Run real OWASP Amass syntax against fictional lab domains - enumerate subdomains from passive and active sources and pull ASN/netblock intel. No real DNS or network lookup is ever made.
Ideal for: OSINT and recon-phase pentesting trainees learning Amass enum/intel syntax before running it against a real target.
What you'll practice
Run real amass syntax: "enum -d", "-passive", "intel -d" against fictional lab domains
Compare passive-only results against fuller active-style enumeration
Save and share your subdomain enumeration session as a practice report
Start practicing
Amass Simulator is part of Practice Tools. Sign in or create an account, then subscribe for ₦4,000/month to unlock it.
📋 Lab Instructions
Step-by-step lab exercises for this tool are coming soon - the simulator above is ready to use right now.