search

owasp-amass / amass

In-depth attack surface mapping and asset discovery
https://owasp.org/www-project-amass/
Other
11.95k stars 1.88k forks source link

[Feature Request] Support Output of CNAME Records #744

Open nscuro opened 2 years ago

nscuro commented 2 years ago

It'd be great if Amass could output CNAME records via its db and enum commands. At the moment, CNAME records are not marked as such (e.g. in JSON output), and are resolved to an IP address.

Having explicit CNAME declarations would make it easier for humans to spot potential subdomain takeover scenarios ("which of our domains is pointing to a vulnerable service?").

It'd also help in tracking which external services are referenced.
Reality foobar.example.com ➡️ baz.example.com ➡️ 1.2.3.4
Amass Output foobar.example.com ➡️ 1.2.3.4
baz.example.com ➡️ 1.2.3.4
Desired Output foobar.example.com ➡️ baz.example.com
anquanbiji commented 2 years ago

Is there any plan for this issue? I think it is very important function.