OWASP Amass

OWASP Amass is a free, open-source framework for mapping attack surfaces and discovering external assets through OSINT and active reconnaissance. It combines a collection engine, a database for discovered assets, and the Open Asset Model, which defines asset types, properties, and relationships for assets exposed on the Internet. Collection sources include APIs, certificates, DNS, routing, scraping, web archives, and WHOIS. Its mapping scope includes physical and digital assets, beyond basic subdomain enumeration. The database supports storing, managing, retrieving, and tracking findings over time. Amass is available for Linux, macOS, and Windows, with self-hosted deployment. Installation options include building from source with Go, Homebrew, the official Docker image, and Docker Compose. The project lists Go, network connectivity, DNS resolution, and basic network reconnaissance knowledge as requirements. Amass is an OWASP Flagship Project and uses the Apache 2.0 license, though some subcomponents have separate licenses. The project directs users seeking help to its Discord community rather than GitHub issues.

Amass brings asset discovery, mapping, and long-term findings management together in a free framework. Its documented requirements and separate licensing for some components are worth noting before adoption.

Amass suits information security professionals who need to map attack surfaces and discover external assets. It also fits users able to meet its Go, connectivity, DNS, and reconnaissance knowledge requirements.

OWASP Amass is a no-cost, open-source framework for mapping attack surfaces and finding externally exposed assets. It fits information-security practitioners and technically capable teams that can operate reconnaissance tooling. The trade-off is ownership: deployment, data-source credentials, and licensing review sit with you rather than a managed provider.

Overview

Amass is built as three connected pieces: a collection engine, an asset database, and the Open Asset Model. Together they describe internet-facing assets, their properties, and relationships, then preserve those findings for later retrieval. That makes the project useful for maintaining an evolving inventory of physical and digital exposure, not merely producing a one-off subdomain list.

The framework is an OWASP Flagship Project and uses the Apache 2.0 license. Some subcomponents carry separate licenses, so organizations with redistribution or compliance requirements should review the repository terms. The software comes without warranties, and the project pages identify no security certifications or compliance attestations.

Key features

Discovery combines OSINT with active reconnaissance. Sources include APIs, certificates, DNS, routing data, scraping, web archives, and WHOIS. This range can reveal relationships and assets that a single source misses, making Amass a strong fit for external attack-surface work. It also means operators need network connectivity, functioning DNS resolution, and basic reconnaissance knowledge.

The asset database stores, manages, and retrieves discoveries for long-term tracking. Teams can therefore compare an external footprint over time instead of treating each scan as disposable output. The Open Asset Model gives those records a consistent way to express asset types, attributes, and links between them.

Deployment is flexible but technical. Documentation covers building from source with Go, installing through the project-maintained Homebrew package, using an official Docker image, and running Docker Compose. Data sources can be configured with credentials. A first version of the engine REST API is documented in the v5.1.1 release notes, which may help teams integrating collection into their own workflows. Support is directed to the project's Discord community; GitHub issues are not intended for installation or usage questions.

Amass supports API discovery, external asset discovery, network discovery, configuration monitoring, finding management, evidence capture, and web-app testing. It can work with OpenAPI/Swagger, REST, GraphQL, and gRPC formats, and its listed ecosystems span Java/Maven, .NET/NuGet, JavaScript package managers, Ruby, Go, Python, PHP, Dart, Swift, Perl, and Elixir. It does not provide business-logic testing or network testing, so it should complement—not replace—a broader testing program.

Pricing

OWASP Amass — free. The sole plan is a free, open-source framework under Apache License 2.0. There is no paid tier, seat allowance, usage quota, or trial period to manage. The value is straightforward for teams able to run and maintain self-hosted software, while the cost shifts to engineering time, infrastructure, data-source setup, and license review.

Platforms

Amass runs on Windows, Linux, and macOS, with self-hosted deployment. Go, network access, DNS resolution, and basic network-reconnaissance understanding are listed requirements. Docker and Docker Compose provide container-oriented deployment paths in addition to source and Homebrew installation.

Who it's for

Information-security professionals responsible for discovering and monitoring an organization's external footprint are the clearest audience. It suits teams that want control over collection sources and storage, need durable findings, and can administer Go- or container-based tooling. Buyers seeking a hosted console, packaged compliance evidence, or minimal operational involvement should look elsewhere.

Pros and cons

Pros

• Broad collection coverage: OSINT and active reconnaissance across API, certificate, DNS, routing, scraping, archive, and WHOIS sources support a wider asset picture.
• Persistent findings: The database and Open Asset Model preserve assets and relationships for ongoing tracking rather than one-time enumeration.
• Flexible deployment: Source, Homebrew, official Docker, and Docker Compose options accommodate different self-hosted environments.
• No license fee: The free Apache-licensed plan removes per-seat or subscription charges.

Cons

• Technical overhead: Go, DNS, connectivity, credentials, and reconnaissance knowledge are prerequisites, making adoption harder for non-specialists.
• Not a complete testing suite: Business-logic and network testing are absent, so other tools remain necessary.
• License diligence: Separate licenses for some components complicate redistribution and internal policy checks.
• Community-only help path: Installation and usage support is routed to Discord rather than GitHub issues, which may not suit organizations requiring formal vendor support.

Alternatives

Choose Kali Linux instead when you want a free, open-source distribution spanning Android, Linux, macOS, self-hosted, and Windows rather than a focused asset-mapping framework.

Caido is the better fit for an API- and web-oriented workflow that benefits from a freemium Basic plan with two projects, seven workflows, three plugins, five filter presets, and one pipeline session at a time.

Pick Dradis when assessment collaboration and reporting are priorities; its free Community Edition is open source, limited to one project at a time, and supported through a community forum.

PenPeeper is a free option for personal or professional use, with restrictions on selling the software or hosting it as paid SaaS.

Pentesterra suits users wanting a freemium DevGuard Free plan with one project, three scans per month, CLI, IDE plugin, web console, and community support.

w3af is a free, open-source web application security scanner.

Aircrack-ng is a free software suite when wireless-focused tooling is the requirement.

Pentographer offers free self-hosted and cloud plans with all features.

Verdict

Choose OWASP Amass if you need a free, extensible way to discover external assets and retain a structured, long-term map of them. Look elsewhere if you need managed monitoring, formal assurance, or comprehensive network and business-logic testing in one product.