Comparison Recon and ASM
Crossfyre vs Amass
A best-in-class subdomain tool vs a full distributed recon platform.
OWASP Amass is an excellent, free, open-source tool for subdomain enumeration and attack-surface mapping. It is one stage of recon, run on one machine, with output you parse yourself. Crossfyre does that stage too (its voyage engine combines passive-source discovery with active DNS brute-forcing), then keeps going: distributing the work across your node fleet, chaining it into port and content discovery, surviving crashes, and turning the firehose into ranked findings.
Feature by feature
| Feature |  Amass | Crossfyre |
|---|---|---|
| Subdomain enumeration | Passive and active | Passive and active, via voyage |
| Scale | One machine | Across your node fleet |
| Ports and content discovery | Separate tools | doorward and ambulo, chained on |
| Scheduling and crash-safe runs | You manage it | Built in, resumes across failures |
| Dashboard, teams, findings history | no | yes |
| What you get back | Text and JSON to parse | Ranked findings and exports |
Every claim about the other tool is taken from its own documentation and pricing as of mid-2026. Re-check before quoting a number.
Standards
What it covers, and what it will not claim.
Pick a list. Every row that says yes names the class that does the work, and every row that says no says why, because a coverage matrix with no gaps in it is a brochure.
8 covered 1 partly 1 not claimed The list this engine was built against. Eight fully, one partly, and one that nothing on the outside can honestly report.
MITRE ATT&CK is deliberately not here. It describes what an adversary does across a whole intrusion, and almost all of a web scanner collapses into one technique in it. A six-row ATT&CK matrix would look impressive and tell you nothing, which is the opposite of what this section is for.
The honest take
Amass is a great tool and voyage owes a debt to the techniques it popularized. Use Amass if a single-stage CLI tool is all you need. Choose Crossfyre when you want subdomain enum as one orchestrated stage of a distributed, crash-safe, schedulable recon pipeline with triage on top.
Questions people ask
Does Crossfyre replace Amass?
For the subdomain stage, voyage covers the same passive-plus-active ground inside the platform. If you love Amass specifically, you can still run it standalone; Crossfyre is about orchestrating the whole pipeline, not just one tool.
Is voyage open source like Amass?
Yes. voyage, ambulo, and doorward are open-source Rust engines you can run standalone with no account. The platform adds the distributed orchestration, resilience, and triage around them.
More recon and asm comparisons
Everything else