AMASS: COLLECT PUBLISHED NAMES FOR A DOMAIN YOU OPERATE, AND LEAVE ACTIVE MODE OFF

Names other datasets already hold

The job is a list of names that public datasets already associate with a domain you operate, each name still wearing the source that returned it. You stop when you can say which mode the binary actually ran. You do not need a longer list to finish.

OWASP Amass is the project that does the wider job. The v5 README describes it as network mapping of attack surfaces and external asset discovery, using open source information gathering and active reconnaissance. Both halves are in the sentence on purpose. This lesson is the information-gathering half. Zone transfers, brute force, name alterations, NSEC walking, and crawling the hosts are the other half, and they stay off the command line.

The licence is Apache-2.0. The v5 README checked for this lesson names Jeff Foley and the years 2017–2026. Running the tool for the exercise is ordinary use. A modified copy you ship later is the LICENSE file's problem, not a feeling about open source. You do not need the maintainer's biography to read a name list.

Two generations of the tool use the word passive, and they do not mean the same traffic.

The user guide on the repository's older master branch is the one a lot of packages and a lot of blogs still match. It describes three modes for amass enum. With neither flag, it seeds from data sources and uses DNS to validate what came back and to keep looking inside the domains you named. Active does that and then reaches the assets: TLS certificates, DNS zone transfers, NSEC walking, and web crawling. The guide's active example is amass enum -active -d example.com -p 80,443,8080. Passive, in the same section, "will only obtain information from data sources and blindly accept it." The command it prints is amass enum --passive -d example.com. The flag table calls -passive "a purely passive mode of execution." That sentence is the mode this lesson will run, and only when amass enum -h on your machine still describes the flag that way.

The v5.1.3 tag, published 25 October 2026, rewrote the help text and left a lot of the DNS in place. In internal/enum/cli.go at that tag, -passive is documented as "Deprecated since passive is the default setting." -active is "Attempt zone transfers and certificate name grabs." OverrideConfig in the same file sets Passive to false when -active is on. It never sets Passive to true when you pass -passive. The DNS plugin does not read the Passive field. dnsIP.query calls PerformQuery for addresses with no Active check. dnsSubs.query looks up NS and MX, and once the NS lookup succeeds it queries every SRV label from NamesByTier(Tier3). The comment in srv.go calls tier 3 opt-in. The call passes tier 3 anyway. The list includes ordinary mail and directory names and also _kpasswd and _kerberos. Those are DNS questions about service labels. They are not a password reset. They are also not a passive dataset read. Reverse lookups in dns/reverse.go are not behind the Active flag either. Active changes the width of an address sweep: the constants on the DNS plugin in that tag are 25, then 100, then 250 when Active is set. HTTP probe plugins return immediately when Active is false, and the CLI refuses -p unless Active is set, with the line "Ports can only be scanned in the active mode."

So a default amass enum -d example.com on v5.1.3 is not the user guide's "blindly accept" mode. Passing the deprecated flag does not turn the DNS off, because the flag is not applied. If your -h and this paragraph disagree, -h wins, and so does amass -version. A cheatsheet that cannot name its build is a souvenir.

Subcommands moved in the same generation. v5.1.3 amass -h lists assoc, engine, enum, subs, track, and viz. There is no intel and no db in that list. enum collects. subs reads what was stored. If your help text still has intel, you are on an older build. Leave intel for another day. The user guide's intel -whois example is reverse WHOIS, which is a different question about organisations, and it is not this exercise.

Data sources move too. amass enum -list prints the names the binary you installed actually has. The datasources.yaml shipped in the v5.1.3 tree leaves the credentialed sources commented out, including Chaos, SecurityTrails, VirusTotal, Shodan, and Hunter. A commented block is a source you did not ask. Uncommenting one means you have read that provider's terms and you meant to spend the key. crt.sh, in that tag, is compiled in. crtsh.query requests https://crt.sh/?CN= plus the name plus &output=json&exclude=expired. No API key is set in that function. Asterisk labels are stripped before the name is stored. Wayback, RapidDNS, DuckDuckGo, and Bing are compiled in beside it, in engine/plugins/load.go. Compiled in is not the same as "answered." A timeout, a block, or an empty body is an outcome. It is not evidence that the domain has no names.

One mislabel is worth catching before you brief it. In that tag, NewCrtsh sets Name() to crt.sh and sets Source.Name to the string HackerTarget. If a row cites HackerTarget and you never configured HackerTarget, check the build before you count two providers.

What you keep is a database, not a vibe. The asset-database docs say that with no database configured, Amass creates a local SQLite file in its configuration directory. OutputDirectory joins os.UserConfigDir() with amass. On a normal Linux desktop that is ~/.config/amass. The older user guide lists the same place, plus $XDG_CONFIG_HOME/amass and /etc/amass, and the Windows and macOS equivalents. The database remembers every domain you typed. It stays out of git.

The useful line is a name, the source, and the mode your help text says you ran. Volume is how a passive exercise starts sounding like a map.