What causes "IP address parsing failed" in owasp-amass/amass?

Only pass the flag when the value is non-empty (guard in the wrapper script)

IP address parsing failed

Error message

IP address parsing failed

What it means

ParseIPs.Set (flag.Value interface) was invoked with an empty string as the -cidr/ip flag value, so there is nothing to split into ranges or individual addresses and the guard fires immediately. Any non-empty input proceeds to parseRange/net.ParseIP handling instead.

Source

Thrown at config/scope.go:344

// ParseIPs represents a slice of net.IP addresses.
type ParseIPs []net.IP

func (p *ParseIPs) String() string {
	if p == nil {
		return ""
	}

	var ipaddrs []string
	for _, ipaddr := range *p {
		ipaddrs = append(ipaddrs, ipaddr.String())
	}
	return strings.Join(ipaddrs, ",")
}

// Set implements the flag.Value interface.
func (p *ParseIPs) Set(s string) error {
	if s == "" {
		return fmt.Errorf("IP address parsing failed")
	}

	ips := strings.Split(s, ",")
	for _, ip := range ips {
		// Is this an IP range?
		err := p.parseRange(ip)
		if err == nil {
			continue
		}
		addr := net.ParseIP(ip)
		if addr == nil {
			return fmt.Errorf("%s is not a valid IP address or range", ip)
		}
		*p = append(*p, addr)
	}
	return nil
}

View on GitHub (pinned to 79299dce87)

Solutions

Only pass the flag when the value is non-empty (guard in the wrapper script)
Provide at least one IP or range, e.g. --ips=192.168.1.0-192.168.1.255
Default the variable before expansion: IPS=${IPS:-192.168.1.1}

Example fix

// before
amass enum -ips=$IPS   # IPS empty -> error
// after
[ -n "$IPS" ] && amass enum -ips="$IPS"

Defensive patterns

Strategy: validation

Validate before calling

if strings.TrimSpace(ipsArg) == "" { skipFlag = true } // don't pass --ips at all

Type guard

func nonEmpty(s string) bool { return strings.TrimSpace(s) != "" }

Try / catch

if err := parseIPs.Set(value); err != nil { return fmt.Errorf("--ips flag: %w", err) }

Prevention

Default IP env vars before flag expansion
Conditionally include flags only when set
Validate IP inputs with net.ParseIP before passing
Never pass empty strings to flag.Value Set implementations

When it happens

Trigger: Calling Set("") on a ParseIPs flag value — e.g. an empty command-line flag value (--ips=) or programmatic assignment of an empty string instead of skipping the call.

Common situations: Shell variable holding the IP list is empty when expanded into the flag; scripting that always passes --ips=$IPS even when unset.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/2d48201ac53b9751. Report an issue: GitHub.