Lion Cipher Lab
Map your own attack surface with OWASP Amass
- Penetration Testing / Red Team
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Every organisation on earth owns more internet-facing things than it thinks it does. A marketing team spins up a landing page on a subdomain and forgets it. An engineer stands up staging.company.com for a two-week project in 2019 and it is still answering today. A cloud account nobody remembers still holds a public IP. That drift has a name — shadow IT — and it is where an enormous share of real breaches actually start, because you cannot patch, monitor, or decommission a server you do not know you have. OWASP Amass exists to close that gap: it is the mature, open-source framework for network…
What you'll learn
- defining 'attack surface' and 'subdomain enumeration' in plain language, and explaining why the defender needs them more than the attacker does
- installing OWASP Amass three ways (Docker, Homebrew, go install) and knowing which to pick
- telling Amass's PASSIVE engine apart from its ACTIVE engine — what each one sends, and to whom
- reading certificate transparency logs as a data source, and understanding why they are the highest-yield passive source in existence
- running amass enum against a domain you own and reading the output line by line
- enriching a run with amass intel (reverse WHOIS, ASN and CIDR pivots) and a config.yaml with data-source API keys
- checking scope properly before you enumerate anything: ownership, bug-bounty scope pages, and security.txt
- judgment: when Amass beats subfinder, when subfinder beats Amass, and what to pipe the results into next
Steps in this lab
- The two words this whole lab rests on: attack surface, and enumeration
- Certificate transparency — the highest-yield passive source, and probably new to you
- PASSIVE versus ACTIVE — the most important distinction in the tool
- Scope: the step that keeps this legal, and how to actually check it
- Which Amass do you have? (v4 and v5 are different tools wearing the same name)
- Install Amass — Docker is the zero-friction path
- Your first passive enumeration
- Read the output — and know which line came from where
- Enrich it: amass intel, and why your results are only as good as your data sources
- Keep the results: the database, and why one run is nearly worthless
- WHEN Amass is the right tool — and the three jobs where it is the wrong one
- Do it better — the five habits, and what the deliverable actually is