Ultimate Amass Cheat Sheet

Samir KC
March 15, 2026



Ultimate Amass Cheat Sheet

In-depth DNS enumeration and network mapping using open source intelligence.

1. Enumeration (Enum)

The core subcommand for finding subdomains and mapping the network.

Passive Mode (Safe)

Uses only data sources (APIs). No direct traffic is sent to the target.

amass enum -passive -d target.com

Active Mode (Standard)

Attempts to resolve the names found, validates IPs, and performs certificate scraping.

amass enum -active -d target.com

Brute Force

Guess subdomains using a wordlist.

amass enum -active -d target.com -brute -w /path/to/wordlist.txt

IP/CIDR Enumeration

Find domains hosted on specific IP ranges.

amass enum -d target.com -addr 192.168.1.0/24

2. Intelligence (Intel)

Discover broader information about the target organization (ASNs, CIDRs).

Reverse Whois

Find root domains associated with an organization name.

amass intel -org "Target Company"

ASN Lookup

Find domains hosted within a specific Autonomous System Number.

amass intel -asn 12345

Reverse IP

Find domains hosted on an IP address.

amass intel -addr 192.168.1.50

3. Database Management (DB)

Amass stores all findings in a graph database. You can query this data later without rescanning.

List Findings

Show all subdomains found for a specific domain in the DB.

amass db -names -d target.com

Show IPs

Show domains and their IP addresses.

amass db -show -d target.com

Clean Database

Delete findings for a specific domain.

amass db -delete target.com

4. Visualization (Viz)

Generate graph files to visualize the network structure in other tools.

Maltego

Generate a CSV file importable into Maltego.

amass viz -maltego -d target.com -o amass_maltego.csv

D3 Force Graph

Create an interactive HTML file.

amass viz -d3 -d target.com -o amass_d3.html

GEXF (Gephi)

Generate a file for Gephi Graphviz.

amass viz -gexf -d target.com -o amass_gephi.gexf

5. Tracking & Configuration

Tracking Changes

Compare the last scan with the current one to see new/removed subdomains.

amass track -d target.com

Using Config File (API Keys)

Amass is much more powerful with API keys (Shodan, Censys, SecurityTrails). Add them to `config.ini`.

amass enum -d target.com -config config.ini

Common Flags

  • -v: Verbose (debug info).
  • -ip: Show IP addresses in output.
  • -src: Show data source (e.g., [VirusTotal]).
  • -o [file]: Output to text file.
  • -json [file]: Output to JSON file.
⇧