OWASP Amass vs Shodan Monitor
OWASP Amass
owasp.orgShodan Monitor
monitor.shodan.ioSide by side
| Figure | OWASP Amass | Shodan Monitor |
|---|---|---|
| Price from | Free | $69/mo |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | — |
| Plans published | 1 | 5 |
| Spec score · OSINT Tools | 8.4 (#2) | 7.3 (#6) |
| Spec score · Attack Surface Management Software | 8.1 (#9) | 7.2 (#24) |
| Intended users | The project describes its framework as helping information security professionals map attack surfaces and discover external assets. | Shodan describes monitoring uses for both individual IP owners and ISPs with millions of customers. |
| Purpose | OWASP Amass is an open source framework for network mapping of attack surfaces and external asset discovery using OSINT and reconnaissance techniques. | Shodan Monitor tracks Internet-connected devices in a network and sends real-time notifications when something unexpected appears. |
Plans
Shodan Monitor
- Membership$49, paid once
- Freelancer$69 a month
- Small Business$359 a month
- Corporate$1,099 a month
- EnterprisePriced on request
In their own words
OWASP Amass
OWASP Amass is a free, open-source framework for mapping attack surfaces and discovering external assets using OSINT and reconnaissance. It combines a collection engine, an asset database, and the Open Asset Model, which describes internet-exposed assets and their types, properties, and relationships. Collection sources include APIs, certificates, DNS, routing, scraping, web archives, and WHOIS. The database can store, manage, and retrieve discoveries for long-term tracking. The project says its mapping covers physical and digital assets, going beyond basic subdomain enumeration. Installation options include building from source with Go, Homebrew, an official Docker image, and Docker Compose. The project lists Go, network connectivity, DNS resolution, and basic network reconnaissance knowledge as requirements. Amass runs on Linux, macOS, and Windows, with self-hosted deployment. The v5.1.1 release notes mention an initial version of the engine REST API. The project is an OWASP Flagship Project and lists Apache 2.0; some subcomponents have separate licenses. The software costs nothing.
Shodan Monitor
Shodan Monitor has no write-up on Specifiction yet; its figures are above.