Deployment guide

OWASP Amass

Overview

OWASP Amass is the OWASP Foundation's flagship tool for attack-surface mapping and external asset discovery. Point it at a domain you own and it discovers the subdomains, DNS records, TLS certificates, netblocks and autonomous systems that make up your external attack surface. It draws on open-source intelligence from certificate-transparency logs, passive DNS, WHOIS/RDAP and more than sixty data sources.

This SecureAnyCloud image is a ready-to-run attack-surface-mapping host, not just the binary. It ships a working configuration, a persistent asset database and a daily scheduled enumeration, so you can start mapping your own domains as soon as you add targets.

What you get:

OWASP Amass 5.1.1 (/usr/local/bin/amass), installed from the official release binary and verified against the upstream SHA256 checksum
A system configuration at /etc/amass/config.yaml and an OSINT data-source API-key template at /etc/amass/datasources.yaml that you fill in to unlock the full source set
A persistent Open Asset Model (OAM) asset database at /var/lib/amass, so findings accumulate and are queryable with amass subs
amass-enum-run and amass-enum.timer: a daily passive enumeration of the domains in /etc/amass/scan.conf, writing text reports with latest-<domain> symlinks for CI or SIEM pickup
amass-selftest: a bounded self-test that proves enumeration works end to end
A host firewall guard that keeps the collection engine (tcp/4000) reachable only from loopback
24/7 SecureAnyCloud support

This is a command-line product with no web UI, no admin account and no password. SSH on port 22 is the only open port, and the SSH key you choose at launch is the only way in.

Authorisation: enumerate only domains and assets that you own or are explicitly authorised to assess. Unauthorised reconnaissance may be unlawful.

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size.

Configure the NSG to allow inbound 22/tcp from your management network only. No inbound application ports are needed. Amass needs outbound internet access to reach its OSINT data sources.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for OWASP Amass by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:owasp-amass-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name owasp-amass \
  --image sac1647283583153:owasp-amass-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

There is no password and no console to log in to, because this product has no credentials. The file /etc/amass/credentials on the VM is an informational note that says so and points to the paths below.

Step 4 - Confirm Amass is installed

amass -version

v5.1.1

The v5 subcommands are enum (collect), subs (query discovered names) and viz (visualise), plus assoc, track and engine. The pre-v4 db and intel verbs are gone.

Step 5 - Run the built-in self-test

Run amass-selftest to prove the scanner and its engine work before you point Amass at your own domains. It runs a bounded passive enumeration end to end and defaults to owasp.org:

amass-selftest owasp.org 1

Running a bounded passive enumeration of owasp.org (<= 1 min)... (Passive is the default. Certificate-transparency and a few sources work with no API keys; add keys in /etc/amass/datasources.yaml to unlock the full source set.) ... ---- OAM asset database present: /var/lib/amass/asset.db discovered 0 name(s) for owasp.org (enum exit 0)

How to read this result: Amass depends heavily on its data-source integrations. With no API keys configured, it queries only a handful of keyless sources, so a short run typically discovers few or no names, as above. This is expected and does not mean the tool is broken. The enumeration engine ran end to end and persisted its Open Asset Model database.

Meaningful discovery comes from adding data-source API keys (Step 7).

Step 6 - Enumerate a domain

Run a passive enumeration directly. Passive is the default mode. It collects only from OSINT data sources and sends no packets to your target:

amass enum -d owasp.org -config /etc/amass/config.yaml -dir /var/lib/amass -timeout 1 -silent

Then list the names Amass has discovered for that domain from the asset database:

amass subs -d owasp.org -dir /var/lib/amass -names

To run an active enumeration, add -active. Active mode performs zone transfers, certificate name grabs and DNS resolution against the target. Run it only against infrastructure you are authorised to test.

