aeondave/theharvester

theHarvester

Email, subdomain, and hostname harvester from public OSINT sources.

Quick Start

# Install
pip install theHarvester
# or on Kali: already installed

# Basic harvest (google + bing sources)
theHarvester -d target.com -b google,bing

# All available sources
theHarvester -d target.com -b all -l 500

# Save results
theHarvester -d target.com -b google,bing,linkedin -l 300 -f results
# Outputs: results.html + results.xml

Core Flags

| Flag | Purpose | |------|---------| | -d <domain> | Target domain | | -b <sources> | Data sources (comma-separated or all) | | -l <n> | Limit results per source (default: 500) | | -f <filename> | Save to HTML/XML (no extension needed) | | -n | DNS lookup on discovered hosts | | -c | DNS brute force (uses built-in wordlist) | | -v | Verify hostnames via DNS resolution | | -e <ip> | Use custom DNS server | | -p | Port scan open ports on discovered hosts | | -s <n> | Start result offset | | --screenshot <dir> | Screenshot discovered web services |

Data Sources

# Passive (no key needed)
-b google,bing,yahoo,duckduckgo,baidu,crtsh,certspotter,hackertarget,dnsdumpster,rapiddns,sublist3r

# Requires API keys
-b hunter,securitytrails,shodan,censys,fullhunt,intelx,virustotal,bevigil,binaryedge

# LinkedIn (extracts names/titles — no key needed, rate limited)
-b linkedin,linkedin_links

# All sources at once
-b all

Common Workflows

Recon on target company:

# Phase 1: passive — no noise
theHarvester -d corp.com -b google,bing,duckduckgo,crtsh,certspotter,hackertarget -l 500 -f corp_passive

# Phase 2: extended — with APIs
theHarvester -d corp.com -b all -l 1000 -f corp_full

# Phase 3: verify + port scan discovered hosts
theHarvester -d corp.com -b google,crtsh -v -p -l 200

Email harvest for phishing prep:

theHarvester -d target.com -b google,bing,linkedin,hunter -l 500 -f emails
# Check results.html for email list
grep -oE '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' results.xml | sort -u > emails.txt

Subdomain discovery:

theHarvester -d target.com -b crtsh,certspotter,dnsdumpster,sublist3r,hackertarget -l 500 -f subdomains

API Keys Setup

# Config: /etc/theHarvester/api-keys.yaml or ~/.theHarvester/api-keys.yaml

apikeys:
  hunter:
    key: YOUR_KEY         # hunter.io — free 50/month
  securitytrails:
    key: YOUR_KEY         # securitytrails.com — free 50/month
  shodan:
    key: YOUR_KEY         # shodan.io — free tier
  virustotal:
    key: YOUR_KEY         # virustotal.com — free
  intelx:
    key: YOUR_KEY         # intelx.io — free tier

Parse Output

# Extract emails from XML output
grep -oE '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' results.xml | sort -u

# Extract subdomains
grep -oE '([a-zA-Z0-9_-]+\.)+target\.com' results.xml | sort -u

# Use holehe on harvested emails
while read email; do holehe "$email" --only-used; done < emails.txt

Resources

| File | When to load | |------|--------------| | references/sources.md | Full source list, API key setup, output parsing, integration with amass/holehe |