loading
Loading content
loading
Recon
Passive OSINT for emails, names, and subdomains on a domain.
overview
Run theHarvester early when an engagement needs emails and personnel names alongside hostnames from public sources.
Operators set --domain and --source, then optionally deepen with --dns-brute, --shodan, or --take-over when active checks are in scope.
Compared with amass or subfinder, it trades host depth for broader OSINT data types from one node. Trickest runs it as a managed recon node with file and folder output.
use cases
Query many OSINT sources at once for a domain so subdomains, hostnames, emails, and names land in a single aggregated set without any direct contact.
Pull names from certificate transparency and threat feeds, then feed the host list into probing and scanning stages downstream.
Gather the email and name data an engagement needs for phishing assessments and identity mapping, sourced entirely from public records.
Switch on DNS brute force, lookups, or takeover checks to confirm and expand the passive findings when the scope allows active traffic.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| limit | STRING | --limit | Limit the number of search results, default=500. |
| start | STRING | --start | Start with result number X, default=0. |
| domain | STRING | --domain | Company name or domain to search. |
| shodan | BOOLEAN | --shodan | Use Shodan to query discovered hosts. |
| source | STRING | --source | anubis, baidu, bevigil, binaryedge, bing, bingapi, bufferoverun, censys, certspotter, crtsh, dnsdumpster, duckduckgo, fullhunt, github-code, hackertarget, hunter, intelx, omnisint, otx, pentesttools, projectdiscovery, qwant, rapiddns, rocketreach, securityTrails, sublist3r, threatcrowd, threatminer, urlscan, virustotal, yahoo, zoomeye |
| dns-brute | BOOLEAN | --dns-brute | Perform a DNS brute force on the domain. |
| take-over | BOOLEAN | --take-over | Check for takeovers. |
Showing key inputs. theharvester exposes 10 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| limit | STRING | --limit | Limit the number of search results, default=500. |
| start | STRING | --start | Start with result number X, default=0. |
| domain | STRING | --domain | Company name or domain to search. |
| shodan | BOOLEAN | --shodan | Use Shodan to query discovered hosts. |
| source | STRING | --source | anubis, baidu, bevigil, binaryedge, bing, bingapi, bufferoverun, censys, certspotter, crtsh, dnsdumpster, duckduckgo, fullhunt, github-code, hackertarget, hunter, intelx, omnisint, otx, pentesttools, projectdiscovery, qwant, rapiddns, rocketreach, securityTrails, sublist3r, threatcrowd, threatminer, urlscan, virustotal, yahoo, zoomeye |
| dns-brute | BOOLEAN | --dns-brute | Perform a DNS brute force on the domain. |
| take-over | BOOLEAN | --take-over | Check for takeovers. |
| dns-lookup | BOOLEAN | --dns-lookup | Enable DNS server lookup, default False. |
| dns-server | STRING | --dns-server | DNS server to use for lookup. |
| virtual-host | BOOLEAN | --virtual-host | Verify host name via DNS resolution and search for virtual hosts |
example
# theHarvester: OSINT emails and hosts for example.comtheHarvester -d example.com -b all -l 200[*] Emails found:admin@example.comsecurity@example.com[*] Hosts found:www.example.commail.example.comvpn.example.comapi.example.comguidance
Use at the start of an engagement for a broad passive picture that includes emails and names. Prefer amass or subfinder when you only need deep subdomain coverage.
Deeper subdomain enumeration and mapping. Stronger on hosts; does not gather emails and names.
Fast passive subdomain aggregation. Leaner when you only need hostnames.
Enumeration plus probing and takeover in one node. theHarvester stays focused on broad OSINT data types.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domain feeds theHarvester, which gathers OSINT data and passes the discovered hosts to httpx before the results land as a queryable output.
Facts on this page come from the live Trickest tool library.