OWASP Amass

OWASP Amass is a self-hosted framework for information security professionals mapping internet-facing assets and attack surfaces. Its combination of varied reconnaissance sources and persistent asset tracking is compelling for technical teams; it is a poor fit for buyers seeking a managed, turnkey service.

Overview

Amass brings asset discovery, storage, and a shared model for describing assets into one framework. It goes beyond basic subdomain enumeration to map physical and digital assets, making it useful for teams that need a continuing picture of their external footprint rather than a one-off lookup. The trade-off is ownership: users must install and operate the software, provide network access and DNS resolution, and bring basic reconnaissance knowledge.

The project is an OWASP Flagship Project. Its Apache 2.0 license permits redistribution and modification, but the repository notes that some subcomponents use separate licenses; review those terms before incorporating them. The software is supplied without warranties.

Key features

The collection engine combines OSINT and active reconnaissance, drawing on APIs, certificates, DNS, routing, scraping, web archives, and WHOIS. This range can help security professionals build a broader external asset view, though it also depends on suitable connectivity and correctly configured data sources. Amass documents credentials for those sources, so integrations require configuration rather than simply being switched on.

The Asset Database stores, manages, and retrieves discovered assets for long-term tracking. The Open Asset Model defines asset types, properties, and relationships, giving findings a structure beyond a raw list of domains. A first version of the engine REST API is also noted in the v5.1.1 release notes. Together, these capabilities suit ongoing mapping workflows better than teams looking only for a quick scan.

Installation routes include building from source with Go, a project-maintained Homebrew package, an official Docker image, and Docker Compose. These choices give technical users flexibility in how they deploy, but they do not remove the need to understand the underlying runtime and network environment.

Pricing

Amass is free and open source. The OWASP Amass plan costs nothing and includes the framework under Apache License 2.0. There is no free trial because the software is already free. There are no published paid tiers or seat-based plan limits in this offering; users should still check separate licenses for subcomponents.

Platforms

Amass supports Linux, macOS, and Windows, with self-hosted deployment. The documented Go, Homebrew, and Docker installation routes provide options across technical environments, while Go, network connectivity, DNS resolution, and basic network reconnaissance knowledge remain practical prerequisites.

Who it's for

Amass is best suited to information security professionals and technically capable teams that need to discover external assets, map relationships, and retain findings over time. It is less appropriate for organizations that want a managed monitoring service or lack the technical capacity to configure reconnaissance sources and operate a self-hosted tool. For support, the project directs installation and usage questions to its Discord community and asks users not to open GitHub issues for support requests.

Pros and cons

• Pros: Broad OSINT and active reconnaissance sources can support a wider view of exposed assets than basic subdomain enumeration alone.
• Pros: An asset database and Open Asset Model support structured findings and longer-term tracking.
• Pros: Free, self-hosted deployment and several installation routes give technical teams control over how they run it.
• Cons: Go, connectivity, DNS, and reconnaissance knowledge create a meaningful setup and operation burden.
• Cons: Separate licenses for some components and the software's no-warranty terms call for review before adoption.
• Cons: Community support through Discord, rather than GitHub support issues, may not suit teams expecting a formal support channel.

Alternatives

For a different approach to attack surface management, compare Qualys External Attack Surface Management, which offers a 30-day, no-cost CSAM with EASM plan and a free trial. runZero is worth considering when its Community Edition's 100-asset, one-organization, 10-recurring-task and 30-day-retention limits fit the need, with a free trial also available.

Detectify Surface Monitoring has a free Starter plan for up to five users and one team, though Surface Monitoring costs extra per domain; it may suit teams considering that paid-per-domain approach. FullHunt offers a free plan with 10 monthly credits for evaluation or internal use, covering discovery, enrichment, exposure, and vulnerability or exploit intelligence, which may fit narrower exploratory use.

Bitdefender Total Security is a device security product rather than an asset-mapping framework, so consider it only if that is the need. ImmuniWeb provides a mobile-app security offering, making it a more relevant option for app-focused scanning. Censys Attack Surface Management uses asset-based pricing with a quote required. Check Point External Risk Management is another paid alternative.

Browse Attack Surface Management Software, API Security Testing Software, Penetration Testing Software, Network Vulnerability Scanners, File Integrity Monitoring Software, and Software Composition Analysis Software for adjacent categories.

Verdict

Choose OWASP Amass if your security team wants a free, self-hosted framework that combines broad external asset discovery with structured, long-term tracking and can manage the technical setup. Look elsewhere if you need a turnkey service, formal support, or a lower operational burden.