BeginnerTools

theHarvester Guide: Email and Subdomain Gathering

Learn theHarvester for passive reconnaissance including email harvesting, subdomain discovery, IP enumeration, and virtual host identification.

#theharvester#OSINT#reconnaissance#email harvesting#subdomain enumeration

Why You Need theHarvester

You need to gather intelligence about a target before launching any active tests — theHarvester collects emails, subdomains, IPs, and virtual hosts from public sources like search engines, PGP servers, and Shodan. It is the first tool to run during passive reconnaissance.

Prerequisites

Understanding of OSINT concepts

Basic knowledge of DNS and web technologies

Authorization for target domains

How theHarvester Works

Search Engines: Google, Bing, Yahoo for email and domain info.

PGP Key Servers: Extract emails from PGP associations.

Certificate Transparency: Use crt.sh for subdomains via SSL logs.

DNS: Query DNS records for subdomain discovery.

Installation

sudo apt install theharvester

Basic Usage

theHarvester -d example.com -b google
theHarvester -d example.com -b google,linkedin,bing

Data Sources

theHarvester -d example.com -b google,bing,crtsh,dns
theHarvester -d example.com -b all -l 1000

Real-World Example

theHarvester -d target.com -b google,bing -l 500 -f target-recon.html
theHarvester -d target.com -b crtsh,dns -l 1000
theHarvester -d target.com -b google,bing,crtsh,dns,pgp -l 500 -v

Common Mistakes

Not using multiple sources. Overlooking rate limits. Trusting unverified results.

Best Practices

Use multiple sources. Save results to file. Verify with -v. Combine with other tools.

Related Tools

**Recon-ng**: Modular reconnaissance framework

**Maltego**: Graphical link analysis

**Amass**: In-depth subdomain enumeration

[OSINT Introduction](/articles/osint-introduction)

[Gobuster Guide](/articles/gobuster-guide)

Summary

theHarvester is an essential OSINT tool for gathering emails, subdomains, and IPs from public sources.

Knowledge Check

What can theHarvester gather?

What does `-b` specify?

How to verify discovered hostnames?

Why use multiple sources?

What does `-f` do?

Frequently Asked Questions

What is theHarvester?

theHarvester is an OSINT tool that gathers emails, subdomains, IPs, and virtual hosts from public sources like search engines, PGP key servers, and certificate transparency logs. It is pre-installed on Kali Linux.

What does the -b flag do in theHarvester?

The `-b` flag specifies the data source(s) to query, such as `google`, `bing`, `crtsh`, or `dns`. Use `-b all` to query every available source, or combine multiple sources for comprehensive results.

How do you verify discovered hostnames?

Use DNS resolution to verify discovered subdomains by checking if they resolve to valid IP addresses. Combine with tools like [dnsx](/tools/dnsx) or simple `dig`/ `nslookup` commands to validate each hostname.

Why use multiple data sources?

Different sources return different results. Search engines find indexed pages, crt.sh reveals certificate-registered subdomains, and DNS queries find hidden records. Combining sources maximizes coverage.

What does the -f flag do?

The `-f` flag saves results to an HTML file (e.g., `-f report.html`). This provides a formatted report of all discovered emails, subdomains, and IPs for documentation and further analysis.

What does the -l flag control?

The `-l` flag limits the number of results per source (e.g., `-l 500`). Setting this prevents excessive queries and keeps results manageable, especially when using broad sources like Google.

How does certificate transparency (crtsh) work?

crt.sh logs all SSL/TLS certificates issued by certificate authorities. By querying crt.sh, theHarvester discovers subdomains from certificate transparency records, which often reveal internal hostnames.

What does the -v flag do?

The `-v` flag enables verbose mode, showing DNS resolution results for discovered hostnames. This helps verify which subdomains are active without running separate DNS checks.