theHarvester

theHarvester is a broad OSINT collector that gathers emails, employee names, subdomains, ports, and banners from search engines and public APIs. Subfinder is a specialized subdomain-discovery tool that pulls from far more certificate transparency and DNS sources. Use theHarvester for people-and-email intelligence; use Subfinder for exhaustive subdomain enumeration.

Free sources that need no key include crtsh (certificate transparency), duckduckgo, bing, otx, rapiddns, and threatminer. Sources that require an API key include shodan, hunter, securitytrails, censys, and github. Add keys to the api-keys.yaml file; most providers offer a limited free tier.

Yes. theHarvester discovers emails passively through search engines (Google, Bing), LinkedIn, and Hunter.io without any DNS brute-force. The -s flag enables DNS brute-force for subdomains, not emails. For email-only discovery, omit -s and use -b google,bing,hunter.

Use the -f flag to write output to a file: theHarvester -d example.com -b all -f report. Modern versions produce an HTML report plus a JSON file. For CSV, parse the JSON output. Store one report per engagement with a dated filename and sanitize before sharing.

Yes. theHarvester is actively maintained by Christian Martorella (laramies) and contributors on GitHub, with regular releases that add new data sources and fix broken scrapers. Keep it updated with apt upgrade, pipx upgrade, or pulling the latest Docker image for reliable results.

theHarvester focuses on email and subdomain discovery from search engines and public APIs with a simple single-command interface. Recon-ng is a full-featured reconnaissance framework with modules for multiple OSINT tasks, database storage, and reporting. Use theHarvester for quick email discovery; Recon-ng for structured multi-phase campaigns.

theHarvester is a passive OSINT tool for gathering email addresses, subdomains, employee names, open ports, and banners from public sources. It queries search engines, certificate transparency logs, DNS databases, and security APIs to compile intelligence reports without directly interacting with the target.

theHarvester gathers publicly available information about a target domain including email addresses, subdomains, employee names, open ports, and service banners. It queries search engines (Google, Bing), certificate transparency logs (crt.sh), and APIs (Shodan, Hunter) to compile intelligence for penetration testing and security assessments.

Basic usage: theHarvester -d example.com -b google. For comprehensive results: theHarvester -d example.com -b all -s -f report.html. The -d flag specifies the domain, -b selects sources (google, bing, all, crtsh, shodan), -s enables DNS brute-force, and -f saves results to a file.

theHarvester comes pre-installed in Kali Linux. If missing, install with: sudo apt install theharvester. Update to the latest version: sudo apt update && sudo apt install theharvester. For the latest development version, clone from GitHub: git clone https://github.com/laramies/theHarvester.git.

Install on Ubuntu/Debian: sudo apt install theharvester. For the latest version, install via pip: pip3 install theHarvester. Alternatively, clone from GitHub: git clone https://github.com/laramies/theHarvester.git && cd theHarvester && pip3 install -r requirements.txt.

Update via apt: sudo apt update && sudo apt install theharvester. For pip installations: pip3 install --upgrade theHarvester. For GitHub installations: cd theHarvester && git pull && pip3 install -r requirements.txt. Check version with: theHarvester --version.

theHarvester supports 20+ sources: Search engines (google, bing, yahoo, duckduckgo, yandex), certificate transparency (crtsh, certspotter), DNS databases (dnsdumpster, passivetotal, virustotal, threatminer), APIs (shodan, hunter, securitytrails, github), and social (linkedin). Use -b all to query all sources.

Yes, email discovery is theHarvester's primary feature. It searches Google, Bing, LinkedIn, and Hunter for corporate email addresses. Use -b google for basic email discovery, -b linkedin for employee names, and -b hunter for corporate email patterns. Enable multiple sources for maximum coverage.

Yes, theHarvester discovers subdomains through search engine indexing, certificate transparency logs (crtsh), and DNS brute-force (-s flag). Search engines index subdomains in results; crt.sh logs SSL certificates; DNS brute-force guesses common names (api, dev, staging). Use -b all -s for maximum subdomain coverage.

theHarvester is legal when used with authorization on domains you own or have written permission to investigate. It uses only passive techniques querying public sources. However, always obtain explicit authorization before running it against any domain. Unauthorized reconnaissance may violate computer fraud laws.

No, theHarvester works without API keys using search engine sources (google, bing, crtsh). However, API keys for Shodan, Hunter, and SecurityTrails significantly expand results. Configure keys in config.yaml file. Free tiers are available for all three services.

Yes, theHarvester can run on Windows with Python 3 installed. Install via pip: pip3 install theHarvester. Alternatively, use WSL (Windows Subsystem for Linux) for a Linux-like environment. The tool works identically on Windows, Linux, and macOS.

Yes, theHarvester can run on Termux (Android). Install Python and theHarvester: pkg install python && pip install theHarvester. Some sources may have limited functionality on mobile due to network restrictions, but core email and subdomain discovery works.

theHarvester is used for passive OSINT reconnaissance in cyber security: email enumeration for phishing simulations, subdomain discovery for attack surface mapping, employee identification for social engineering, and domain intelligence gathering for penetration testing engagements.

theHarvester focuses on email discovery and basic subdomain enumeration from search engines and APIs. Amass provides deeper subdomain discovery with 40+ data sources, active DNS verification, and enterprise-level attack surface mapping. theHarvester is simpler and faster; Amass is more comprehensive but requires more configuration.

Yes, use the -b linkedin source: theHarvester -d example.com -b linkedin. This searches Bing for LinkedIn profiles associated with the target domain, extracting employee names and email patterns. Combine with -b google for additional email discovery. LinkedIn source results depend on Bing's indexing of public LinkedIn profiles.

