Verified SOP & TutorialAudited Score 98/100

The Complete Production SOP: How to Deploy and Run OWASP Amass In-Depth Network Attack Surface Mapping in Autonomous AI Agents

Step-by-step SOP to install and run OWASP Amass attack surface mapping in Codex, Claude Code, and Cursor. Includes verified prompts, configs, and fixes.

View 1-Click Spec

Target Runtimes:codexclaude-codecursorwindsurf

5 min read • Updated for 2026

Technical Overview & Architectural Context

Without structured procedural guardrails, autonomous coding agents tasked with attack surface discovery frequently generate hallucinated subdomains, mix up passive OSINT with invasive active DNS brute-forcing, or run unthrottled queries that trigger rate limits and IPS blocks. Furthermore, agents often miss the crucial step of tracking differential changes across enumeration runs, failing to identify newly exposed cloud assets or dangling DNS pointers that leave organizations vulnerable to subdomain takeover. The OWASP Amass In-Depth Network Attack Surface Mapping skill enforces deterministic execution sequencing. It constrains the AI agent to follow a strict reconnaissance lifecycle: starting with purely passive intelligence collection (certificate transparency logs, search engines, WHOIS databases), escalating systematically to active DNS brute forcing and ASN sweeps only when explicitly permitted, and validating state transitions using Amass track. By binding workspace file access and strictly defining boundary rules, this skill prevents uncoordinated network probing and ensures output reproducibility.

Prerequisites & Environment Requirements

OWASP Amass v4.2+ binary installed locally and available in system PATH

Codex Desktop, Claude Code CLI, Cursor, or Windsurf installed with skill support

Workspace repository initialized with standard security audit directories (.amass/, reports/)

Verified Search Intents & Long-Tail Queries Solved

SEO Audit Score: 98/100

This operational tutorial is engineered to provide deterministic solutions for these developer search queries:

#install amass-in-depth-network-mapping in cursor ide#claude code amass-in-depth-network-mapping rules#codex desktop amass-in-depth-network-mapping setup tutorial#how to fix amass-in-depth-network-mapping agent execution error#OWASP amass attack surface mapping AI agent workflow#amass-in-depth-network-mapping sandbox permissions and security score#run amass enum claude code prompt triggers

Step-by-Step Execution Playbook

Local Environment Setup & SKILL.md Mounting

Create the local skill manifest directory and inject verified procedural rules into agent runtime path.

Agent runtimes such as Claude Code and Cursor scan predefined project locations (e.g., .agents/skills/ or .claude/skills/) to discover context directives. By writing the canonical SKILL.md file to the workspace, the agent parses frontmatter triggers like 'map attack surface amass' and automatically adopts the execution SOP when domain discovery tasks are detected.

Terminal Command

mkdir -p .agents/skills/amass-in-depth-network-mapping && curl -fsSL https://askills.dev/api/skills/amass-in-depth-network-mapping/raw -o .agents/skills/amass-in-depth-network-mapping/SKILL.md

.agents/skills/amass-in-depth-network-mapping/SKILL.md

---
name: "amass-in-depth-network-mapping"
description: "Map organizational attack surfaces using active and passive OSINT techniques."
metadata:
  author: "OWASP"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "map attack surface amass"
  - "run amass enum"
  - "track network assets owasp amass"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

Production Pro-Tip

Keep the SKILL.md instructions concise. Restricting Amass execution parameters inside the frontmatter rules saves up to 450 prompt tokens per conversation turn.

Sandbox Gotcha

The skill defaults shell_exec and net_access to false in the manifest metadata. The agent must orchestrate Amass commands via approved local scripts or request explicit user confirmation before initiating outbound sweeps.

Configuring Datasources and Resolvers

Inject verified Amass configuration and custom DNS resolvers to avoid poisoned or rate-limited responses.

Amass relies on a structured config.yaml to query passive threat-intelligence feeds (e.g., Shodan, Censys, VirusTotal) and active resolvers. To ensure deterministic results and avoid agent hallucinations during lookup failures, provide a curated config template in the project directory that isolates API keys in a local untracked file.

