R-THE
theHarvester
Gathers emails, subdomains, names, and IPs from public sources like search engines and PGP servers.
OVERVIEW
theHarvester queries a configurable set of passive sources — search engines, crt.sh, DNS, Shodan, PGP key servers, and more — for a given domain and aggregates whatever emails, employee names, subdomains, IPs, and URLs it finds into one report. It's one of the original OSINT aggregators and remains a fast way to get a first-pass picture of an organization's public footprint.
Because most sources are queried passively, it's normally the first tool run on a new domain, well before anything that touches the target's own infrastructure. Some sources need free or paid API keys configured in an .api-keys.yaml file to return full results.
USE CASES
Practical use cases
- 01
Building an initial list of employee emails for phishing-simulation or password-spray scoping discussions.
- 02
Cross-referencing subdomains found by other passive sources (crt.sh, DNS, search engines) in one pass.
- 03
Identifying employee names and roles useful for social-engineering pretext research.
- 04
Getting a fast public-footprint snapshot at the very start of a domain-scoped engagement.
QUICK START
Early domain-scoped recon, to quickly aggregate what's already public about an organization's people, emails, and infrastructure.
- Install theHarvester and optionally add free API keys for extra sources (Shodan, Hunter, etc.) in api-keys.yaml.
- Run it against the target domain with a handful of relevant sources selected.
- Review the emails, hosts, and names it returns and de-duplicate against other recon output.
- Feed confirmed subdomains and emails into your next recon or social-engineering scoping step.
theHarvester -d target.com -b crtsh,duckduckgo,otx -f resultsBEFORE YOU RUN IT
What to check before running it
Results are only as fresh as the source's last index — an email or subdomain returned may already be retired; verify before use.
Several sources require API keys and rate-limit or throttle without them, so a bare install returns partial coverage.
It's a data-aggregation tool, not proof of a live vulnerability — treat every hit as a lead to verify, not a finding.