← All cheat sheets

🌶 THEHARVESTER

Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.

Interactive tool: 🕵️ Recon / OSINT Helper

theHarvester gathers emails, names, subdomains, IPs, and URLs from
multiple public data sources. It is an essential OSINT tool for the
early stages of penetration testing and red team engagements.

theHarvester -d <domain> -b <source>
                                 # Basic search

theHarvester -d <domain> -b all          # Search all sources
theHarvester -d <domain> -b anubis       # Anubis-DB
theHarvester -d <domain> -b baidu        # Baidu search
theHarvester -d <domain> -b bevigil      # BeVigil
theHarvester -d <domain> -b binaryedge   # BinaryEdge
theHarvester -d <domain> -b bing         # Bing search
theHarvester -d <domain> -b bingapi      # Bing API
theHarvester -d <domain> -b bufferoverun # Bufferoverun
theHarvester -d <domain> -b censys       # Censys (API key)
theHarvester -d <domain> -b certspotter  # CertSpotter
theHarvester -d <domain> -b crtsh        # crt.sh (certificates)
theHarvester -d <domain> -b dnsdumpster  # DNSDumpster
theHarvester -d <domain> -b duckduckgo   # DuckDuckGo
theHarvester -d <domain> -b fullhunt     # FullHunt
theHarvester -d <domain> -b github-code  # GitHub code search
theHarvester -d <domain> -b hackertarget # HackerTarget
theHarvester -d <domain> -b hunter       # Hunter.io (API key)
theHarvester -d <domain> -b hunterhow    # HunterHow
theHarvester -d <domain> -b intelx       # Intelligence X
theHarvester -d <domain> -b netlas       # Netlas.io
theHarvester -d <domain> -b otx          # AlienVault OTX
theHarvester -d <domain> -b pentesttools # PentestTools
theHarvester -d <domain> -b projectdiscovery
                                         # ProjectDiscovery
theHarvester -d <domain> -b rapiddns     # RapidDNS
theHarvester -d <domain> -b rocketreach  # RocketReach
theHarvester -d <domain> -b securityTrails
                                         # SecurityTrails (API key)
theHarvester -d <domain> -b shodan       # Shodan (API key)
theHarvester -d <domain> -b sitedossier  # SiteDossier
theHarvester -d <domain> -b subdomaincenter
                                         # Subdomain Center
theHarvester -d <domain> -b subdomainfinderc99
                                         # SubdomainFinder
theHarvester -d <domain> -b threatminer  # ThreatMiner
theHarvester -d <domain> -b urlscan      # URLScan.io
theHarvester -d <domain> -b virustotal   # VirusTotal (API key)
theHarvester -d <domain> -b yahoo        # Yahoo search
theHarvester -d <domain> -b zoomeye      # ZoomEye

theHarvester -d <domain>         # Target domain
theHarvester -b <source>         # Data source(s)
theHarvester -l <limit>          # Limit results (default: 500)
theHarvester -S <start>          # Start result number
theHarvester -g                  # Use Google dorks
theHarvester -s                  # Use Shodan
theHarvester -v                  # Verify DNS resolution
theHarvester -n                  # DNS lookup on discovered hosts
theHarvester -c                  # DNS brute force
theHarvester -t                  # DNS TLD expansion
theHarvester -e <dns>            # Use specific DNS server
theHarvester -r <file>           # DNS reverse lookup on results
theHarvester -f <file>           # Save output (HTML/XML)

theHarvester -f results          # Save as results.html & results.xml
theHarvester -f report.html      # HTML report
theHarvester -f report.xml       # XML report

# Search all sources
theHarvester -d example.com -b all -l 500

# Quick search with common sources
theHarvester -d example.com -b bing,crtsh,dnsdumpster,hackertarget

# Deep email harvesting
theHarvester -d example.com -b all -l 1000 -f email_report

# Subdomain enumeration
theHarvester -d example.com -b crtsh,dnsdumpster,hackertarget,virustotal

# DNS verification of results
theHarvester -d example.com -b all -v -n

# Shodan enrichment
theHarvester -d example.com -b all -s

# Store API keys in: /etc/theHarvester/api-keys.yaml
# or: ~/.theHarvester/api-keys.yaml

# Keys needed for:
# - Shodan
# - Hunter.io
# - Censys
# - SecurityTrails
# - VirusTotal
# - BinaryEdge
# - GitHub

- Python 3 based tool
- Some sources require API keys
- Rate limiting may affect results
- Run with multiple sources for best coverage
- Verify discovered emails before use
- Pair with recon-ng for deeper investigation
- Results should be cross-referenced
- Actively maintained on GitHub