theHarvester
theHarvester gathers publicly available emails, subdomains, hosts and names for a domain from search engines and other sources.
Legal & ethical use. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Early-stage reconnaissance for an authorised assessment
- Check what employee information your own organisation exposes
Key features
- Many public data sources
- Simple command-line interface
- Result export
Installation
Install from your distribution or clone the repository (Python).
Beginner usage guide
Select one source at a time with -b to understand what each contributes, and verify every result manually.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Search one source for a domain
theHarvester -d example.com -b duckduckgo-d is the domain and -b the data source; available sources vary by version.
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Command flags checked against the real binary theHarvester (Read proxies.yaml from /etc/theHarvester/proxies.yaml) on 2026-10-27.