arsenal/theHarvester

theHarvester

OSINT recon · GPL-2.0

Gathers subdomains, hostnames, emails, and IPs from public sources to map a target's footprint before a single packet is sent.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01Passive recon, the quiet first move

Everything else in the arsenal touches the target. theHarvester does not. It queries public sources, search engines, certificate transparency logs, DNS datasets, and the like, to assemble what the world already knows about a domain: its subdomains, host names, email addresses, and associated IPs. Done first, it draws the map that tells the active tools where to look, and it leaves no trace on the target because you never connected to it.

02Scope and good manners

The data is public, but what you do next is not neutral. Use theHarvester only to map assets you own or are authorized to assess. Harvested email addresses must never be fed into phishing or spam, which crosses from research into a crime and a serious abuse of people's personal data.

↑ contents

03Install

$ sudo apt install theharvester # Debian / Kali

$ sudo dnf install theHarvester # Fedora

$ pipx install theHarvester # Gentoo / any distro (PyPI)

04A first pass

Give it a domain with -d, a result limit with -l, and a source with -b. You can name one source or use several. Start with a broad source to get a feel for the footprint.

$ theHarvester -d warfi.net -l 500 -b bing

05Choosing and combining sources

Each source sees a different slice, so breadth comes from using several. Some sources need a free API key set in the config file; without a key they are skipped. -b all runs every available source, which is the usual thorough option.

$ theHarvester -d warfi.net -l 1000 -b bing,duckduckgo,crtsh,certspotter

$ theHarvester -d warfi.net -b all -l 1000

» crtsh and certspotter read certificate transparency logs, which are one of the richest sources of real subdomains because every TLS certificate is logged publicly.

06API keys and sharper flags

Many of theHarvester's best sources need a free API key. Add them to its config file once and an all-sources run gets far richer. A few flags also sharpen a run: resolve and verify what it finds, brute-force for more subdomains, and pull in Shodan for open ports.

$ $EDITOR ~/.theHarvester/api-keys.yaml

$ theHarvester -d warfi.net -b all -l 1000 -n -c

$ theHarvester -d warfi.net -b shodan

» -n resolves names to IPs, -c attempts a DNS brute force for more subdomains, and -b shodan adds open-port intelligence to the footprint.

07Saving the results

For anything you will act on, write the run to files. theHarvester can emit JSON and an HTML report, and the host list is the natural input to a resolver or a scanner.

$ theHarvester -d warfi.net -b all -l 1000 -f warfi-recon

↑ contents

08Feeding the rest of the arsenal

The subdomains and IPs theHarvester finds are where the active phase begins. Resolve the hosts to live IPs, then scan just those with masscan or nmap. This is how recon narrows a scan from a guessed range to a real, enumerated surface.

$ grep -oE '[a-z0-9.-]+\.warfi\.net' warfi-recon.json | sort -u > subs.txt

$ # resolve, then scan the live ones with nmap or masscan

09Seeing your own footprint

The most useful run of theHarvester is against your own domain. It shows what the internet can learn about you without asking: forgotten subdomains, a staging box that was never taken down, email addresses on public pages that will attract phishing. Each finding is something to retire, lock down, or watch.

» A subdomain you did not know was public is a candidate for attack; find it before someone else does.

» Exposed email addresses invite phishing; knowing which are public shapes your user training.

» Certificate transparency means every cert you issue is public; assume any subdomain you put a cert on is discoverable.

Run it on your own domains freely. For client domains, keep it inside written scope, and treat harvested personal data under the Data Privacy Act.

↑ contents