Skip to content
SPECIFICTION
Get listed

OWASP Amass

owasp.org

Free plan WindowsmacOSLinuxSelf-hosted
Visit owasp.org
Spec score 8.4 #2 of 18 in OSINT Tools

What it is

OWASP Amass is a free, open-source framework for mapping attack surfaces and discovering external assets using OSINT and reconnaissance. It combines a collection engine, an asset database, and the Open Asset Model, which describes internet-exposed assets and their types, properties, and relationships. Collection sources include APIs, certificates, DNS, routing, scraping, web archives, and WHOIS. The database can store, manage, and retrieve discoveries for long-term tracking. The project says its mapping covers physical and digital assets, going beyond basic subdomain enumeration. Installation options include building from source with Go, Homebrew, an official Docker image, and Docker Compose. The project lists Go, network connectivity, DNS resolution, and basic network reconnaissance knowledge as requirements. Amass runs on Linux, macOS, and Windows, with self-hosted deployment. The v5.1.1 release notes mention an initial version of the engine REST API. The project is an OWASP Flagship Project and lists Apache 2.0; some subcomponents have separate licenses. The software costs nothing.

Spec sheet

Purpose
OWASP Amass is an open source framework for network mapping of attack surfaces and external asset discovery using OSINT and reconnaissance techniques.Read 5 Oct 2026 · owasp.org
Intended users
The project describes its framework as helping information security professionals map attack surfaces and discover external assets.Read 5 Oct 2026 · owasp.org
Deployment
The documentation describes installation from source, a project-maintained Homebrew package, official Docker image, and Docker Compose.Read 5 Oct 2026 · owasp-amass.github.io
API
The v5.1.1 release notes mention a first version of the engine REST API.Read 5 Oct 2026 · github.com
Integrations
The project provides Docker and Docker Compose deployment options and documents configuring data sources with credentials.Read 5 Oct 2026 · owasp-amass.github.io
Support
The project asks users needing installation or usage help to use its Discord server, where community members can help.Read 5 Oct 2026 · github.com
License
The project page lists the Apache 2.0 license, and the repository notes that some subcomponents have separate licenses.Read 5 Oct 2026 · owasp.org
Founded
2001Read 28 Sep 2026 · owasp.org
Asset database
The asset database is described as supporting storage, management, and retrieval of discovered assets, including long-term tracking.Read 5 Oct 2026 · owasp-amass.github.io
Broader asset mapping
The documentation says Amass maps physical and digital assets and goes beyond basic subdomain enumeration.Read 5 Oct 2026 · owasp-amass.github.io
Collection and storage
The framework includes an asset discovery collection engine, an asset database for findings, and the Open Asset Model.Read 5 Oct 2026 · owasp.org
Core components
The framework includes an asset discovery collection engine, an asset database for findings, and the Open Asset Model for representing assets.Read 5 Oct 2026 · owasp.org
Data collection
The project lists OSINT and active reconnaissance capabilities, including API, certificate, DNS, routing, scraping, web archive, and WHOIS sources.Read 5 Oct 2026 · hub.docker.com
Data storage
The Asset Database supports storing, managing, and retrieving discovered assets for long-term tracking.Read 5 Oct 2026 · owasp-amass.github.io
Installation
The documentation describes installation from source with Go, through Homebrew, and via an official Docker image.Read 5 Oct 2026 · owasp-amass.github.io
License terms
The repository says the software may be redistributed or modified under the Apache License and is provided without warranties.Read 5 Oct 2026 · github.com
Maintainer
The project page names Jeff Foley as project leader.Read 5 Oct 2026 · owasp.org
Open Asset Model
The Open Asset Model represents assets exposed on the Internet and defines asset types, properties, and relationships.Read 5 Oct 2026 · owasp-amass.github.io
Operating system requirements
The project page lists Go, network connectivity, DNS resolution, and basic network reconnaissance knowledge as requirements.Read 5 Oct 2026 · owasp.org
Requirements
The project page lists Go, network connectivity, DNS resolution capabilities, and basic network reconnaissance understanding as requirements.Read 5 Oct 2026 · owasp.org
Security and compliance
The project page identifies OWASP Amass as an OWASP Flagship Project; the opened project pages state no security certifications or compliance attestations.Read 5 Oct 2026 · owasp.org
Support limitation
The repository asks users not to open GitHub issues for support requests or questions.Read 5 Oct 2026 · github.com

Plans and prices

OWASP Amass Free Open-source framework · Apache License 2.0 Read 5 Oct 2026 · owasp.org

Every OWASP Amass plan and price →

Strong points and limits

Strong points

  • Maps physical and digital assets
  • Uses OSINT and active reconnaissance
  • Asset database supports long-term tracking
  • Runs on Linux, macOS, and Windows
  • Free under an Apache 2.0 license

Limits

  • Requires Go, network connectivity, and DNS resolution
  • Project directs support questions to Discord
  • Some subcomponents have separate licenses

Who it suits

Amass is for information security professionals mapping attack surfaces and discovering external assets. It suits users able to meet the listed Go, network, DNS, and reconnaissance requirements.

Verdict

Amass combines asset discovery, a database, and a model for representing exposed assets, with several deployment options. It is free, but users should account for the stated technical requirements and separate licenses for some components.

Where Specifiction places it

Alternatives to OWASP AmassAll alternatives →