amass-enum

Find subdomains of a domain.

TLDR

Passively find subdomains of a domain

$ amass enum -passive -d [domain_name]
copy

Find subdomains of a domain and actively verify them attempting to resolve the found subdomains

$ amass enum -active -d [domain_name] -p [80,443,8080]
copy

Do a brute force search for subdomains

$ amass enum -brute -d [domain_name]
copy

Save the results to a text file

$ amass enum -o [output_file] -d [domain_name]
copy

Save the results to a database

$ amass enum -o [output_file] -dir [path/to/database_directory]
copy

Copied to clipboard
free 100$ digital ocean credit