Post cover image
Photo by Clay Banks on Unsplash

July 18, 2026

I Found 400 Hidden Subdomains On My First Target Using One Free Tool

A beginner-friendly, no-fluff guide to mastering Amass for real-world recon

By Yamini Yadav_369

7 min read

The first time I ran Amass on a client's domain during a pentest engagement, I expected maybe 20 or 30 subdomains. That is what I usually got from basic tools. Instead, I got over 400 results. Staging servers nobody remembered. Old API endpoints still pointing to production databases. A forgotten Jenkins panel that had zero authentication on it.

That day I understood something simple. You cannot hack what you cannot see. And most companies cannot see half of their own internet facing assets. Amass is the tool that fixes that blind spot, and once you learn it properly, you will never look at recon the same way again.

This post is going to walk you through everything. What Amass actually is, how it works under the hood, every important command explained in plain English, and how to use it the smart way instead of just running one command and hoping for the best.

What Is Amass

Amass is a free and open-source tool built by OWASP for something called attack surface mapping. In simple words, it finds all the subdomains, IP addresses, and network information connected to a target domain.

Think of a company's main website like the front door of a house. Amass is the tool that walks around the entire property and tells you about every window, every side door, every basement entrance, and even that old shed at the back that nobody locks anymore.

Security engineers, bug bounty hunters, and penetration testers use it because before you can test anything, you need to know what actually exists. You cannot attack a target you do not know is there.

Why Subdomain Enumeration Even Matters

Before we touch commands, you need to understand why this step matters so much.

Most companies focus all their security budget on the main website. example.com gets a firewall, a WAF, regular audits, the works. But what about dev.example.com or old-api.example.com or test-payments.example.com? These get created for a project, forgotten after launch, and left running with outdated software and weak security.

These forgotten subdomains are gold for attackers and for ethical hackers doing their job properly. Amass helps you find them systematically instead of guessing.

How Amass Actually Works

Amass does not just guess subdomain names randomly. It uses several techniques together, and understanding these will help you use the tool much better.

Passive recon This means Amass pulls information from public sources without ever sending a single packet to the target. It checks certificate transparency logs, DNS databases, search engines, and dozens of other open sources. Since nothing touches the target directly, this method is completely silent and safe to run on any domain.

Active recon This means Amass directly interacts with the target's DNS servers. It tries brute forcing subdomain names, checks zone transfers, and does reverse DNS lookups. This is louder and can sometimes be noticed by the target, so use it carefully and only on domains you have permission to test.

API integrations Amass connects with services like Shodan, VirusTotal, SecurityTrails, and Censys if you give it API keys. More API keys mean more data sources checked, which means more subdomains found.

Data correlation Once Amass collects all this raw data, it maps out the relationships between subdomains, IP addresses, and ASNs so you get a clear picture of the entire network, not just a flat list of names.

Installing Amass

Getting Amass running is simple.

On Kali Linux, it usually comes preinstalled. If not:

sudo apt install amass

If you are using Go, you can install the latest version directly:

go install -v github.com/owasp-amass/amass/v4/...@master

Check if it installed correctly:

amass -version

If you see a version number printed back, you are ready to go.

The Core Commands Explained In Simple English

This is the part most guides skip over quickly. I am going to slow down here because understanding what each flag does will save you hours of confusion later.

1. Basic passive enumeration

Command:

amass enum -passive -d example.com

What it means in plain English: "Go check public sources only, do not touch the target directly, and find every subdomain you can for example.com."

When to use it: This is your starting point on almost every engagement. It is safe, silent, and fast. Always run this first before anything active.

2. Active enumeration

Command:

amass enum -active -d example.com

What it means: "Go find subdomains and also directly query the target's DNS servers to confirm they are real and alive."

When to use it: Once you have written permission to test a target actively, this gives you a much deeper and more accurate result because Amass verifies things instead of just listing names it found online.

3. Saving output to a file

Command:

amass enum -passive -d example.com -o results.txt

What it means: "Do the same passive scan, but instead of dumping everything on my screen, save it neatly into a file called results.txt."

When to use it: Always. You will want to compare results across different days, feed this into other tools like httpx or nuclei, or just keep records for your report.

4. Brute forcing subdomains

Command:

amass enum -brute -d example.com

What it means: "Take a wordlist of common subdomain names like dev, staging, test, api, and try each one against example.com to see if it resolves."

