Amass

What is OWASP Amass?

The OWASP Amass Project has developed a tool to help information security professionals perform network mapping of attack surfaces and perform external asset discovery using open source information gathering and active reconnaissance techniques. To learn more about the Amass scanner itself visit OWASP Amass Project or Amass GitHub.

Deployment

The amass chart can be deployed via helm:

# Install HelmChart (use -n to configure another namespace)helm upgrade --install amass secureCodeBox/amass

Scanner Configuration

The following security scan configuration example are based on the Amass User Guide, please take a look at the original documentation for more configuration examples.

• The most basic use of the tool for subdomain enumeration: amass enum -d example.com
• Typical parameters for DNS enumeration: amass enum -v -src -ip -brute -min-for-recursive 2 -d example.com

Special command line options:

• Disable generation of altered names amass enum -noalts -d example.com
• Turn off recursive brute forcing amass enum -brute -norecursive -d example.com
• Disable saving data into a local database amass enum -nolocaldb -d example.com
• Domain names separated by commas (can be used multiple times) amass enum -d example.com

Requirements

Kubernetes: >=v1.11.0-0

Values

Key	Type	Default	Description
parser.env	list	[]	Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
parser.image.repository	string	"docker.io/securecodebox/parser-amass"	Parser image repository
parser.image.tag	string	defaults to the charts version	Parser image tag
parser.ttlSecondsAfterFinished	string	nil	seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
scanner.backoffLimit	int	3	There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy)
scanner.env	list	[]	Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
scanner.extraContainers	list	[]	Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
scanner.extraVolumeMounts	list	[{"mountPath":"/amass/output/config.ini","name":"amass-config","subPath":"config.ini"}]	Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
scanner.extraVolumes	list	[{"configMap":{"name":"amass-config"},"name":"amass-config"}]	Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
scanner.image.repository	string	"caffix/amass"	Container Image to run the scan
scanner.image.tag	string	nil	defaults to the charts appVersion
scanner.nameAppend	string	nil	append a string to the default scantype name.
scanner.resources	object	{}	CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/)
scanner.securityContext	object	{}	Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
scanner.ttlSecondsAfterFinished	string	nil	seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/

License

Code of secureCodeBox is licensed under the Apache License 2.0.

Examples

example.com

Scan

# SPDX-FileCopyrightText: 2021 iteratec GmbH## SPDX-License-Identifier: Apache-2.0
apiVersion: "execution.securecodebox.io/v1"kind: Scanmetadata:  name: "amass-example.com"spec:  scanType: "amass"  parameters:    - "-noalts"    - "-norecursive"    - "-nolocaldb"    - "-d"    - "example.com"

secureCodeBox.io

Scan

# SPDX-FileCopyrightText: 2021 iteratec GmbH## SPDX-License-Identifier: Apache-2.0
apiVersion: "execution.securecodebox.io/v1"kind: Scanmetadata:  name: "amass-securecodebox.io"  labels:    organization: "secureCodeBox"spec:  scanType: "amass"  parameters:    - "-noalts"    - "-norecursive"    - "-d"    - "securecodebox.io"