search

owasp-amass / amass

In-depth attack surface mapping and asset discovery
https://owasp.org/www-project-amass/
Other
11.63k stars 1.85k forks source link

bring back 3.19.1 #976

Open gprime31 opened 9 months ago

gprime31 commented 9 months ago

bring back 3.19.1

change.org

griveralfie commented 9 months ago

I agree. For simple tasks like DNS brute force enumeration, version 4 is now unbearable. I don't want to use the database, just give flags to produce a list of domains, IPs, CIDR ranges etc.

rynmrtn commented 9 months ago

We understand that previous versions of amass made this quite convenient. However, it also made maintenance of the tool more challenging as everyone was dependent upon the core team to provide CLI changes to get data out.

Given this, we made the decision to separate to enumeration capability from the data-extraction so that others could build better tooling on top of what amass collects.

It's early in the life of v4 but many of the tools you likely miss are available in the new tools repo. If what you need isn't there, this is an open-source project and we would love to have new contributors!

griveralfie commented 9 months ago

Thanks I'll take a look, I probably have the necessary skills to write some scripts that pull out of the database but good to see there is already a collection for stuff like this

griveralfie commented 9 months ago

We understand that previous versions of amass made this quite convenient. However, it also made maintenance of the tool more challenging as everyone was dependent upon the core team to provide CLI changes to get data out.

Given this, we made the decision to separate to enumeration capability from the data-extraction so that others could build better tooling on top of what amass collects.

It's early in the life of v4 but many of the tools you likely miss are available in the new tools repo. If what you need isn't there, this is an open-source project and we would love to have new contributors!

I have now played around to understand the database and tools to access it's data. There are many references in the documentation to the old version, such as when talking about the amass db command and screenshots are now outdated.

I don't feel confident enough about the program to write it up, but a documentation review could be something worth looking into for you guys

gprime31 commented 9 months ago

So now we need 2 tools to do the job that 1 tool used to do better... right.

griveralfie commented 9 months ago

So now we need 2 tools to do the job that 1 tool used to do better... right.

I made a 2 line bash script for subdomain enumeration, it's not so bad. But it is certainly less convenient than before

mzpqnxow commented 5 months ago

@rynmrtn I appreciate your patience in accommodating users by explaining this repeatedly. It's a thankless task

To those demanding to "bring amass 3.x back!" ...

It wasn't taken away

Pin yourself to a 3.x tag or commit ID and you're done. Nothing has changed for you

Sure, you won't necessarily get new features or bug-fixes, but you're always free to fork 3.x. Seeing as you seem to find the Amass 3 branch so good that you won't adapt to a new use-pattern, it seems you may not need any bug-fixes or enhancements anyway! ;)

If you're not a developer, then find someone who is willing to donate their time to maintaining a fork of 3.x

Note, I'm not an Amass developer and not represent any of the individuals associated with Amass. All opinions belong to me