theharvester

--limitLimit the number of search results, default=500.

--startStart with result number X, default=0.

--domainCompany name or domain to search.

--shodanUse Shodan to query discovered hosts.

--sourceanubis, baidu, bevigil, binaryedge, bing, bingapi, bufferoverun, censys, certspotter, crtsh, dnsdumpster, duckduckgo, fullhunt, github-code, hackertarget, hunter, intelx, omnisint, otx, pentesttools, projectdiscovery, qwant, rapiddns, rocketreach, securityTrails, sublist3r, threatcrowd, threatminer, urlscan, virustotal, yahoo, zoomeye

--dns-brutePerform a DNS brute force on the domain.

--take-overCheck for takeovers.

--dns-lookupEnable DNS server lookup, default False.

--dns-serverDNS server to use for lookup.

--virtual-hostVerify host name via DNS resolution and search for virtual hosts