Amass Cheat Sheet — Subdomain Enumeration

1️⃣ Basic Enumeration

Run a simple passive scan:

amass enum -d example.com

Passive sources only (no active probing):

amass enum -passive -d example.com

Specify output file:

amass enum -d example.com -o subdomains.txt

2️⃣ Active Enumeration (More Powerful)

Active mode performs DNS brute-forcing and resolution.

amass enum -active -d example.com

Include brute forcing:

amass enum -brute -d example.com

Use wordlist:

amass enum -brute -w wordlist.txt -d example.com

3️⃣ Multiple Domains

Enumerate several domains:

amass enum -df domains.txt

Example domains.txt:

example.com
test.com
target.org

4️⃣ Use API Keys (Better Results)

Amass supports APIs like:

• SecurityTrails
• Shodan
• Censys
• VirusTotal

Example config file:

amass enum -config config.ini -d example.com

Example config.ini snippet:

[virustotal]
apikey = YOUR_API_KEY

[securitytrails]
apikey = YOUR_API_KEY

5️⃣ Set Resolver List

Using good DNS resolvers improves results.

amass enum -rf resolvers.txt -d example.com

Example:

1.1.1.1
8.8.8.8
9.9.9.9

6️⃣ Run with Maximum Data Sources

Use all sources available:

amass enum -src -ip -d example.com

Options:

FlagPurpose-srcShow data source-ipResolve IPs-bruteDNS brute force-activeActive scanning

7️⃣ Enumeration with Timing Control

Control scan speed:

amass enum -d example.com -max-dns-queries 200

8️⃣ Subdomain Visualization

Amass can generate graphs.

amass viz -d3 -d example.com -o graph.html

Other formats:

amass viz -dot -d example.com

9️⃣ Use the Amass Database

Store results:

amass enum -d example.com -dir amass_data

List domains:

amass db -dir amass_data -names

Show IP mapping:

amass db -dir amass_data -show -ip

🔟 Track Changes (Attack Surface Monitoring)

amass track -d example.com

Shows new subdomains discovered over time.

🧠 Pro Bug Bounty Workflow

Typical workflow used by hackers:

subfinder -d example.com -o subs1.txt
amass enum -passive -d example.com -o subs2.txt
cat subs*.txt | sort -u > all_subs.txt
dnsx -l all_subs.txt -o live_subs.txt
httpx -l live_subs.txt

Tools often combined with Amass:

• Subfinder
• dnsx
• httpx

⚡ High-Signal Command (Recommended)

amass enum -active -brute -min-for-recursive 2 -d example.com -o amass.txt

This enables:

• recursive enumeration
• brute forcing
• active discovery

🧪 Useful Wordlists

Common sources:

SecLists/Discovery/DNS/
assetnote/subdomains

From OWASP repository collections.

⚠️ Ethical Reminder

Always run enumeration only on systems you are authorized to test (bug bounty scope, internal pentest, or lab environments).

If you want more Content about Cybersecurity and Penetration Testing Then don’t Forgot To Follow Us

SHARE & SUPPORT ⚡️✅ ❤️