skills.rest
AeonDave
AeonDaveCOMMUNITY
Explore all skills by this author →
GitHub

amass

Enumerate subdomains and map attack surfaces for a domain.

15|1|Updated Feb 12, 2026
Search Tags:#reconnaissance#subdomain enumeration#dns#asset discovery#attack surface#osint
One-click install
npx skills add https://github.com/AeonDave/malskill --skill amass
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: amass
Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/recon/amass
Command: npx skills add https://github.com/AeonDave/malskill --skill amass

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps identify all digital assets associated with a domain, revealing potential vulnerabilities and mapping an organization's online presence.

Core Features & Use Cases

  • Subdomain Enumeration: Discover subdomains using passive and active techniques.
  • Asset Discovery: Identify related infrastructure and network assets.
  • Attack Surface Mapping: Gain a comprehensive view of an organization's digital footprint.
  • Use Case: When asked to perform deep reconnaissance on a target domain, use Amass to find all associated subdomains and IP addresses.

Quick Start

Use the amass skill to perform passive subdomain enumeration for example.com.

Frequently Asked Questions about amass

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform subdomain enumeration and map the attack surface for a target domain?▼

Subdomain enumeration and attack surface mapping are performed by utilizing passive OSINT techniques alongside active DNS probing and brute-force methods to discover subdomains, IPs, and related assets for a given domain.

What is the best way to discover related network assets and infrastructure during reconnaissance?▼

The best way to discover related network assets during reconnaissance is to run comprehensive attack surface mapping that combines passive OSINT data gathering with active DNS probing to identify an organization's digital footprint.

Does subdomain enumeration work without configuring external API keys?▼

Yes, subdomain enumeration works without API keys by relying on built-in passive OSINT techniques and active DNS brute-force probing, but configuring external data source API keys is supported to leverage enhanced discovery results.

Can I output discovered DNS records and asset data to files or directories?▼

Yes, you can output discovered DNS records and asset data to files or directories, as the configuration provides explicit options for directing enumeration results to specified file outputs or directory structures.

When should I use passive OSINT versus active DNS probing for asset discovery?▼

Use passive OSINT for stealthy asset discovery using external data sources, whereas active DNS probing and brute-force methods are utilized for deep, comprehensive subdomain enumeration and direct infrastructure mapping.

Related Skills

Explore More Software Engineering Skills→
valITinovalITino
7

osint-gathering

Collect passive OSINT data on target domains via public sources.

Community
Advanced
chainreactorschainreactors
235

gogo

Automate network reconnaissance to identify live hosts, open ports, and service fingerprints.

Official
Intermediate
macaughmacaugh
5

Automated Subdomain Enumeration

Enumerate subdomains via passive sources and active DNS techniques.

Community
Advanced
wgpsecwgpsec
1.6k

subdomain-deep

Enumerate subdomains via DNS brute-force, OSINT, and web crawling.

Official
Intermediate