Edit the config.yaml file in theHarvester's installation directory (~/.theHarvester/config.yaml or /etc/theharvester/config.yaml). Add your API keys for Shodan, Hunter, SecurityTrails, and other services. Free tiers are available for Shodan (limited queries), Hunter (50 requests/month), and SecurityTrails (50 queries/month). API keys significantly expand results beyond basic search engine sources.

theHarvester focuses on email and subdomain discovery from search engines and public APIs with a simple single-command interface. Recon-ng is a full-featured reconnaissance framework with modules for multiple OSINT tasks, database storage, and reporting. theHarvester is better for quick email discovery; Recon-ng is better for structured multi-phase reconnaissance campaigns.

Yes, use sources like crtsh (certificate transparency), dnsdumpster, and search engines (google, bing) which discover subdomains passively without DNS brute-force. The -s flag enables DNS brute-force which actively queries potential subdomain names. For passive-only discovery, omit -s and use -b crtsh,google,bing for results that do not directly interact with the target's DNS infrastructure.

Use the -f flag with an HTML output file, then convert to CSV: theHarvester -d example.com -b all -f results.html. For direct CSV, pipe results through text processing: theHarvester -d example.com -b all 2>&1 | grep -E '^[^@]*@' > emails.csv. The -f flag generates a structured HTML report with all discovered emails, subdomains, and hosts organized by category.

theHarvester requires API keys for full source functionality. Add your keys to /etc/theHarvester/api-keys.yaml: shodan: YOUR_KEY, hunterio: YOUR_KEY, securitytrails: YOUR_KEY, censys: YOUR_ID:YOUR_SECRET. Free tiers are available for Shodan (limited queries) and SecurityTrails (50 queries/month). Without API keys, only passive sources like crtsh and DNS work.

For red team operations, combine theHarvester's email discovery with password spraying using CrackMapExec. Run: theHarvester -d target.com -b all -f harvest.html to gather emails, then extract them for use in phishing campaigns or credential attacks. Use the -p flag to DNS-brute-force subdomains that may host vulnerable services, then chain with Nmap or Masscan for port scanning.

Yes, theHarvester can find employee names from LinkedIn, Hunter, and other professional sources using -b linkedin or -b hunter. Use the --limit flag to control the number of results. Employee names reveal organizational structure, identify high-value targets for social engineering, and help craft targeted phishing emails with realistic job titles.

Run both tools and merge results: theHarvester -d target.com -b all -f harvest.html && subfinder -d target.com -o subfinder.txt. Extract subdomains from theHarvester's HTML output and merge with subfinder results using: sort -u merged.txt. This passive combination avoids DNS brute-force detection while maximizing subdomain coverage from both tool databases.

Passive mode (-b crtsh,bing,duckduckgo) queries third-party sources without touching the target's infrastructure, generating zero network traffic to the target. Active mode adds -s for DNS brute-force, which actively queries potential subdomain names on the target's DNS servers. Use passive-only for stealthy recon and active for comprehensive discovery when detection is acceptable.

theHarvester itself is legal software, and querying public sources like search engines and certificate transparency logs is generally lawful because the data is already public. However, using the gathered emails, names, or subdomains to attack, phish, or access systems you do not own is illegal in most jurisdictions. Only run theHarvester against domains you own or have explicit written authorization to assess, such as a signed penetration-testing scope or an in-scope bug-bounty program.

Empty results usually mean the chosen source was rate-limited, blocked, or requires an API key you have not configured. Search engines like Google and Bing frequently throttle automated queries, so switch to -b crtsh or -b duckduckgo, add API keys for Shodan and Hunter, and confirm outbound DNS and HTTPS are not blocked by a proxy. Also verify the domain is spelled correctly and actually has public records — small or newly registered domains legitimately return little data.

theHarvester is a broad OSINT collector that gathers emails, employee names, subdomains, ports, and banners, making it ideal for the very first reconnaissance pass. Subfinder and Amass are specialized subdomain-discovery tools that pull from far more sources and scale to enterprise attack-surface mapping. In practice you run theHarvester first for people-and-email intelligence, then use Subfinder or Amass to exhaustively enumerate subdomains, and merge the results for maximum coverage.

Yes. theHarvester is a Python 3 application, so it runs anywhere Python 3.9+ is available. On macOS use Homebrew (brew install theharvester) or pipx; on Windows use pip inside a virtual environment or run it under WSL for the closest Linux-like experience. On Kali and most Debian-based Linux it is available directly via apt. Docker is the most portable option because it bundles every dependency.

Use the -f flag to write output to a file, e.g. theHarvester -d example.com -b all -f report. Modern versions produce an HTML report plus a JSON file you can feed into other tools, while older versions accept -f report.xml. Store one report per engagement with a dated filename, and sanitize it before sharing because it can contain internal hostnames and staff email addresses.

Free sources that need no key include crtsh (certificate transparency), duckduckgo, bing, otx, rapiddns, and threatminer. Sources that require an API key include shodan, hunter, securitytrails, censys, and github. Add keys to the api-keys.yaml file; most providers offer a limited free tier, so you can start without paying and upgrade only if you need higher query volumes.

Yes. theHarvester is actively maintained by Christian Martorella (laramies) and contributors on GitHub, with regular releases that add new data sources and fix broken scrapers as third-party sites change. Because sources break often, keeping theHarvester updated (apt upgrade, pipx upgrade, or pulling the latest Docker image) is important for reliable results.