{"id":5400,"date":"2020-02-10T22:05:43","date_gmt":"2020-02-10T14:05:43","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=5400"},"modified":"2020-02-10T22:15:27","modified_gmt":"2020-02-10T14:15:27","slug":"owasp-amass-dns-enumeration-attack-surface-mapping-external-asset-discovery","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2020\/02\/owasp-amass-dns-enumeration-attack-surface-mapping-external-asset-discovery\/","title":{"rendered":"OWASP Amass &#8211; DNS Enumeration, Attack Surface Mapping &#038; External Asset Discovery"},"content":{"rendered":"<p>The OWASP Amass Project is a DNS Enumeration, Attack Surface Mapping &#038; External Asset Discovery tool to help information security professionals perform network mapping of attack surfaces and perform external asset discovery using open source information gathering and active reconnaissance techniques.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/02\/OWASP-Amass-DNS-Enumeration-Attack-Surface-Mapping-External-Asset-Discovery.png\" alt=\"OWASP Amass - DNS Enumeration, Attack Surface Mapping &amp; External Asset Discovery\" width=\"640\" height=\"400\" class=\"aligncenter size-full wp-image-5402\" \/><\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<h2>Information Gathering Techniques Used by OWASP Amass for DNS Enumeration and More<\/h2>\n<p>The main functionality of Amass is as follows:<\/p>\n<ul>\n<li><strong>DNS:<\/strong> Basic enumeration, Brute forcing (optional), Reverse DNS sweeping, Subdomain name alterations\/permutations, Zone transfers (optional)<\/li>\n<li><strong>Scraping:<\/strong> Ask, Baidu, Bing, DNSDumpster, DNSTable, Dogpile, Exalead, Google, HackerOne, IPv4Info, Netcraft, PTRArchive, Riddler, SiteDossier, ViewDNS, Yahoo<\/li>\n<li><strong>Certificates:<\/strong> Active pulls (optional), Censys, CertSpotter, Crtsh, Entrust, GoogleCT<\/li>\n<li><strong>APIs:<\/strong> AlienVault, BinaryEdge, BufferOver, CIRCL, CommonCrawl, DNSDB, GitHub, HackerTarget, IPToASN, Mnemonic, NetworksDB, PassiveTotal, Pastebin, RADb, Robtex, SecurityTrails, ShadowServer, Shodan, Spyse (CertDB &#038; FindSubdomains), Sublist3rAPI, TeamCymru, ThreatCrowd, Twitter, Umbrella, URLScan, VirusTotal, WhoisXML<\/li>\n<li><strong>Web Archives:<\/strong> ArchiveIt, ArchiveToday, Arquivo, LoCArchive, OpenUKArchive, UKGovArchive, Wayback<\/li>\n<\/ul>\n<h3>Usage of Amass for DNS Enumeration, Attack Surface Mapping &#038; External Asset Discovery<\/h3>\n<p>The Amass tool has several subcommands shown below for handling your Internet exposure investigation.<\/p>\n<ul>\n<li><strong>intel<\/strong> &#8211; Collect open-source intelligence for investigation of the target organization<\/li>\n<li><strong>enum<\/strong> &#8211; Perform DNS enumeration and network mapping of systems exposed to the Internet<\/li>\n<li><strong>viz<\/strong> &#8211; Generate visualizations of enumerations for exploratory analysis<\/li>\n<li><strong>track<\/strong> &#8211; Compare results of enumerations against common target organizations<\/li>\n<li><strong>db<\/strong> &#8211; Manage the graph databases storing the enumeration results<\/li>\n<\/ul>\n<p>Each subcommand has its own arguments, for example, the &#8216;intel&#8217; subcommand.<\/p>\n<p>The intel subcommand can help you discover additional root domain names associated with the organization you are investigating. The data source sections of the configuration file are utilized by this subcommand in order to obtain passive intelligence, such as reverse whois information.