OWASP Amass

OWASP Amass is an open-source framework for discovering and mapping internet-facing assets through OSINT and reconnaissance. It suits information security professionals who can work with network tooling and want to track assets over time. Its breadth and no-cost license are compelling, but setup requirements and separate licenses for some components call for care.

Overview

Amass brings together a collection engine, an asset database, and the Open Asset Model, which describes exposed assets and their relationships. That makes it more than a subdomain lookup tool: it is designed to map physical and digital assets and retain findings for longer-term tracking. For teams maintaining an external view of their attack surface, that combination offers a useful foundation; it is not a turnkey service for users seeking managed monitoring.

Key features

Collection draws on OSINT and active reconnaissance sources spanning APIs, certificates, DNS, routing, scraping, web archives, and WHOIS. This breadth can help security professionals build a wider picture of their external footprint, while requiring basic network reconnaissance knowledge and appropriate connectivity.

The asset database supports storing, managing, and retrieving findings, so discoveries can be tracked beyond a single run. The Open Asset Model provides a way to represent asset types, properties, and relationships. A first version of the engine REST API appears in the v5.1.1 release notes, giving the framework an API access point.

Deployment options include installation from source with Go, Homebrew, an official Docker image, and Docker Compose. Docker options can suit teams that prefer container-based deployment; source installation requires comfort with Go. Configuring data sources may involve credentials. Amass requires Go, network connectivity, DNS resolution, and basic network reconnaissance understanding.

Pricing

Amass is free: its OWASP Amass plan costs nothing and is an open-source framework under Apache License 2.0. There is no paid tier or free trial to weigh against it. The software may be redistributed or modified under Apache terms and is provided without warranties; some subcomponents have separate licenses, so teams should review those before adopting or redistributing the full framework.

Platforms

Amass supports Linux, macOS, and Windows, with self-hosted deployment. Its documented installation routes include Go, Homebrew, and Docker. This suits teams able to manage their own environment, rather than those who need a hosted platform.

Who it's for

Amass is best suited to information security professionals mapping external assets who can meet its technical requirements and manage their own deployment. Community help is available through its Discord server. The project asks users not to use GitHub issues for support requests or questions, so teams should be comfortable relying on community support rather than a formal support channel.

Pros and cons

• Pros: Free, open-source access makes a broad discovery framework available without a subscription.
• Pros: Collection, an asset database, and a model for asset relationships support discovery and longer-term tracking in one framework.
• Pros: Go, Homebrew, Docker, and Docker Compose provide several self-hosted installation paths.
• Cons: Go, DNS resolution, network access, and reconnaissance knowledge make it a poor fit for nontechnical users or teams seeking a managed tool.
• Cons: Separate licenses for some subcomponents add review work for organizations modifying or redistributing the software.
• Cons: Support is community-oriented, and GitHub issues are not meant for usage questions.

Alternatives

Choose Qualys External Attack Surface Management if a freemium option with a 30-day no-cost CSAM and EASM plan is a better fit than Amass's self-hosted framework.

runZero offers a free Community Edition capped at 100 assets, one organization, 10 recurring tasks, and 30 days of data retention, so it is worth considering when those defined limits suit your needs.

Bitdefender Total Security is a paid security suite with a free plan and trial; its listed individual plan covers five devices for $59.99 a year at the first-year price, plus applicable sales tax.

Detectify Surface Monitoring has a free Starter plan for up to five users and one team, but Surface Monitoring costs extra per domain; consider it if that team structure fits.

FullHunt offers a free plan with 10 credits per month for evaluation or internal use, covering discovery, enrichment, exposure, and vulnerability or exploit intelligence.

Ivanti Neurons for Zero Trust Access is a paid alternative with named-user licensing and custom pricing.

ImmuniWeb offers a 395.00 EUR-per-month mobile scan subscription priced per app, with unlimited scans of builds or versions of the same Android or iOS app.

Tenable One Attack Surface Management is a paid alternative whose Foundation plan includes attack surface management and unified visibility across IT, cloud, web applications, OT, and external attack surfaces.

Browse Attack Surface Management Software, API Security Testing Software, File Integrity Monitoring Software, Penetration Testing Software, Network Vulnerability Scanners, and Software Composition Analysis Software for related categories.

Verdict

Choose OWASP Amass if you are an information security professional who wants a free, self-hosted framework for broad external asset discovery and ongoing tracking. Its combination of collection, asset storage, and a shared asset model is the main reason to choose it; look elsewhere if you need managed deployment, formal support, or a low-friction tool without network reconnaissance requirements.