amass-track

amass track [-d domain] [-since date] [-last n] [options]

amass track compares results from different enumeration runs to identify changes in an organization's external attack surface. It detects new subdomains, removed assets, and infrastructure changes.This is useful for continuous monitoring of an organization's digital footprint, alerting security teams to potential shadow IT or unauthorized changes.Note that track is a legacy subcommand. In Amass v4 it was moved out of the core amass binary into the separate oam-tools package (as oam_track), and the workflow was reworked again in Amass v5. On current Amass installations the amass track subcommand may not be available; check the version with amass -version.

-d domain

Domain to track

Compare against enumerations since date

Compare against the last n enumerations

Show all historical changes

Output file

Database directory

~/.config/amass/config.ini

Amass configuration file defining data sources, API keys, and scope settings.

Requires multiple enumeration runs stored in the database. Detection quality depends on consistency of enumeration settings. Large organizations may have frequent legitimate changes. The track subcommand is deprecated: it was removed from the core amass binary in v4 (moved to oam-tools as oam_track) and reworked again in v5, so it may be unavailable on current installations.

amass track was introduced to support continuous monitoring use cases, allowing security teams to detect attack surface changes over time. With the Amass v4 redesign the subcommand was split out into the oam-tools package as oam_track, and the tracking workflow was further reworked in Amass v5.

amass(1), amass-enum(1), amass-intel(1), amass-db(1)

Source code · Documentation