feat: add amass provider + fix subfinder timeout

- Add OWASP amass as second enum provider (passive mode)
- enum stage now runs subfinder + amass in parallel, merges & deduplicates
- Subfinder timeout now configurable via config (default: 30 min)
- Amass timeout configurable (default: 30 min)
- If amass binary not found, gracefully skips (subfinder-only fallback)
- Updated Dockerfile, config.example.yaml, README

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: badchars

Dockerfile

@@ -19,7 +19,8 @@ RUN go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest &&
     go install github.com/projectdiscovery/httpx/cmd/httpx@latest && \
     go install github.com/projectdiscovery/tlsx/cmd/tlsx@latest && \
     go install github.com/projectdiscovery/naabu/v2/cmd/naabu@latest && \
-    go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
+    go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest && \
+    go install github.com/owasp-amass/amass/v4/...@master
 
 # ── Stage 3: Final image ──
 FROM ubuntu:24.04

README.md

@@ -1,9 +1,9 @@
 <p align="center">
-  <img src="https://img.shields.io/badge/Go-1.25-00ADD8?style=flat-square&logo=go&logoColor=white" alt="Go">
+  <img src="https://img.shields.io/badge/Go-1.24-00ADD8?style=flat-square&logo=go&logoColor=white" alt="Go">
   <img src="https://img.shields.io/badge/Docker-Ready-2496ED?style=flat-square&logo=docker&logoColor=white" alt="Docker">
   <img src="https://img.shields.io/badge/License-MIT-green?style=flat-square" alt="License">
   <img src="https://img.shields.io/badge/CDP-Chromium-4285F4?style=flat-square&logo=googlechrome&logoColor=white" alt="CDP">
-  <img src="https://img.shields.io/badge/Providers-12-blueviolet?style=flat-square" alt="Providers">
+  <img src="https://img.shields.io/badge/Providers-13-blueviolet?style=flat-square" alt="Providers">
   <img src="https://img.shields.io/badge/DSL_Rules-60+-orange?style=flat-square" alt="DSL Rules">
 </p>
 
@@ -53,7 +53,7 @@ recon0 run target.com
      |
      v
  ┌────────────────────────────────────────────────────────────────────────────┐
- │  1. ENUM           subfinder         Passive subdomain enumeration        │
+ │  1. ENUM           subfinder+amass   Passive subdomain enumeration        │
  │  2. RESOLVE        dnsx          ◄── DNS gate: 0 results = stop          │
  │  3. PROBE          httpx + tlsx      HTTP probing, tech fingerprint, TLS │
  │  4. CRAWL          cdpcrawl          Headless Chrome + HAR + JS capture  │
@@ -117,6 +117,7 @@ go install github.com/projectdiscovery/httpx/cmd/httpx@latest
 go install github.com/projectdiscovery/tlsx/cmd/tlsx@latest
 go install github.com/projectdiscovery/naabu/v2/cmd/naabu@latest
 go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
+go install github.com/owasp-amass/amass/v4/...@master
 
 # Run
 ./recon0 run target.com
@@ -146,6 +147,7 @@ $ recon0 providers
 
   Provider       Stage        Status     Binary
   ──────────────────────────────────────────────────
+  amass          enum         enabled    /usr/local/bin/amass
   subfinder      enum         enabled    /usr/local/bin/subfinder
   dnsx           resolve      enabled    /usr/local/bin/dnsx
   httpx          probe        enabled    /usr/local/bin/httpx
@@ -229,6 +231,7 @@ recon0 status --remote 10.0.0.5:9090
 | Provider | Stage | Tool | Purpose |
 |----------|-------|------|---------|
 | `subfinder` | enum | [subfinder](https://github.com/projectdiscovery/subfinder) | Passive subdomain enumeration from 100+ sources |
+| `amass` | enum | [amass](https://github.com/owasp-amass/amass) | OWASP subdomain enumeration — DNS, scraping, certificates, APIs |
 | `dnsx` | resolve | [dnsx](https://github.com/projectdiscovery/dnsx) | DNS resolution, A/AAAA/CNAME records, takeover checks |
 | `httpx` | probe | [httpx](https://github.com/projectdiscovery/httpx) | HTTP probing, status codes, tech fingerprinting, CDN detection |
 | `tlsx` | probe | [tlsx](https://github.com/projectdiscovery/tlsx) | TLS certificate extraction, SAN enumeration, expiry checks |

