Information Gathering
theHarvester
theHarvester is passive OSINT for an organization’s footprint. Give it a domain
and it queries a long list of public sources — search engines, certificate
transparency logs, DNS datasets, and more — then hands back the emails,
subdomains, hostnames, IPs, and sometimes employee names it found, without ever
touching the target directly. It’s the fast way to sketch an organization’s
external attack surface at the very start of an engagement.
Installed from the AUR (as theharvester-git) and wired up with the extra Python
dependencies it needs; Security → Information Gathering → theHarvester. The
binary is capitalized: theHarvester.
The help it prints
usage: theHarvester [-h] -d DOMAIN [-l LIMIT] [-S START] [-j SOURCE_WORKERS]
[-p] [--no-hosts] [-s] [--routeviews] [--screenshot DIR]
[-e DNS_SERVER] [-t] [-r [DNS_RESOLVE]]
[--dns-resolvers IPS_OR_FILE] [-n] [-c]
[--dns-recursive-depth DNS_RECURSIVE_DEPTH]
[--dns-recursive-query-limit DNS_RECURSIVE_QUERY_LIMIT]
[--dns-recursive-runtime-seconds DNS_RECURSIVE_RUNTIME_SECONDS]
[-f NAME] [-w WORDLIST] [-a] [--vhost]
[--vhost-endpoint VHOST_ENDPOINT]
[--vhost-candidate HOSTNAME]
[--vhost-request-limit VHOST_REQUEST_LIMIT]
[--vhost-runtime-seconds VHOST_RUNTIME_SECONDS]
[--vhost-timeout-seconds VHOST_TIMEOUT_SECONDS]
[--vhost-concurrency VHOST_CONCURRENCY] [--vhost-insecure]
[-q] [-v] [-b SOURCE]
theHarvester is used to gather open source intelligence (OSINT) on a company
or domain.
options:
-h, --help show this help message and exit
-d, --domain DOMAIN Company name or domain to search, or an explicit
ASN/IP/CIDR target for --routeviews.
-l, --limit LIMIT Maximum results requested from each source that
supports result limits; 0 continues to provider
exhaustion with no local result or page-count cap
(default: 500).
-S, --start START Result offset for sources that support pagination
(default: 0).
-j, --source-workers SOURCE_WORKERS
Maximum discovery sources to run at once (default: 3).
-p, --proxies Use proxies.yaml for supported discovery-source,
Shodan, and takeover requests. Takeover fails closed
if no proxy is available.
--no-hosts Exclude hostname results while retaining other result
types returned by selected sources.
-s, --shodan Query the Shodan Host API for discovered IPs, using
configured proxies when enabled.
--routeviews Enrich discovered IPs with sourced ASN attribution, or
an explicitly targeted ASN, IP, or prefix, through
RouteViews. Returned routing relationships do not
establish ownership or target scope. Uses
authenticated access when a RouteViews API key is
configured.
--screenshot DIR Save screenshots of reachable discovered hosts to DIR.
This sends direct browser requests.
-e, --dns-server DNS_SERVER
Accepted for compatibility but currently unused; use
--dns-resolvers to select resolvers.
-t, --take-over Check discovered hosts for provider-gated takeover
indicators. Uses configured DNS resolvers and wildcard
controls, does not follow redirects, and uses
configured proxies when enabled. Indicators are not
confirmed takeovers.
-r, --dns-resolve [DNS_RESOLVE]
Resolve discovered hostnames. Pass comma-separated
resolver IPs or a text file with one IP per line; omit
the value to use defaults. One run-wide phase uses at
most 20 hostname jobs; its query and runtime limits
are unlimited by default.
--dns-resolvers IPS_OR_FILE
Select resolver IPs for DNS actions without enabling
hostname resolution. Pass comma-separated IPs or a
text file with one IP per line.
-n, --dns-lookup Perform PTR lookups across the /24 network containing
each discovered IPv4 address. Addresses are
deduplicated; one run-wide phase uses at most 20
active jobs with no default request or runtime
ceiling. This sends active DNS queries.
