Alternatives to Amass
OWASP tool that maps an organisation's external attack surface and assets. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Amass
OWASP tool that maps an organisation's external attack surface and assets.
Replacements
Listings that take over the same core job as Amass.
SpiderFoot
Automated open-source intelligence collection with 200 modules.
SpiderFoot runs two hundred OSINT modules automatically with a web interface and graphing, though full coverage needs API keys for many third-party services.
theHarvester
Collect public information about domains during authorized research.
theHarvester collects public domain information from several data sources into structured results, without Amass's graph database or active reconnaissance, and some sources need API credentials.
Recon-ng
Modular web reconnaissance framework with a Metasploit-style interface.
Recon-ng offers a modular framework with a Metasploit-style interface and a workspace database, runs on macOS and Linux only, and many modules need third-party API keys.
Censys
An internet intelligence platform for searching hosts, services and TLS certificates across the internet.
Censys moves the work to a hosted, freemium web platform for searching hosts, services and TLS certificates, requiring an account and paid plans for the full enterprise features.
Shodan
A search engine that indexes internet-connected devices and the services they expose.
Shodan is a hosted, freemium search engine of exposed devices and services with monitoring alerts, and most useful features need a paid membership instead of running a local tool.
Maltego
Desktop tool for visually mapping relationships in OSINT investigations.
Maltego is a closed-source desktop tool that maps relationships visually through data transforms, and its free Community Edition has usage and feature limits.
Similar software
Related functionality, not a direct replacement.
Nuclei
A fast vulnerability scanner driven by YAML templates contributed by thousands of security researchers.
Sherlock
Finds accounts with a given username across hundreds of sites.
Holehe
Checks which services an email address is registered with.
Gobuster
Check candidate web paths and network names during security testing.
HackerTarget WhatWeb Scan
An online scan that runs WhatWeb and Wappalyzer to fingerprint the technologies behind a website.
Netcraft Site Report
A free web lookup that shows the hosting, server software and technologies behind any website.
