$ man theharvester

theHarvester

Emails, subdomains, IPs and URLs for a domain, from dozens of public sources.

osint / reconpassive / local only

⚠ Recon your own assets, or targets you have written permission to test. Passive OSINT reads public data, but using it to target someone else's systems can still be illegal or against their terms. Examples on this site use example.com placeholders.

## why a developer should care

Emails tell an attacker your username format; subdomains tell them where to look. theHarvester gathers both in one run. Listed in the PayloadsAllTheThings recon methodology.

## install

$ git clone https://github.com/laramies/theHarvester && cd theHarvester && uv sync

Other platforms and pre-built binaries: official install guide ↗

Check it worked: open a new terminal and run uv run theHarvester -h. "command not found" means it isn't installed or isn't on your PATH yet.

## shortcuts

domain:

# Subdomains from certificate logs

$ uv run theHarvester -d {{target}} -b certspotter

# Emails, URLs and hosts

$ uv run theHarvester -d {{target}} -b emails,urls,certspotter

## helps with

A07 Authentication Failures

→ official docs · ← all tools