Step 7 - Add OSINT data-source API keys (unlock discovery)

This is the most important step for real results. Amass integrates more than sixty data sources, and many require a free or paid API key. The image ships a template at /etc/amass/datasources.yaml with every source commented out:

sed -n '1,12p' /etc/amass/datasources.yaml

# these are the global options related to data sources. global_options:
# minimum_ttl is the default used when datasources don't specify a larger ttl value. minimum_ttl: 1440 #one day # uncomment and add credentials for data sources that you'd like to be used by the engine datasources:
# - name: 360PassiveDNS
# ttl: 3600
# creds:
# account:
# apikey: null

Uncomment the sources you have accounts for and paste in your keys. For example:

datasources: - name: AlienVault creds: account: apikey: YOUR_ALIENVAULT_KEY

Save the file, then re-run an enumeration. Amass now queries the sources you enabled. Keys live only on your VM, and the file ships empty so no credential is baked into the image.

Step 8 - Scheduled enumeration and reports

amass-enum-run is the scheduled entry point. It reads /etc/amass/scan.conf and enumerates every domain in AMASS_TARGETS. It writes a text report per domain, plus a stable latest-<domain>.txt symlink that your CI or SIEM can always read.

Your VM ships with AMASS_TARGETS empty, so the scheduled job does nothing until you configure it. Point it at a domain you own and run it once by hand:

sudo sed -i 's/^AMASS_TARGETS=.*/AMASS_TARGETS="owasp.org"/' /etc/amass/scan.conf
sudo amass-enum-run

[2026-07-19T15:44:10+0000] amass-enum-run: enumerating owasp.org (mode=passive, timeout=15m) [2026-07-19T15:44:20+0000] amass-enum-run: owasp.org: 0 name(s) -> /var/lib/amass/reports/amass-owasp.org-20260719T154410Z.txt [2026-07-19T15:44:20+0000] amass-enum-run: scheduled enumeration complete

The daily timer is enabled and armed from first boot:

systemctl is-enabled amass-enum.timer

enabled

Step 9 - Query the asset database

Findings accumulate in the OAM asset database at /var/lib/amass. Query it at any time with amass subs:

amass subs -d owasp.org -dir /var/lib/amass -names -ip

The -names flag prints discovered names, -ip adds their resolved addresses, and -show prints the full result set.

Amass also ships amass viz to generate graph visualisations of the asset database, and amass track to surface newly discovered assets between runs.

Configuration

The appliance configuration lives in /etc/amass/scan.conf:

grep -vE '^\s*#|^\s*$' /etc/amass/scan.conf

AMASS_TARGETS="" AMASS_MODE="passive" AMASS_TIMEOUT=15 AMASS_DIR="/var/lib/amass" REPORT_DIR="/var/lib/amass/reports" AMASS_CONFIG="/etc/amass/config.yaml" REPORT_RETENTION_DAYS=30

AMASS_TARGETS: space-separated domains that the scheduled job enumerates. List only domains you are authorised to assess.
AMASS_MODE: passive (OSINT only, no packets to the target, the safe default) or active.
AMASS_TIMEOUT: per-domain time budget in minutes.
REPORT_RETENTION_DAYS: dated reports older than this are pruned.

After editing, restart the timer:

sudo systemctl restart amass-enum.timer

Amass's own scan behaviour (scope, ports, brute forcing) is set in /etc/amass/config.yaml. Data-source keys go in /etc/amass/datasources.yaml.

Security

This image is hardened for a security tool:

SSH only. Nothing listens on the network except sshd on port 22.
Loopback-only collection engine. Amass v5's enum runs an embedded collection engine that binds tcp/4000. The image ships an nftables guard (amass-firewall.service) that drops any off-box access to that port. The engine is reachable only from the VM itself, even if a network rule were opened. Confirm the guard:

sudo nft list table inet amass_guard | grep -E 'dport 4000'

tcp dport 4000 drop

No baked-in credential. The image ships no password of any kind, and /etc/amass/datasources.yaml ships empty. Your API keys never leave your VM.
Patched and self-updating. The OS is fully patched at capture, and unattended security upgrades remain enabled.

