Comparison Recon and ASM
Crossfyre vs Amass
A best-in-class subdomain tool vs a full distributed recon platform.
OWASP Amass is an excellent, free, open-source tool for subdomain enumeration and attack-surface mapping. It is one stage of recon, run on one machine, with output you parse yourself. Crossfyre does that stage too (its voyage engine combines passive OSINT with active DNS brute-forcing), then keeps going: distributing the work across your node fleet, chaining it into port and content discovery, surviving crashes, and turning the firehose into ranked findings.
Feature by feature
| Feature |  Amass | Crossfyre |
|---|---|---|
| Subdomain enumeration | Passive and active | Passive and active, via voyage |
| Scale | One machine | Across your node fleet |
| Ports and content discovery | Separate tools | pulse and mach, chained on |
| Scheduling and crash-safe runs | You manage it | Built in, resumes across failures |
| Dashboard, teams, findings history | no | yes |
| What you get back | Text and JSON to parse | Ranked findings and exports |
Every claim about the other tool is taken from its own documentation and pricing as of mid-2026. Re-check before quoting a number.
Standards
What it covers, and what it will not claim.
Pick a list. Every row that says yes names the class that does the work, and every row that says no says why, because a coverage matrix with no gaps in it is a brochure.
8 covered 1 partly 1 not claimed The list this engine was built against. Eight fully, one partly, and one that nothing on the outside can honestly report.
MITRE ATT&CK is deliberately not here. It describes what an adversary does across a whole intrusion, and almost all of a web scanner collapses into one technique in it. A six-row ATT&CK matrix would look impressive and tell you nothing, which is the opposite of what this section is for.
The honest take
Amass is a great tool and voyage owes a debt to the techniques it popularized. Use Amass if a single-stage CLI tool is all you need. Choose Crossfyre when you want subdomain enum as one orchestrated stage of a distributed, crash-safe, schedulable recon pipeline with triage on top.
Questions people ask
Does Crossfyre replace Amass?
For the subdomain stage, voyage covers the same passive-plus-active ground inside the platform. If you love Amass specifically, you can still run it standalone; Crossfyre is about orchestrating the whole pipeline, not just one tool.
Is voyage open source like Amass?
Yes. voyage, mach, and pulse are open-source Rust engines you can run standalone with no account. The platform adds the distributed orchestration, resilience, and triage around them.
More recon and asm comparisons
Everything else