OWASP Amass

7.0easy start · #15 of 65
in Software Composition Analysis Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you workyes

Runs on Linux, Mac, self-hosted, Windows.

OWASP Amass is ranked #15 of 65 in software composition analysis software on The Geeks Club. It runs on Linux, macOS, Self-hosted, Windows. There is a free plan.

OWASP Amass plans and pricing

All plans

OWASP Amass Free Open-source framework · Apache License 2.0 owasp.org · 5 Oct 2026

Compared on software composition analysis software

API discovery: Yes
Authentication testing: Yes
Authorization testing: Yes
Input-validation testing: Yes
Business-logic testing: No
Deployment: self-hosted
API formats: OpenAPI/Swagger, REST, GraphQL, gRPC

Best OWASP Amass alternatives

See all 20

Sonatype Nexus Repository 0 of 4 in the starter kit Lesson 18.0 Xygeni 0 of 4 in the starter kit Lesson 27.9 FOSSA 0 of 4 in the starter kit Lesson 37.7 Snyk Open Source 0 of 4 in the starter kit Lesson 47.4 Docker Desktop 0 of 4 in the starter kit Lesson 57.3 Socket 0 of 4 in the starter kit Lesson 67.3

The record

Purpose: OWASP Amass is an open source framework for network mapping of attack surfaces and external asset discovery using OSINT and reconnaissance techniques.
Core components: The framework includes an asset discovery collection engine, an asset database for findings, and the Open Asset Model for representing assets.
Intended users: The project describes its framework as helping information security professionals map attack surfaces and discover external assets.
Open Asset Model: The Open Asset Model represents assets exposed on the Internet and defines asset types, properties, and relationships.
Data collection: The project lists OSINT and active reconnaissance capabilities, including API, certificate, DNS, routing, scraping, web archive, and WHOIS sources.
Asset database: The asset database is described as supporting storage, management, and retrieval of discovered assets, including long-term tracking.
Integrations: The project provides Docker and Docker Compose deployment options and documents configuring data sources with credentials.
Installation: The documentation describes installation from source with Go, through Homebrew, and via an official Docker image.
Operating system requirements: The project page lists Go, network connectivity, DNS resolution, and basic network reconnaissance knowledge as requirements.
License: The project page lists the Apache 2.0 license, and the repository notes that some subcomponents have separate licenses.
Security and compliance: The project page identifies OWASP Amass as an OWASP Flagship Project; the opened project pages state no security certifications or compliance attestations.
Support: The project asks users needing installation or usage help to use its Discord server, where community members can help.
Support limitation: The repository asks users not to open GitHub issues for support requests or questions.
License terms: The repository says the software may be redistributed or modified under the Apache License and is provided without warranties.
Price from: Free

Where it ranks on The Geeks Club

Best Software Composition Analysis Software in 2026#15 of 65
Best Penetration Testing Software in 2026#10 of 35
Best File Integrity Monitoring Software in 2026#12 of 29
Best Attack Surface Management Software in 2026#8 of 28
Best API Security Testing Software in 2026#11 of 27
Best Network Vulnerability Scanners in 2026#9 of 26

Is OWASP Amass yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OWASP Amass

Sources

owasp.org/projects/amass· checked 5 Oct 2026
owasp-amass.github.io/docs/· checked 5 Oct 2026
hub.docker.com/r/caffix/amass· checked 5 Oct 2026
github.com/owasp-amass/amass· checked 5 Oct 2026
github.com/owasp-amass/amass/releases· checked 5 Oct 2026
owasp.org/projects/api-security-testing-framework· checked 28 Sept 2026