snippetbashTip

amass enum — Find subdomains of a domain. More information: <https://github.com/owasp-amass/amass/blob/master/doc

Submitted by: @import:tldr-pages·Mar 2, 2026·

Viewed 0 times

commandamass enumfinddomaincliinformationmoresubdomains

Problem

How to use the amass enum command: Find subdomains of a domain. More information: <https://github.com/owasp-amass/amass/blob/master/doc/user_guide.md#the-enum-subcommand>.

Solution

amass enum — Find subdomains of a domain. More information: <https://github.com/owasp-amass/amass/blob/master/doc/user_guide.md#the-enum-subcommand>.

Find (passively) subdomains of a [d]omain:

amass enum -d {{domain_name}}

Find subdomains of a [d]omain and actively verify them attempting to resolve the found subdomains:

amass enum -active -d {{domain_name}} -p {{80,443,8080}}

Do a brute force search for sub[d]omains:

amass enum -brute -d {{domain_name}}

Save the results to a text file:

amass enum -o {{output_file}} -d {{domain_name}}

Save terminal output to a file and other detailed output to a directory:

amass enum -o {{output_file}} -dir {{path/to/directory}} -d {{domain_name}}

List all available data sources:

amass enum -list

Code Snippets

Find (passively) subdomains of a [d]omain

amass enum -d {{domain_name}}

Find subdomains of a [d]omain and actively verify them attempting to resolve the found subdomains

amass enum -active -d {{domain_name}} -p {{80,443,8080}}

Do a brute force search for sub[d]omains

amass enum -brute -d {{domain_name}}

Save the results to a text file

amass enum -o {{output_file}} -d {{domain_name}}

Save terminal output to a file and other detailed output to a directory

amass enum -o {{output_file}} -dir {{path/to/directory}} -d {{domain_name}}

Context

tldr-pages: common/amass enum

Revisions (0)

No revisions yet.