Step 7: Visualize

amass viz -d northwind-labs.io -d3 -dot -gexf -o ./graphs
dot -Tpng ./graphs/amass.dot -o ./graphs/amass.png   # Graphviz, file names may differ

-d3 writes an interactive HTML force graph, -dot a Graphviz file, -gexf a Gephi file. List the output directory to see the exact names.

Step 8: Configure data sources and options

Keys live in ~/.config/amass/datasources.yaml; options in config.yaml (both are created on first run). Pass another file with -config. Keys come from your own accounts; never commit this file.

# ~/.config/amass/datasources.yaml
global_options:
  minimum_ttl: 1440
datasources:
  - name: Shodan
    ttl: 10080
    creds:
      account:
        apikey: REPLACE_WITH_SHODAN_KEY
  - name: VirusTotal
    ttl: 10080
    creds:
      account:
        apikey: REPLACE_WITH_VIRUSTOTAL_KEY
  - name: PassiveTotal
    creds:
      account:
        username: ops@northwind-labs.io
        apikey: REPLACE_WITH_PASSIVETOTAL_KEY

# ~/.config/amass/config.yaml
scope:
  domains:
    - northwind-labs.io
  ports: [80, 443, 8443]
options:
  datasources: "./datasources.yaml"
  bruteforce:
    enabled: false
  alterations:
    enabled: false

The same file can point options.database at Postgres (postgres://…) or Neo4j instead of the default local database.

Examples

Example 1: "Find all subdomains of our domain before the pentest starts"

amass enum -d northwind-labs.io -nocolor -silent
amass subs -d northwind-labs.io -names -o northwind-names.txt
wc -l northwind-names.txt

Result: northwind-names.txt holds one host name per line (for example vpn.northwind-labs.io, staging-api.northwind-labs.io). Resolve them with dnsx or dig before reporting, because some are stale or wildcard answers.

Example 2: "What new hosts appeared since last month?"

amass enum -d northwind-labs.io -nocolor -silent
amass track -d northwind-labs.io -since "09/01 00:00:00 2026 UTC"

Result: a list of names and addresses first discovered after 1 September 2026, the candidates for review.

Guidelines

  • Authorization: passive mode still queries third parties, but -active, -brute and -alts send traffic to the target's DNS and web ports. Use them only with written permission.
  • Keys matter: without data source keys coverage is limited to free sources such as certificate transparency. Rate limits of free tiers apply.
  • Old tutorials are wrong for v5: commands with intel, db, -json, -o on enum, or -d3 -o file.html will fail. Run amass enum -h and amass <subcommand> -h to check flags on your build.
  • Runtime: a passive run takes minutes; brute force with large wordlists takes hours. The engine port 4000 must be free.
  • Data stays: the asset database keeps history between runs; pass -dir to separate engagements and delete it when the engagement ends.
  • Verify discovered names yourself: wildcard DNS and third-party data produce false positives.

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

ログインしてレビューを書く

同じリポジトリのスキル

概要と使いどころ

3dsmax-rendering

無料

Scripts and configures production rendering in Autodesk 3ds Max with the V-Ray and Corona renderers: output size and files, render elements, denoising, light mix, batch and command-line rendering, and network rendering. Use when a user asks to set up a production render, render several cameras in one batch, render from the command line or on a render farm, add render passes for compositing, or cut render time for archviz and product shots.

日本語の概要は準備中です。原文の説明を表示しています。

TerminalSkills/skills1632026年10月4日 更新

3dsmax-scripting

無料

Covers scripting Autodesk 3ds Max, the 3D modeling and rendering application, with MAXScript and Python (pymxs): scene manipulation, object creation, material assignment, camera and light setup, batch operations, and file I/O. Use when tasks involve automating repetitive 3ds Max workflows, batch processing scenes, running scripts headless with 3dsmaxbatch, creating custom tools, or scripting scene setup for archviz, product visualization, or VFX.

日本語の概要は準備中です。原文の説明を表示しています。

TerminalSkills/skills1632026年10月4日 更新

3proxy

無料

3proxy is a small open-source proxy server that runs HTTP/HTTPS, SOCKS4/5, SNI and TCP/UDP port-mapping proxies from one config file. Use when a user asks to set up an HTTP or SOCKS5 proxy, add proxy users and passwords, write 3proxy access rules, chain or rotate upstream (parent) proxies, limit bandwidth, connections or monthly traffic per user, run 3proxy in Docker, or fix a 3proxy.cfg that will not start.

日本語の概要は準備中です。原文の説明を表示しています。

TerminalSkills/skills1632026年10月4日 更新

a2a-protocol

無料

Builds Agent2Agent (A2A) servers and clients, the open protocol (originally from Google, now under the Linux Foundation) that lets AI agents from different frameworks call each other. Use when the user wants to create an A2A-compliant agent, build an Agent Card, implement task management, connect agents across frameworks, set up agent discovery, handle streaming responses, implement push notifications, or orchestrate multi-agent workflows. Trigger words: a2a, agent to agent, agent2agent, a2a protocol, a2a server, a2a client, agent card, agent interoperability, agent collaboration, multi-agent, agent discovery, a2a sdk, a2a task.

日本語の概要は準備中です。原文の説明を表示しています。

TerminalSkills/skills1632026年10月4日 更新

ab-test-setup

無料

Plans a controlled experiment (A/B test) so its result can be trusted: writes the hypothesis, picks one primary metric and the guardrails, computes sample size and run time, specifies how visitors are assigned and when exposure is logged, and reads out the result with a confidence interval. Use when someone says "set up an A/B test", "split test this page", "how many visitors do I need", "how long should the experiment run", "is this result significant", "can I stop the test early", or wants to test a headline, price, layout or onboarding change against the current version.

日本語の概要は準備中です。原文の説明を表示しています。

TerminalSkills/skills1632026年10月4日 更新

ably

無料

Ably is a hosted realtime messaging service: clients publish and subscribe to named channels over WebSockets, see who is present, replay message history, and resume after a dropped connection. Use when a user asks to "add realtime updates", "push live notifications to the browser", "show who is online", "add a chat room with typing indicators", "publish from a serverless function", or "authenticate Ably clients without exposing the API key". Covers the ably 2.x JavaScript SDK (Realtime and REST), JWT token authentication, presence, history and rewind, batch publishing, and the @ably/chat 1.x SDK.

日本語の概要は準備中です。原文の説明を表示しています。

TerminalSkills/skills1632026年10月4日 更新

TerminalSkills のスキルをすべて見る

このスキルの問題を報告する