No. 15 of 65 ·Software Composition Analysis Software

OWASP Amass

Windows · Mac · Linux · Self-hosted

Freedom report

Three barsScore 6.5

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely3 of 6 device platforms
DocumentedPlans, terms and facts published

OWASP Amass is ranked #15 of 65 in software composition analysis software on Freedom251. It runs on Linux, macOS, Self-hosted, Windows. There is a free plan.

OWASP Amass plans and pricing

All plans

OWASP Amass Free Open-source framework · Apache License 2.0 owasp.org · 5 Oct 2026

Compared on software composition analysis software

API discovery: Yes
Authentication testing: Yes
Authorization testing: Yes
Input-validation testing: Yes
Business-logic testing: No
Deployment: self-hosted
API formats: OpenAPI/Swagger, REST, GraphQL, gRPC

Best OWASP Amass alternatives

See all 20

Two bars Snyk Open Source Free tier No. 1$25/mo6.7 Two bars Sonatype Nexus Repository Free tier No. 2$162.50/mo6.7 Two bars Accessibility Test Framework for Android Free tier No. 3Free6.6 Two bars Docker Desktop Free tier No. 4$9/mo6.6 Two bars Endor Labs Free tier No. 5Free6.6 Two bars OpenSCA Free tier No. 6Free6.6

The record

Purpose: OWASP Amass is an open source framework for network mapping of attack surfaces and external asset discovery using OSINT and reconnaissance techniques.
Core components: The framework includes an asset discovery collection engine, an asset database for findings, and the Open Asset Model for representing assets.
Intended users: The project describes its framework as helping information security professionals map attack surfaces and discover external assets.
Open Asset Model: The Open Asset Model represents assets exposed on the Internet and defines asset types, properties, and relationships.
Data collection: The project lists OSINT and active reconnaissance capabilities, including API, certificate, DNS, routing, scraping, web archive, and WHOIS sources.
Asset database: The asset database is described as supporting storage, management, and retrieval of discovered assets, including long-term tracking.
Integrations: The project provides Docker and Docker Compose deployment options and documents configuring data sources with credentials.
Installation: The documentation describes installation from source with Go, through Homebrew, and via an official Docker image.
Operating system requirements: The project page lists Go, network connectivity, DNS resolution, and basic network reconnaissance knowledge as requirements.
License: The project page lists the Apache 2.0 license, and the repository notes that some subcomponents have separate licenses.
Security and compliance: The project page identifies OWASP Amass as an OWASP Flagship Project; the opened project pages state no security certifications or compliance attestations.
Support: The project asks users needing installation or usage help to use its Discord server, where community members can help.
Support limitation: The repository asks users not to open GitHub issues for support requests or questions.
License terms: The repository says the software may be redistributed or modified under the Apache License and is provided without warranties.
Price from: Free

Where it ranks on Freedom251

Best Software Composition Analysis Software in 2026#15 of 65
Best Penetration Testing Software in 2026#5 of 35
Best File Integrity Monitoring Software in 2026#7 of 29
Best Attack Surface Management Software in 2026#1 of 28
Best API Security Testing Software in 2026#2 of 27
Best Network Vulnerability Scanners in 2026#6 of 26

Is OWASP Amass yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OWASP Amass

Sources

owasp.org/projects/amass· checked 5 Oct 2026
owasp-amass.github.io/docs/· checked 5 Oct 2026
hub.docker.com/r/caffix/amass· checked 5 Oct 2026
github.com/owasp-amass/amass· checked 5 Oct 2026
github.com/owasp-amass/amass/releases· checked 5 Oct 2026
owasp.org/projects/api-security-testing-framework· checked 28 Sept 2026