CyberArunLog in

Footprinting & Reconnaissance · Module 02

theHarvester

Gather emails, subdomains and hosts about a target from public (OSINT) sources.

ModuleModule 02PhaseFootprinting & ReconnaissanceTypeDefensive / AnalysisPlatformKali Linux

Safe to try on your own machine. Spin up your Kali Linux lab and practice away — on any system you own or have permission to test. That’s exactly how the pros learn.

Definition

theHarvester is an open-source reconnaissance tool that gathers publicly available information about an organization, domain, or target.

Primary purpose

Collect emails, subdomains, hostnames, and other publicly indexed assets.

Cybersecurity use

Open-Source Intelligence (OSINT), external attack surface discovery, and authorized penetration testing.

Key features

Email discovery

Finds publicly available email addresses for a domain.

Subdomain discovery

Identifies subdomains reported by supported data sources.

Hostname collection

Collects hostnames associated with a target.

Multiple data sources

Supports many search engines and public datasets.

Export options

Can save results in formats such as XML and JSON.

Important commands

theHarvester -h

Show command-line help and supported sources.

theHarvester -d example.com -b anubis

Search a domain using a chosen source.

theHarvester -d example.com -b crtsh

Use the certificate-transparency source.

theHarvester -d example.com -b all

Try all supported sources.

theHarvester -d example.com -b anubis -l 100

Limit the search to 100 results.

theHarvester -d example.com -b anubis -f results

Save results to an output file.

Practical examples

01Search a domain
command
theHarvester -d example.com -b anubis

Purpose Collects public info for the domain through the selected source.

02Increase the result limit
command
theHarvester -d example.com -b anubis -l 100

Purpose Requests up to 100 results, subject to the source.

03Save results
command
theHarvester -d example.com -b anubis -f results

Purpose Saves collected results to a file for later use.

Important points

  • OSINT: Collects from public sources instead of directly exploiting a target.
  • Passive reconnaissance: Many searches use third-party sources, so you rarely touch the target.
  • Data-source dependency: Results depend on source availability, indexing and API access.
  • API keys: Some sources require an API key or account.
  • False positives: Verify collected emails, hosts and subdomains before trusting them.
  • Version compatibility: Flags and sources change between releases — check theHarvester -h.

Common use cases

OSINT investigations

Gather public information about an organization.

Email enumeration

Identify publicly indexed organizational emails.

Subdomain discovery

Find subdomains for authorized assessments.

Attack surface management

Help spot internet-facing assets that need checking.

Defensive security

Find forgotten or unexpected public-facing assets.

Learn it in context

This tool is taught in Module 02

Read the full written notes, with diagrams, defense and detection.

Open Module 02
Back to all tools