OWASP Amass v5
Apache-2.0; components may vary
Files 05 to 09
The tool and source registry
268 tools, datasets and official sources across five libraries. Each entry keeps its licence or access tier, its honest limitation, and its official link. An open-source collector does not grant rights to collect from an upstream source.
Browse the registry
38 of 268 entries.
SpiderFoot
MIT
ProjectDiscovery Subfinder
MIT
Findomain
GPL-3.0
assetfinder
MIT
Cert Spotter
MPL-2.0
openrdap/rdap
MIT
gau
MIT
WappalyzerGo
MIT
webappanalyzer fingerprints
GPL-3.0
WhatWeb
GPL-2.0
ExifTool
Artistic License or GPL, same terms as Perl
Apache Tika
Apache-2.0
oletools
BSD-style package; bundled parts vary
FOCA
GPL-3.0
Metagoofil maintained fork
GPL-3.0-or-later
Gitleaks
MIT
detect-secrets
Apache-2.0
TruffleHog
AGPL-3.0
OSV-Scanner
Apache-2.0
crt.sh
no-key hosted CT search
Censys Free
hosted account/PAT
BuiltWith Free API
key, hosted free endpoint
GreyNoise Community
keyless limited or free key
urlscan.io Search
API key
AlienVault OTX
community API
Common Crawl
free CDXJ/JSON index and WARC
Wayback Machine
public archive
Arquivo.pt
free archive APIs, GPL-3.0 stack
GitHub REST Code Search
authenticated public-code search
Have I Been Pwned (HIBP) Pwned Passwords
no-key k-anonymity API/downloads
NVD
free feeds/API
CISA KEV
free JSON/CSV
FIRST EPSS
free daily CSV/API
OSV API
free
GitHub Advisory Database
CC-BY-4.0 data
ProjectDiscovery Chaos
account/API
LeakIX API
free key advertised for researchers
Collection modes
The connector profile decides whether a use is passive, not the product name. CM2 is routed to a separately scoped security engagement; CM3 is prohibited in this system.
| Mode | Meaning |
|---|---|
| CM0 | query third-party/open datasets or analyze already obtained artifacts; passive core |
| CM1 | low-impact direct retrieval such as an ordinary public page/DNS lookup or permitted rendered-page capture; policy and rate review required |
| CM2 | active resolution/probing, port/service interaction, or third-party scan submission; excluded and routed to a separately scoped security engagement |
| CM3 | authentication, credential validation, exploitation, disruption, or alteration; prohibited in this system |