When to use it: Great for finding subdomains that are not indexed anywhere publicly, since brute force does not rely on public data, it just tries names directly.

5. Using your own wordlist for brute forcing

Command:

amass enum -brute -d example.com -w mywordlist.txt

What it means: "Instead of using the built in list, use my custom wordlist to try subdomain names."

When to use it: Custom wordlists built from a specific industry or company naming pattern often find things generic lists miss. If a company uses names like "portal-uae" or "app-fintech", a targeted wordlist finds these much faster.

6. Checking multiple domains at once

Command:

amass enum -passive -df domains.txt

What it means: "Here is a text file with a list of domains, go run passive recon on all of them together."

When to use it: Useful when a company owns multiple brands or domains and you need to map the whole organization's footprint in one go.

7. Limiting DNS queries per second

Command:

amass enum -active -d example.com -max-dns-queries 200

What it means: "Do active recon, but slow yourself down and only send 200 DNS queries per second so you do not overload or trigger alerts on the target's systems."

When to use it: Important on client engagements where being noisy could trigger security monitoring tools or get your IP blocked mid-scan.

8. Excluding certain data sources

Command:

amass enum -passive -d example.com -exclude crtsh

What it means: "Do the passive scan but skip the crt.sh certificate transparency source specifically."

When to use it: Sometimes one data source gives noisy or unreliable results for a specific target, and excluding it cleans up your final list.

9. Viewing the network graph

Command:

amass viz -d3 -d example.com

What it means: "Take everything you found for this domain and draw me a visual map showing how subdomains, IPs, and networks connect to each other."

When to use it: Perfect for reports and presentations. Clients understand a visual attack surface map much faster than a plain text list of 400 subdomains.

10. Getting intel on IP ranges and ASN information

Command:

amass intel -org "Company Name"

What it means: "Search for every domain and IP range publicly associated with this company name."

When to use it: This is amazing for the very first stage of recon when you only know the company name and nothing else. It helps you discover domains you did not even know belonged to the target.

Command:

amass intel -d example.com -whois

What it means: "Find other domains that might be registered by the same person or organization that owns example.com."

When to use it: Companies often register similar sounding domains for different products or regional offices. This command helps uncover those related properties.

12. Checking database and configuring settings

Command:

amass db -names -d example.com

What it means: "Show me all the subdomain names Amass has already stored in its local database for this domain from previous scans."

When to use it: Amass keeps a history of everything it finds. This command lets you pull past results without running the whole scan again.

Here is how I actually structure my recon using Amass on a real engagement, step by step.

  1. Run passive enumeration first and save to a file. This is safe and gives a baseline.
  2. Run the intel command with the organization name to catch any related domains outside the main scope.
  3. Once scope and permission are confirmed for active testing, run active enumeration with a controlled query rate.
  4. Run brute force with a custom wordlist built specifically for the target's industry.
  5. Combine all output files and remove duplicates.
  6. Feed the final subdomain list into a tool like httpx to check which ones are alive and returning a web response.
  7. Generate a visual graph for the final report.

This flow alone will put you ahead of most people who just run one basic command and call it recon.

Common Mistakes Beginners Make

Running active scans without permission is the biggest one. Passive recon is generally considered safe since it only uses public data, but active recon touches the target directly and should only happen within an authorized scope.

Another common mistake is ignoring the wordlist quality for brute forcing. A generic wordlist gives generic results. Spend time building or finding wordlists relevant to the industry you are testing.

Many beginners also forget to add API keys for services like Shodan or VirusTotal in the config file. Without these keys, Amass is working with a fraction of its real power. Take ten minutes to set up free tier API keys and you will see a noticeable jump in results.

Amass is one of those tools that looks intimidating at first because of how many flags and options it has, but once you understand the logic behind passive versus active recon, everything clicks into place. The tool is not magic. It is systematic, and that is exactly why it works so well.

Start every engagement with passive enumeration. Move to active only when you have permission. Build good wordlists. Save and organize your output. Do this consistently and your recon phase will always be stronger than the person who just runs one quick command and moves on.

If this helped you understand Amass better, follow The First Digit for more practical security tool breakdowns written the way they should be, simple, honest, and based on real testing experience.