Recon
Pull emails, names, and hosts from public OSINT
theharvester is an OSINT gathering tool that collects intelligence about a domain or organization from search engines, certificate transparency logs, DNS datasets, code repositories, threat-intelligence platforms, and other public sources, and normalizes the hosts, emails, IPs, URLs, ASNs, people, and other results it collects.
installgit clone https://github.com/laramies/theHarvester.git
Python · GPL-2.0 license
overview
What theharvester does
Run theHarvester early when an engagement needs emails and personnel names alongside hostnames from public sources.
Operators set --domain and --source, then optionally deepen with --dns-brute, --shodan, or --take-over when active checks are in scope.
Compared with amass or subfinder, it trades host depth for broader OSINT data types from one node. Trickest runs it as a managed recon node with file and folder output.
use cases
Where theharvester fits
Map a domain's public footprint
Query many OSINT sources at once for a domain so subdomains, hostnames, emails, and names land in a single aggregated set without any direct contact.
Seed a pipeline with passive subdomains
Pull names from certificate transparency and threat feeds, then feed the host list into probing and scanning stages downstream.
Collect emails and personnel names
Gather the email and name data an engagement needs for phishing assessments and identity mapping, sourced entirely from public records.
Extend into light active checks
Switch on DNS brute force, lookups, or takeover checks to confirm and expand the passive findings when the scope allows active traffic.
reference
theharvester inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| limit | STRING | --limit | Limit the number of search results, default=500. |
| start | STRING | --start | Start with result number X, default=0. |
| domain | STRING | --domain | Company name or domain to search. |
| shodan | BOOLEAN | --shodan | Use Shodan to query discovered hosts. |
| source | STRING | --source | anubis, baidu, bevigil, binaryedge, bing, bingapi, bufferoverun, censys, certspotter, crtsh, dnsdumpster, duckduckgo, fullhunt, github-code, hackertarget, hunter, intelx, omnisint, otx, pentesttools, projectdiscovery, qwant, rapiddns, rocketreach, securityTrails, sublist3r, threatcrowd, threatminer, urlscan, virustotal, yahoo, zoomeye |
| dns-brute | BOOLEAN | --dns-brute | Perform a DNS brute force on the domain. |
| take-over | BOOLEAN | --take-over | Check for takeovers. |
Showing key inputs. theharvester exposes 10 inputs in total.
Full flag reference (10 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| limit | STRING | --limit | Limit the number of search results, default=500. |
| start | STRING | --start | Start with result number X, default=0. |
| domain | STRING | --domain | Company name or domain to search. |
| shodan | BOOLEAN | --shodan | Use Shodan to query discovered hosts. |
| source | STRING | --source | anubis, baidu, bevigil, binaryedge, bing, bingapi, bufferoverun, censys, certspotter, crtsh, dnsdumpster, duckduckgo, fullhunt, github-code, hackertarget, hunter, intelx, omnisint, otx, pentesttools, projectdiscovery, qwant, rapiddns, rocketreach, securityTrails, sublist3r, threatcrowd, threatminer, urlscan, virustotal, yahoo, zoomeye |
| dns-brute | BOOLEAN | --dns-brute | Perform a DNS brute force on the domain. |
| take-over | BOOLEAN | --take-over | Check for takeovers. |
| dns-lookup | BOOLEAN | --dns-lookup | Enable DNS server lookup, default False. |
| dns-server | STRING | --dns-server | DNS server to use for lookup. |
| virtual-host | BOOLEAN | --virtual-host | Verify host name via DNS resolution and search for virtual hosts |
example
Run theharvester
# theHarvester: OSINT emails and hosts for example.com
theHarvester -d example.com -b all -l 200[*] Emails found:
admin@example.com
security@example.com
[*] Hosts found:
www.example.com
mail.example.com
vpn.example.com
api.example.comguidance
Choosing theharvester
Use at the start of an engagement for a broad passive picture that includes emails and names. Prefer amass or subfinder when you only need deep subdomain coverage.
amass
Deeper subdomain enumeration and mapping. Stronger on hosts; does not gather emails and names.
subfinder
Fast passive subdomain aggregation. Leaner when you only need hostnames.
sudomy
Enumeration plus probing and takeover in one node. theHarvester stays focused on broad OSINT data types.
faq
theharvester questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run theharvester yourself
A domain feeds theHarvester, which gathers OSINT data and passes the discovered hosts to httpx before the results land as a queryable output.
Facts on this page come from the live Trickest tool library.