Terminal Command

mkdir -p config && cp config/datasources.yaml.example config/datasources.yaml && echo 'resolvers:
  - 1.1.1.1
  - 8.8.8.8' >> config/amass-config.yaml

Production Pro-Tip

Configure reliable public DNS resolvers explicitly in amass-config.yaml to avoid agent timeouts caused by faulty local ISP recursive resolvers.

Sandbox Gotcha

Never allow the agent to commit datasources.yaml containing production API keys. Always add config/datasources.yaml to your .gitignore before running enumeration.

Intent Matching & Trigger Invocation

Verify deterministic activation using tested natural language prompts.

Test that the agent runtime matches the intent against the frontmatter triggers. By prompting with standard phrases such as 'run amass enum' or 'map attack surface amass', the agent enters the SOP workflow, adhering strictly to passive-first discovery before attempting active DNS permutation.

Production Pro-Tip

Instruct the agent to output results in JSON Lines format (-json) to enable automated programmatic parsing and linting in subsequent steps.

Verification, Diffing & Dangling CNAME Remediation

Execute automated self-healing checks and diff tracking before accepting agent deliverables.

A complete attack surface enumeration must verify output integrity. The agent must run 'amass track' to identify state deviations between the current run and previous scans, flagging stale DNS entries or CNAME records pointing to unclaimed S3 buckets or Azure endpoints for immediate remediation.

Terminal Command

amass db -dir .amass -names -d example.com > ./reports/discovered_assets.txt && amass track -dir .amass -d example.com > ./reports/diff_report.txt

Production Pro-Tip

Review the generated diff_report.txt directly using git diff to quickly identify newly provisioned microservices or unmonitored shadow IT assets.

Real-World Scenario: Autonomous Attack Surface Mapping and Dangling CNAME Audit for 'corp.example.com'

Tested Trigger Prompt (Feed directly into Codex, Claude, or Cursor):

“Run amass enum to map the attack surface of corp.example.com using passive OSINT, check for dangling CNAME records, and document newly discovered assets in markdown.”

Deterministic Agent Verification Pipeline:

Step 1: Identifies the 'run amass enum' trigger and loads the amass-in-depth-network-mapping SOP from SKILL.md.

Step 2: Constructs and executes 'amass enum -passive -d corp.example.com -json ./reports/passive_results.json' to gather OSINT records without active network transmission.

Step 3: Parses the generated JSONL output, evaluates CNAME pointers against known dangling cloud provider patterns (e.g., AWS S3, GitHub Pages, Heroku), and compiles a structured audit report in ./reports/attack_surface_corp.md.

Runtime Troubleshooting & Failure Modes

Error: Failed to obtain the configuration file: yaml: line 14: did not find expected key

Root Cause: The agent generated an invalid config.yaml with misaligned indentation under the 'resolvers' or 'datasources' YAML block when configuring Amass.

Resolution Command / Fix:

yamllint config/amass-config.yaml && sed -i 's/	/  /g' config/amass-config.yaml

Error: amass: error: rate limit exceeded: API datasource returned HTTP 429

Root Cause: Unthrottled concurrent requests by the agent across passive API endpoints triggered vendor rate limiting, causing empty enumeration results.

Resolution Command / Fix:

amass enum -passive -d corp.example.com -config config/amass-config.yaml -max-dns-queries 50

Frequently Asked Questions (OWASP Amass In-Depth Network Attack Surface Mapping SOP)

Q:Can I use OWASP Amass In-Depth Network Attack Surface Mapping across Codex, Claude Code, and Cursor simultaneously?

Yes. The skill conforms to the universal SKILL.md specification. Runtimes including Claude Code, Codex Desktop, Cursor, and Windsurf parse the YAML metadata and markdown rules identically to steer model execution.

Q:How does OWASP Amass In-Depth Network Attack Surface Mapping prevent context window overflow during long agent sessions?

The skill instructs the agent to persist raw enumeration telemetry into local JSONL files and workspace databases (.amass/) rather than printing hundreds of raw DNS lines to standard output. This limits the context window load to summary statistics and actionable findings.

Q:Does this skill require escalated root or container permissions?

No. The skill is audited with a security score of 98/100. Standard passive and active DNS enumeration with OWASP Amass runs unprivileged in user-space, requiring only read/write access to the local project workspace.

Ready to equip your autonomous agent with OWASP Amass In-Depth Network Attack Surface Mapping?

Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.

Get 1-Click Install Spec