Amass (T) alternatives
6 tools in the catalogue cover the same ground as Amass (T) and can replace it depending on the need. Each one is reachable, re-checked daily, and listed with its pricing.
- Subfinder (T)freeFast passive subdomain discovery utility that aggregates results from many curated OSINT and API-backed sources.
- Phonebook.czfreeFree OSINT intelligence tool for enumerating subdomains, email addresses and URLs associated with a target domain by querying passive DNS and certificate data.
- DNS DumpsterfreeFree domain research tool that discovers hosts and subdomains related to a domain. Provides DNS record enumeration (MX, TXT, Host) with a visual map of discovered infrastructure.
- crt.sh - Certificate SearchfreeCT log viewer aggregating certificate data from multiple Certificate Transparency logs. Search for all certificates ever issued to a domain to discover subdomains and detect certificate misuse.
- SpiderFoot (T)freeAutomated OSINT collection tool with 200+ modules for reconnaissance and threat intelligence.
- AADInternals (T)freePowerShell toolkit for Azure AD and Entra ID assessment, including tenant reconnaissance and hybrid identity attack-path analysis.
Amass (T)
Cloud Infrastructure
Also written Amass
Advanced attack surface mapping framework for DNS and subdomain enumeration with graph correlation and extensive data-source support.
RECOMMENDED USE
Comprehensive external attack-surface and subdomain mapping
Information
Video tutorials
Learn to use Amass (T)
Suggested workflow
Chain these tools in order for a complete investigation
Similar tools
These tools can also help you
SpiderFoot (T)
Cloud InfrastructureAutomated OSINT collection tool with 200+ modules for reconnaissance and threat intelligence.
SecurityTrails
Domain NameComprehensive DNS and domain intelligence platform. Access historical DNS records, WHOIS data, IP neighbors, subdomain enumeration and attack surface data for any domain.
ROADtools (T)
Cloud InfrastructureAzure AD exploration framework for dumping tenant objects, principals, and permissions to support attack-path and privilege analysis.
Subfinder (T)
Cloud InfrastructureFast passive subdomain discovery utility that aggregates results from many curated OSINT and API-backed sources.
User reviews
Be the first to leave a review