Tools & Techniques: Amass for Asset Discovery

Amass is the Swiss army knife people either love or run once and never configure. Used well, it consolidates passive sources and optional active brute force into one pipeline.

It's also loud if you point it at everything with default settings. Treat Amass like recon infrastructure, not a fire-and-forget button.

Amass output without scope filtering is just anxiety in a text file—always intersect results with authorized roots before deeper probing.

Setup that survives real work

API keys for passive sources when policy allows, a resolver list that isn't the public defaults, and an output directory per engagement.

Use `-passive` first on client work; escalate to active only with permission.

Workflow on scope

Feed root domains from scope files. Deduplicate against client inventory. Pass results to httpx before you manually browse 400 dead hosts.

• `-dir` for organized outputs

• `-silent` in scripts; humans read logs separately

• Document Amass version in report appendix

Common mistakes

Scanning OOS acquisitions because WHOIS looked related. Ignoring rate limits and getting blocked at the resolver level.

Amass finds candidates; scope decides testers.

Run active modes only where your authorization explicitly allows it.

Archive Amass config per client—API keys and scope roots differ; mixing configs causes accidental cross-client probes.

Small habits compound—what feels like overhead early becomes speed when deadlines hit.

Output hygiene

Deduplicate Amass output against prior runs—only new hosts deserve httpx cycles.

Store API keys in env vars, not command history—passive sources eat keys if leaked.

Composing with other tools

Chain Amass → httpx → nuclei with scope grep in between—document the one-liner in appendices.

Compare Amass passive output with client lists to find shadow IT politely.

Tune concurrency when resolvers complain—slow and complete beats fast and empty.

---

Worth reading next

Recon Series: Subdomain Enumeration

Tools & Techniques: httpx for HTTP Probing

Writing Simple Recon Scripts Without the Mess