-c, --dns-brute Perform a DNS brute force on the domain.
--dns-recursive-depth DNS_RECURSIVE_DEPTH
Enable recursive DNS discovery to this maximum depth.
Zero disables it.
--dns-recursive-query-limit DNS_RECURSIVE_QUERY_LIMIT
Hard cap on recursive DNS record queries across all
resolver vantages.
--dns-recursive-runtime-seconds DNS_RECURSIVE_RUNTIME_SECONDS
Hard runtime cap in seconds for recursive DNS
discovery.
-f, --filename NAME Write NAME.json, NAME.xml, and NAME.jsonl.
-w, --wordlist WORDLIST
Path to the endpoint wordlist used by --api-scan.
-a, --api-scan Check common API paths with GET, HEAD, and OPTIONS.
Requests follow redirects.
-q, --quiet Suppress missing API key warnings and reading the api-
keys file.
-v, --verbose Show informational diagnostic messages.
-b, --source SOURCE Comma-separated source names or source capabilities.
Multiple capabilities select the union of matching
sources; they do not filter returned fields.
Capabilities: subdomains, emails, ips, asns, urls,
people, breaches, all. Sources: apis-guru, arquivo,
baidu, bevigil, brave, bufferoverun, builtwith,
censys, certspotter, commoncrawl, criminalip, crt-
name, crtsh, dehashed, dnsdb, dnsdumpster, duckduckgo,
dymo, fofa, fullhunt, github-code, gitlab,
hackertarget, haveibeenpwned, hibpverified,
hudsonrock, hunter, hunterhow, intelx, leakix,
leaklookup, mojeek, netlas, onyphe, otx, pentesttools,
projectdiscovery, rapiddns, robtex, rocketreach,
securityscorecard, securityTrails, sherlockeye,
shodan, shodanct, shodanInternetDB, sourcegraph,
subdomainapi, subdomaincenter, subdomainfinderc99,
thc, tomba, urlscan, virustotal, waybackarchive,
whoisxml, windvane, yahoo, zoomeye
virtual host discovery:
P2 direct interaction (active reconnaissance): sends direct HTTP and TLS
requests. For normal use, pass only --vhost; bounded safety defaults apply
automatically. Supplying --vhost-endpoint or --vhost-candidate also
enables discovery.
--vhost Test harvested in-scope hostnames against harvested
literal IPs, using HTTPS before HTTP.
--vhost-endpoint VHOST_ENDPOINT
Replace harvested IPs with one authorized HTTP or
HTTPS endpoint using a literal IP.
--vhost-candidate HOSTNAME
Repeat to add an authorized in-scope hostname.
Candidate names are never resolved through DNS.
virtual host advanced controls:
Optional safety overrides. Bounded defaults apply when these options are
omitted.
--vhost-request-limit VHOST_REQUEST_LIMIT
Hard request cap shared by baseline, controls,
candidates, and confirmations (default: 100).
--vhost-runtime-seconds VHOST_RUNTIME_SECONDS
Hard wall-clock cap for virtual-host discovery
(default: 30.0 seconds).
--vhost-timeout-seconds VHOST_TIMEOUT_SECONDS
Timeout for each virtual-host request (default: 5.0
seconds).
--vhost-concurrency VHOST_CONCURRENCY
Maximum concurrent candidate requests (default: 5).
--vhost-insecure Do not verify TLS certificates for HTTPS probes;
evidence records tls_verified=false.Examples
# Everything it can find for a domain, using all sources
theHarvester -d target.com -b all
# Just one fast source, capped result count
theHarvester -d target.com -l 500 -b duckduckgo
# Enable DNS brute-forcing of subdomains
theHarvester -d target.com -b crtsh -c
# Save a full report (HTML + JSON) for later
theHarvester -d target.com -b all -f target-reconSome sources want an API key configured before they’ll return much — the tool
notes which as it runs. -b all is the broad first pass; narrow to specific
sources once you know what’s paying off.