Maintenance

Data sources: add API keys in /etc/amass/datasources.yaml to widen coverage. Keys are what turn Amass from "runs" into "finds".
Scheduled scans: amass-enum.timer runs them daily. Run one on demand with sudo amass-enum-run <domain>, and inspect history with journalctl -u amass-enum.service.
Reports: text reports and latest-<domain>.txt symlinks are under /var/lib/amass/reports.
Upgrades: download a newer release from the OWASP Amass releases, verify it against the published amass_checksums.txt, and replace /usr/local/bin/amass.
Security patches: unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch OWASP Amass on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

OWASP Amass is the OWASP Foundation's open source, Apache-2.0 licensed tool for attack-surface mapping and external asset discovery. Point it at a domain you own, or one you are explicitly authorised to test, and it discovers the subdomains, DNS records, TLS certificates, netblocks and autonomous systems that make up your external attack surface. It draws on open-source intelligence from certificate-transparency logs, passive DNS, WHOIS/RDAP and dozens of data sources.

This SecureAnyCloud image is a headless, ready-to-run asset-inventory appliance. You drive Amass with the amass command over SSH using your own key. Everything else is already in place when you connect.

What you get:

The pinned, checksum-verified Amass scanner and a system configuration
An OSINT data-source template and a persistent OWASP Open Asset Model (OAM) asset database
A daily passive enumeration schedule and CI/SIEM-friendly reports
No web interface, no service to log into and no credentials
SSH with your launch key as the only open port, with the embedded collection-engine port (tcp/4000) firewalled to loopback
No default credential of any kind and no baked-in API keys
An operating system that is fully patched at capture, with unattended security upgrades enabled

Authorised use only

Amass is a defensive asset-inventory and attack-surface-mapping tool. Use it only against domains you own or are explicitly permitted to assess. Enumerating third-party infrastructure that you are not authorised to test may be illegal in your jurisdiction.

This image ships with no targets configured. The default enumeration mode is passive open-source-intelligence collection, which sends no packets to your targets. Add only the domains you are authorised to enumerate.

The examples in this guide use owasp.org, the OWASP Foundation's own project domain, which is the tool's standard demonstration target.

Prerequisites

Before you deploy this image, make sure you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network
Outbound internet access from the instance, so Amass can reach OSINT data sources
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Connecting to Your Instance

This listing may offer more than one operating system variant. Connect over SSH on port 22 as the default login user for the variant you launched:

OS variant SSH login user

Ubuntu 24.04 LTS ubuntu

Use your EC2 key pair, for example:

ssh -i /path/to/your-key.pem ubuntu@<vm-ip>

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for OWASP Amass. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or another size that suits your workload. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, then create or select a security group that opens port 22 from your management network. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes a minute or two after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

Run the following command to launch an instance from the SecureAnyCloud OWASP Amass Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens port 22 from your management network.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --associate-public-ip-address \
  --metadata-options "HttpTokens=required" \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=owasp-amass}]'

Confirm the Scanner and the Armed Schedule

SSH in and confirm the pinned scanner, the armed enumeration timer and the loopback-only collection engine.

Check the installed version:

amass -version

Confirm that the scheduled enumeration timer and the collection-engine firewall guard are armed and running:

systemctl is-active amass-enum.timer amass-firewall.service

Check when the daily enumeration next runs:

systemctl list-timers amass-enum.timer --all --no-pager

Both units report active on a fresh instance. amass-enum.timer is armed and waiting, and amass-firewall.service keeps the embedded collection engine reachable from loopback only.