<\/p>\n<pre>\r\n-active\tEnable active recon methods\r\n-addr\tIPs and ranges (192.168.1.1-254) separated by commas\r\n-asn\tASNs separated by commas (can be used multiple times)\r\n-cidr\tCIDRs separated by commas (can be used multiple times)\r\n-config\tPath to the INI configuration file\r\n-d\tDomain names separated by commas (can be used multiple times)\r\n-demo\tCensor output to make it suitable for demonstrations\r\n-df\tPath to a file providing root domain names\r\n-dir\tPath to the directory containing the graph database\r\n-ef\tPath to a file providing data sources to exclude\r\n-exclude\tData source names separated by commas to be excluded\r\n-if\tPath to a file providing data sources to include\r\n-include\tData source names separated by commas to be included\r\n-ip\tShow the IP addresses for discovered names\r\n-ipv4\tShow the IPv4 addresses for discovered names\r\n-ipv6\tShow the IPv6 addresses for discovered names\r\n-list\tPrint the names of all available data sources\r\n-log\tPath to the log file where errors will be written\r\n-max-dns-queries\tMaximum number of concurrent DNS queries\r\n-noresolvrate\tDisable resolver rate monitoring\r\n-noresolvscore\tDisable resolver reliability scoring\r\n-o\tPath to the text output file\r\n-org\tSearch string provided against AS description information\r\n-p\tPorts separated by commas (default: 443)\r\n-public-dns\tUse public-dns.info resolvers\r\n-r\tIP addresses of preferred DNS resolvers (can be used multiple times)\r\n-rf\tPath to a file providing preferred DNS resolvers\r\n-src\tPrint data sources for the discovered names\r\n-timeout\tNumber of minutes to execute the enumeration\r\n-whois\tAll discovered domains are run through reverse whois\r\n<\/pre>\n<p>It has some visualization capabilities and can also output to other tools and in various formats such as D3.js, GEXF, Graphistry JSON, VisJS and <a href=\"https:\/\/www.darknet.org.uk\/2008\/11\/maltego-download-data-mining-information-gathering-tool\/\">Maltego<\/a> format.<\/p>\n<p>You can download Amass here:<\/p>\n<p><strong>Linux:<\/strong> <a href=\"https:\/\/github.com\/OWASP\/Amass\/releases\/download\/v3.4.2\/amass_v3.4.2_linux_amd64.zip\">amass_v3.4.2_linux_amd64.zip<\/a><br \/>\n<strong>Windows:<\/strong> <a href=\"https:\/\/github.com\/OWASP\/Amass\/releases\/download\/v3.4.2\/amass_v3.4.2_windows_amd64.zip\">amass_v3.4.2_windows_amd64.zip<\/a><br \/>\n<strong>Source:<\/strong> <a href=\"https:\/\/github.com\/OWASP\/Amass\/archive\/v3.4.2.zip\">Amass-v3.4.2.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/OWASP\/Amass\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The OWASP Amass Project is a DNS Enumeration, Attack Surface Mapping &#038; External Asset Discovery tool to help information security professionals perform network mapping of attack surfaces and perform external asset discovery using open source information gathering and active reconnaissance techniques. Information Gathering Techniques Used by OWASP Amass for DNS Enumeration and More The main [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":5402,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"none","_seopress_titles_title":"OWASP Amass - DNS Enumeration, Attack Surface Mapping &amp; External Asset Discovery","_seopress_titles_desc":"The OWASP Amass Project is a DNS Enumeration, Attack Surface Mapping &amp; External Asset Discovery tool to help information security professionals perform network mapping of attack surfaces.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[9],"tags":[],"featured_image_src":"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/02\/OWASP-Amass-DNS-Enumeration-Attack-Surface-Mapping-External-Asset-Discovery-600x400.png","featured_image_src_square":"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/02\/OWASP-Amass-DNS-Enumeration-Attack-Surface-Mapping-External-Asset-Discovery-600x400.png","author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/5400"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=5400"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/5400\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media\/5402"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=5400"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=5400"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=5400"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}