OWASP Amass on Ubuntu 24.04 on Azure User Guide

Overview

OWASP Amass is the OWASP Foundation's flagship tool for attack-surface mapping and external asset discovery. Point it at a domain you own and it discovers the subdomains, DNS records, TLS certificates, netblocks and autonomous systems that make up your external attack surface, drawing on open-source intelligence from certificate-transparency logs, passive DNS, WHOIS/RDAP and more than sixty data sources.

The cloudimg image is a ready-to-run attack-surface-mapping host, not just the binary. It ships a working configuration, an OSINT data-source API-key template you fill in to unlock the full source set, a persistent Open Asset Model (OAM) database so findings accumulate and can be queried, a daily scheduled enumeration over the domains you configure, and text reports for CI or SIEM pickup. Backed by 24/7 cloudimg support.

What is included:

• OWASP Amass 5.1.1 (/usr/local/bin/amass), installed from the official release binary and verified against the upstream SHA256 checksum
• A system configuration at /etc/amass/config.yaml and an OSINT data-source template at /etc/amass/datasources.yaml
• A persistent OAM asset database at /var/lib/amass (queryable with amass subs)
• amass-enum-run + amass-enum.timer - a daily passive enumeration of the domains in /etc/amass/scan.conf, writing text reports with latest-<domain> symlinks
• amass-selftest - a bounded self-test so you can prove enumeration works end to end
• A host firewall guard that keeps the collection engine (tcp/4000) reachable only from loopback
• 24/7 cloudimg support

This is a command-line product: no web UI, no admin account and no password. SSH on port 22 is the only open port, and the SSH key you choose at launch is the only way in.

Authorisation: only enumerate domains and assets you own or are explicitly authorised to assess. Unauthorised reconnaissance may be unlawful.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point. NSG inbound: allow 22/tcp from your management network only - no inbound application ports are needed. Outbound internet access is required for Amass to reach its OSINT data sources.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for OWASP Amass by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22). Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name owasp-amass \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

There is no password and no console to log in to - this product has no credentials. /etc/amass/credentials on the VM is an informational note that says exactly that and points at the paths below.

Step 4 - Confirm Amass is installed

amass -version

v5.1.1

The v5 subcommands are enum (collect), subs (query discovered names), viz (visualise), plus assoc, track and engine. The pre-v4 db and intel verbs are gone.

Step 5 - Run the built-in self-test

amass-selftest runs a bounded passive enumeration end to end so you can prove the scanner and its engine work before you point it at your own domains. It defaults to owasp.org:

amass-selftest owasp.org 1

Running a bounded passive enumeration of owasp.org (<= 1 min)...
(Passive is the default. Certificate-transparency and a few sources work with no
 API keys; add keys in /etc/amass/datasources.yaml to unlock the full source set.)
...
----
OAM asset database present: /var/lib/amass/asset.db
discovered 0 name(s) for owasp.org (enum exit 0)

Reading this result honestly: Amass is heavily driven by its data-source integrations. With no API keys configured, only a handful of keyless sources are queried, so a short run typically discovers few or no names - as above. That is expected, and it does not mean the tool is broken: the enumeration engine ran end to end and persisted its Open Asset Model database. Meaningful discovery comes from adding data-source API keys (Step 7).

Step 6 - Enumerate a domain

Run a passive enumeration directly. Passive is the default mode - it collects only from OSINT data sources and sends no packets to your target:

amass enum -d owasp.org -config /etc/amass/config.yaml -dir /var/lib/amass -timeout 1 -silent

Then list the names Amass has discovered for that domain from the asset database:

amass subs -d owasp.org -dir /var/lib/amass -names

To run an active enumeration (zone transfers, certificate name grabs and DNS resolution against the target), add -active. Only do this against infrastructure you are authorised to test.

Step 7 - Add OSINT data-source API keys (unlock discovery)

This is the single most important step for real results. Amass integrates more than sixty data sources; many require a free or paid API key. The image ships a ready template at /etc/amass/datasources.yaml with every source commented out:

sed -n '1,12p' /etc/amass/datasources.yaml

# these are the global options related to data sources.
global_options:
# minimum_ttl is the default used when datasources don't specify a larger ttl value.
  minimum_ttl: 1440 #one day

# uncomment and add credentials for data sources that you'd like to be used by the engine
datasources:
#  - name: 360PassiveDNS
#    ttl: 3600
#    creds:
#      account:
#        apikey: null

Uncomment the sources you have accounts for and paste in your keys, for example:

datasources:
  - name: AlienVault
    creds:
      account:
        apikey: YOUR_ALIENVAULT_KEY

Save the file, then re-run an enumeration - Amass will now query the sources you enabled. Keys live only on your VM; the file ships empty so no credential is ever baked into the image.

Step 8 - Scheduled enumeration and reports

amass-enum-run is the scheduled entry point. It reads /etc/amass/scan.conf, enumerates every domain in AMASS_TARGETS, and writes a text report per domain with a stable latest-<domain>.txt symlink your CI or SIEM can always read.

Your VM ships with AMASS_TARGETS empty, so the scheduled job does nothing until you configure it. Point it at a domain you own and run it once by hand:

sudo sed -i 's/^AMASS_TARGETS=.*/AMASS_TARGETS="owasp.org"/' /etc/amass/scan.conf
sudo amass-enum-run

[2026-07-19T15:44:10+0000] amass-enum-run: enumerating owasp.org (mode=passive, timeout=15m)
[2026-07-19T15:44:20+0000] amass-enum-run: owasp.org: 0 name(s) -> /var/lib/amass/reports/amass-owasp.org-20260719T154410Z.txt
[2026-07-19T15:44:20+0000] amass-enum-run: scheduled enumeration complete

The daily timer is enabled and armed out of the box:

systemctl is-enabled amass-enum.timer

enabled

Step 9 - Query the asset database

Findings accumulate in the OAM asset database at /var/lib/amass. Query it any time with amass subs:

amass subs -d owasp.org -dir /var/lib/amass -names -ip

-names prints discovered names; -ip adds their resolved addresses; -show prints the full result set. Amass also ships amass viz to generate graph visualisations of the asset database, and amass track to surface newly discovered assets between runs.

Configuration

The appliance configuration lives in /etc/amass/scan.conf:

grep -vE '^\s*#|^\s*$' /etc/amass/scan.conf

AMASS_TARGETS=""
AMASS_MODE="passive"
AMASS_TIMEOUT=15
AMASS_DIR="/var/lib/amass"
REPORT_DIR="/var/lib/amass/reports"
AMASS_CONFIG="/etc/amass/config.yaml"
REPORT_RETENTION_DAYS=30

• AMASS_TARGETS - space-separated domains the scheduled job enumerates (only domains you are authorised to assess).
• AMASS_MODE - passive (OSINT only, no packets to the target - the safe default) or active.
• AMASS_TIMEOUT - per-domain time budget in minutes.
• REPORT_RETENTION_DAYS - dated reports older than this are pruned.

After editing, restart the timer:

sudo systemctl restart amass-enum.timer

Amass's own scan behaviour (scope, ports, brute forcing) is in /etc/amass/config.yaml, and data-source keys are in /etc/amass/datasources.yaml.

Security

This image is hardened for a security tool:

• SSH only. Nothing listens on the network except sshd on port 22.
• Loopback-only collection engine. Amass v5's enum runs an embedded collection engine that binds tcp/4000. The image ships an nftables guard (amass-firewall.service) that drops any off-box access to that port, so the engine is reachable only from the VM itself even if a network rule were opened. Confirm it:

sudo nft list table inet amass_guard | grep -E 'dport 4000'

tcp dport 4000 drop

• No baked credential. The image ships no password of any kind, and /etc/amass/datasources.yaml ships empty - your API keys never leave your VM.
• Patched and self-updating. The OS is fully patched at capture and unattended security upgrades remain enabled.

Maintenance

• Data sources: add API keys in /etc/amass/datasources.yaml to widen coverage - this is what turns Amass from "runs" into "finds".
• Scheduled scans: run daily by amass-enum.timer; run one on demand with sudo amass-enum-run <domain>. Inspect history with journalctl -u amass-enum.service.
• Reports: text reports and latest-<domain>.txt symlinks under /var/lib/amass/reports.
• Upgrades: download a newer release from the OWASP Amass releases, verify it against the published amass_checksums.txt, and replace /usr/local/bin/amass.
• Security patches: unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.