Prove Enumeration End to End with the Self-Test

Run the bundled self-test to confirm that the scanner, configuration and data sources work end to end before you point Amass at your own domains. It runs a short passive enumeration of owasp.org, exercises the collection engine and persists the OWASP Open Asset Model asset database:

$ amass-selftest owasp.org Running a bounded passive enumeration of owasp.org (<= 1 min)... Session Scope FQDN: owasp.org ---- OAM asset database present: /var/lib/amass/asset.db discovered 0 name(s) for owasp.org (enum exit 0)

A short passive keyless run establishes the session scope and writes the asset database, but it typically discovers few or no additional names. Add OSINT data-source API keys (Step 6) or use active mode (Step 9) for meaningful discovery.

The result that matters here is that the enumeration engine ran a real session end to end and persisted the asset database, which you can query at any time.

Configure the Domains You Are Authorised to Enumerate

The scheduled enumeration reads its targets from /etc/amass/scan.conf, which ships empty. View the file:

cat /etc/amass/scan.conf

Add to AMASS_TARGETS (space separated) only the domains you own or are explicitly authorised to assess. Open the file for editing:

sudo nano /etc/amass/scan.conf

For example, set AMASS_TARGETS="example.com example.net" and AMASS_MODE="passive". Then restart the timer so it picks up the change:

sudo systemctl restart amass-enum.timer

Add OSINT Data-Source API Keys (Optional, Unlocks Full Discovery)

Certificate-transparency and a few other sources work without keys, but Amass reaches its full potential with API keys for the OSINT data sources. The file /etc/amass/datasources.yaml ships fully commented, with dozens of source stanzas ready for your keys. The image includes no keys of its own. Open the file to add yours:

sudo nano /etc/amass/datasources.yaml

Uncomment the sources you have accounts for, paste your keys and re-run an enumeration. Keys you add stay on your instance.

The Scheduled Enumeration and Reports

A systemd timer runs a daily passive enumeration of your configured domains. Each run writes a dated text report under /var/lib/amass/reports/ and updates a stable latest-<domain>.txt symlink that your CI or SIEM can always read.

To trigger the scheduled runner on demand, run it for a domain you are authorised to enumerate:

sudo amass-enum-run <your-domain>

The runner writes /var/lib/amass/reports/latest-<your-domain>.txt for downstream pickup.

Query the OWASP Open Asset Model Asset Database

Every enumeration persists its findings in the OAM asset database at /var/lib/amass, so results accumulate over time. Query the discovered names for a domain at any time:

amass subs -d <your-domain> -dir /var/lib/amass -names

To generate a graph visualisation of the asset relationships, run:

amass viz -d <your-domain> -dir /var/lib/amass

Passive Versus Active Mode

The default mode is passive. Amass collects from open-source-intelligence data sources only and sends no packets to your targets.

For assets you own, you can switch to active mode. It additionally resolves names and performs light active reconnaissance, such as zone-transfer attempts and certificate name grabs. Set AMASS_MODE="active" in /etc/amass/scan.conf, or run an active enumeration directly:

amass enum -active -d <your-domain> -config /etc/amass/config.yaml -dir /var/lib/amass

Use active mode only against infrastructure you own or are explicitly authorised to test.

Security and Credentials

This image ships no credentials. Amass has no web interface, no API listener you log into and no admin account, so there is nothing to log in to and nothing to rotate. The only way in is SSH with the key you chose at launch.

Read the instance note, which documents the layout and contains no secrets:

cat /etc/amass/credentials

The embedded collection engine is firewalled to loopback, SSH with your key is the only open port, and unattended security upgrades keep the operating system patched. The data-source template ships with no keys, and any keys you add stay on your instance.

Support

SecureAnyCloud provides 24/7 technical support for this product by email and live chat.

Contact: sales@secureanycloud.com

Support covers configuring authorised enumeration targets, adding and troubleshooting OSINT data-source API keys, interpreting the asset database and reports, wiring the schedule and reports into a CI or SIEM pipeline, and switching between passive and active modes. Critical issues receive a one-hour average response.

Enumerate only domains you own or are authorised to assess. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them, including the OWASP Foundation.

Deploy on AWS

Launch OWASP Amass on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS