# Amass

Amass is an External Attack Surface Management product. It runs on-premises. Pricing is free.

Amass is an open-source OWASP tool for comprehensive attack surface mapping and asset discovery through domain reconnaissance and subdomain enumeration.

Checked October 2026.

## What is Amass?

Amass is an open-source tool developed by OWASP that performs comprehensive attack surface mapping and asset discovery for organizations and security professionals.

The tool focuses on identifying and enumerating external assets associated with target domains through various reconnaissance techniques. It utilizes multiple data sources including DNS records, certificate transparency logs, web archives, and search engines to discover subdomains, IP addresses, and other network infrastructure components.

Amass provides several operational modes including passive information gathering that relies on public data sources without directly interacting with target systems, and active reconnaissance that performs direct queries and scans. The tool can map relationships between discovered assets and visualize the attack surface through network graphs.

The platform supports integration with various APIs and data sources to enhance discovery capabilities. It includes features for DNS enumeration, subdomain discovery, certificate analysis, and ASN mapping. Results can be exported in multiple formats for further analysis and integration with other security tools.

Amass is designed to help security teams understand their external attack surface by identifying potentially unknown or forgotten assets that could present security risks.

Tags: Reconnaissance, Open Source, Network Reconnaissance, Subdomain Enumeration, DNS Security

## Where it fits in your security program (NIST CSF 2.0)

- [Identify](https://cybersectools.com/guides/building-identify-program-small-team): helps you know your assets and your risks.

## Quick facts

- Category: [Exposure & Vulnerability Management](https://cybersectools.com/categories/exposure-vulnerability-management) · [External Attack Surface Management](https://cybersectools.com/categories/external-asm)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 14,260
- Website: github.com

## Where it ranks

Amass is not a pick on the current [Best Attack Surface Management Solutions for Business](https://cybersectools.com/shortlists/best-attack-surface-solutions).

## Amass FAQ

### What is Amass?

Amass is a product in the External Attack Surface Management category. It covers Reconnaissance, Open Source and Network Reconnaissance.

### What is the pricing for Amass?

Amass is free. Download and setup instructions are at https://github.com/owasp-amass/amass.

### What are alternatives to Amass?

Alternatives to Amass listed on CybersecTools:

1. [ctlogs.dev](https://cybersectools.com/tools/ctlogsdev) - Fast Certificate Transparency search and JSON API for subdomain reconnaissance. (Commercial)
2. [MGM Security Partners recon me](https://cybersectools.com/tools/mgm-security-partners-recon-me) (Commercial)
3. [SurfaceDiff](https://cybersectools.com/tools/surfacediff) - Continuous external attack surface monitoring that shows what changed between scans. (Commercial)
4. [DDactic Attack Surface Discovery](https://cybersectools.com/tools/ddactic-attack-surface-discovery) - Scans domains to discover attack surface, vulnerabilities, and generate hardening (Commercial)
5. [Detectify Platform](https://cybersectools.com/tools/detectify-platform) - Platform for external attack surface management and application security testing (Commercial)

Compare all Amass alternatives at [https://cybersectools.com/alternatives/amass](https://cybersectools.com/alternatives/amass)

### What deployment and organization size does Amass fit?

Amass is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare Amass with similar solutions

- [Amass vs ctlogs.dev](https://cybersectools.com/compare/amass-vs-ctlogsdev)
- [Amass vs MGM Security Partners recon me](https://cybersectools.com/compare/amass-vs-mgm-security-partners-recon-me)
- [Amass vs SurfaceDiff](https://cybersectools.com/compare/amass-vs-surfacediff)

All alternatives to Amass: [/alternatives/amass](https://cybersectools.com/alternatives/amass)

---

Source: https://cybersectools.com/tools/amass

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on Amass: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md