loading
Loading content
loading
Recon
Emails, subdomains, and names enumeration tool from public OSINT sources.
overview
theHarvester queries public search engines and data sources for emails, names, and subdomains tied to a domain, which makes it a classic first OSINT pass.
Source selection, result limits, and optional DNS brute or Shodan hooks let you stay passive or deepen into active checks.
Use it early for people and email intel that pure subdomain tools never collect.
use cases
Query many OSINT sources at once for a domain so subdomains, hostnames, emails, and names land in a single aggregated set without any direct contact.
Pull names from certificate transparency and threat feeds, then feed the host list into probing and scanning stages downstream.
Gather the email and name data an engagement needs for phishing assessments and identity mapping, sourced entirely from public records.
Switch on DNS brute force, lookups, or takeover checks to confirm and expand the passive findings when the scope allows active traffic.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| limit | STRING | --limit | Limit the number of search results, default=500. |
| start | STRING | --start | Start with result number X, default=0. |
| domain | STRING | --domain | Company name or domain to search. |
| shodan | BOOLEAN | --shodan | Use Shodan to query discovered hosts. |
| source | STRING | --source | anubis, baidu, bevigil, binaryedge, bing, bingapi, bufferoverun, censys, certspotter, crtsh, dnsdumpster, duckduckgo, fullhunt, github-code, hackertarget, hunter, intelx, omnisint, otx, pentesttools, projectdiscovery, qwant, rapiddns, rocketreach, securityTrails, sublist3r, threatcrowd, threatminer, urlscan, virustotal, yahoo, zoomeye |
| dns-brute | BOOLEAN | --dns-brute | Perform a DNS brute force on the domain. |
| take-over | BOOLEAN | --take-over | Check for takeovers. |
Showing key inputs. theharvester exposes 10 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| limit | STRING | --limit | Limit the number of search results, default=500. |
| start | STRING | --start | Start with result number X, default=0. |
| domain | STRING | --domain | Company name or domain to search. |
| shodan | BOOLEAN | --shodan | Use Shodan to query discovered hosts. |
| source | STRING | --source | anubis, baidu, bevigil, binaryedge, bing, bingapi, bufferoverun, censys, certspotter, crtsh, dnsdumpster, duckduckgo, fullhunt, github-code, hackertarget, hunter, intelx, omnisint, otx, pentesttools, projectdiscovery, qwant, rapiddns, rocketreach, securityTrails, sublist3r, threatcrowd, threatminer, urlscan, virustotal, yahoo, zoomeye |
| dns-brute | BOOLEAN | --dns-brute | Perform a DNS brute force on the domain. |
| take-over | BOOLEAN | --take-over | Check for takeovers. |
| dns-lookup | BOOLEAN | --dns-lookup | Enable DNS server lookup, default False. |
| dns-server | STRING | --dns-server | DNS server to use for lookup. |
| virtual-host | BOOLEAN | --virtual-host | Verify host name via DNS resolution and search for virtual hosts |
example
# theHarvester: OSINT emails and hosts for example.comtheHarvester -d example.com -b all -l 200[*] Emails found:admin@example.comsecurity@example.com[*] Hosts found:www.example.commail.example.comvpn.example.comapi.example.comguidance
Use theHarvester at the start of an engagement when you want a broad passive picture, including emails and names, not just hostnames. For deep subdomain enumeration alone, amass or subfinder dig further. theHarvester wins on breadth of OSINT data types from one tool.
Deeper subdomain enumeration and mapping. Goes further on hosts but does not gather emails and names.
Fast passive subdomain source aggregation. Leaner when you only need names.
Enumeration plus probing and takeover in one node. theHarvester leans more toward broad OSINT data.
faq
related
Asynchronous DNS brute-force tool for fast subdomain enumeration.
OWASP Amass: network mapping and external asset discovery.
OWASP Amass intel: find an organization's root domains and ranges.
OWASP Amass enumeration that produces structured JSON output.
Find related domains and subdomains via shared Google Analytics IDs.
Find domains and subdomains potentially related to a given domain.
A domain feeds theHarvester, which gathers OSINT data and passes the discovered hosts to httpx before the results land as a queryable output.
Facts on this page come from the live Trickest tool library.