config.example.yaml

@@ -34,8 +34,15 @@ api:
 providers:
   subfinder:
     enabled: true
-    # all: true       # use all passive sources
-    # recursive: true # recursive enumeration
+    timeout: 30        # minutes — per-source HTTP timeout
+    # all: true        # use all passive sources
+    # recursive: true  # recursive enumeration
+
+  amass:
+    enabled: true
+    timeout: 30        # minutes — overall enumeration timeout
+    # amass runs in passive mode (-passive) alongside subfinder
+    # both run in parallel, results are merged and deduplicated
 
   dnsx:
     enabled: true

go.mod

@@ -1,6 +1,6 @@
 module github.com/badchars/recon0
 
-go 1.23.0
+go 1.24
 
 require (
 	github.com/chromedp/cdproto v0.0.0-20250724212937-08a3db8b4327

internal/config/config.go

@@ -72,7 +72,8 @@ func Defaults() *Config {
 			Listen:  "0.0.0.0",
 		},
 		Providers: map[string]ProviderConfig{
-			"subfinder": {Enabled: boolPtr(true)},
+			"subfinder": {Enabled: boolPtr(true), Extra: map[string]any{"timeout": 30}},
+			"amass":     {Enabled: boolPtr(true), Extra: map[string]any{"timeout": 30}},
 			"dnsx":      {Enabled: boolPtr(true)},
 			"httpx":     {Enabled: boolPtr(true), Extra: map[string]any{"ports": []any{80, 443, 8080, 8443, 8000, 8888, 3000, 5000, 9090}}},
 			"tlsx":      {Enabled: boolPtr(true)},

internal/pipeline/stage.go

@@ -14,8 +14,8 @@ var Stages = []Stage{
 	{
 		Name:      "enum",
 		Desc:      "Subdomain enumeration",
-		Providers: []string{"subfinder"},
-		Parallel:  false,
+		Providers: []string{"subfinder", "amass"},
+		Parallel:  true,
 	},
 	{
 		Name:      "resolve",

internal/provider/amass.go

@@ -0,0 +1,53 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+	"os/exec"
+	"strconv"
+
+	"github.com/badchars/recon0/internal/config"
+)
+
+type Amass struct{}
+
+func (a *Amass) Name() string       { return "amass" }
+func (a *Amass) Stage() string      { return "enum" }
+func (a *Amass) OutputType() string { return "subdomains" }
+func (a *Amass) Check() error       { return CheckBinary("amass") }
+
+func (a *Amass) Run(ctx context.Context, opts *RunOpts) (*Result, error) {
+	extra := opts.Config
+	timeout := config.GetInt(extra, "timeout", 30) // minutes
+
+	args := []string{
+		"enum",
+		"-passive",
+		"-df", opts.Input,
+		"-timeout", strconv.Itoa(timeout),
+		"-o", opts.Output,
+	}
+
+	if config.GetBool(extra, "silent", true) {
+		args = append(args, "-silent")
+	}
+
+	cmd := exec.CommandContext(ctx, "amass", args...)
+	errFile, err := OpenLogFile(opts.LogDir, "amass")
+	if err == nil {
+		defer errFile.Close()
+		cmd.Stderr = errFile
+	}
+
+	if err := cmd.Run(); err != nil {
+		return &Result{OutputFile: opts.Output}, fmt.Errorf("amass: %w", err)
+	}
+
+	count := LineCount(opts.Output)
+	return &Result{
+		Count:      count,
+		OutputFile: opts.Output,
+	}, nil
+}
+
+func init() { Register(&Amass{}) }

internal/provider/subfinder.go

@@ -17,17 +17,18 @@ func (s *Subfinder) OutputType() string { return "subdomains" }
 func (s *Subfinder) Check() error       { return CheckBinary("subfinder") }
 
 func (s *Subfinder) Run(ctx context.Context, opts *RunOpts) (*Result, error) {
+	extra := opts.Config
+	timeout := config.GetInt(extra, "timeout", 30) // minutes, subfinder default
+
 	args := []string{
 		"-dL", opts.Input,
 		"-all",
 		"-recursive",
 		"-t", strconv.Itoa(opts.Res.ThreadsHeavy),
-		"-timeout", strconv.Itoa(int(opts.Res.TimeoutScan.Seconds())),
+		"-timeout", strconv.Itoa(timeout),
 		"-o", opts.Output,
 	}
 
-	// Config overrides
-	extra := opts.Config
 	if config.GetBool(extra, "silent", true) {
 		args = append(args, "-silent")
 	}