theHarvester: Complete Guide to OSINT, Email, and Subdomain Enumeration Using Kali Linux

theHarvester is one of the most widely recognized OSINT tools in the penetration testing world, originally created by Christian Martorella. It aggregates publicly available information about a target organization — email addresses, employee names, subdomains, open ports/banners, and IP addresses — by querying a wide range of passive sources including search engines (Google, Bing), Certificate Transparency logs (crt.sh), Shodan, LinkedIn, Hunter.io, and PGP key servers. It is typically the go-to tool for the “people and email” side of information gathering, complementing DNS-focused tools like Amass and Subfinder.

Installation

theHarvester is pre-installed on Kali Linux.

# Kali/Debian
sudo apt update && sudo apt install theharvester -y

# From source (any Linux distro with Python 3)
git clone https://github.com/laramies/theHarvester.git
cd theHarvester
python3 -m pip install -r requirements/base.txt --break-system-packages
python3 theHarvester.py --help

Verify installation:

theHarvester --help

Syntax

theHarvester -d DOMAIN -b SOURCE [OPTIONS]

Command-Line Options

Basic Usage

theHarvester -d example.com -b crtsh

Expected output:

*******************************************************************
*  _   _                                                          *
* | |_| |__   ___    /\  /\__ _ _ ____   _____  ___| |_ ___ _ __  *
*  | __| '_ \ / _ \  / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *
*  | |_| | | |  __/ / __  / (_| | |   \ V /  __/\__ \ ||  __/ |    *
*   \__|_| |_|\___| \/ /_/ \__,_|_|    \_/ \___||___/\__\___|_|    *
*                                                                   *
* theHarvester 4.5.1                                               *
*******************************************************************

[*] Target: example.com
[*] Searching crtsh.

[*] Hosts found: 3
------------------
dev.example.com
www.example.com
mail.example.com

[*] Emails found: 0

Practical Examples

Example 1 — Basic Certificate Transparency search

theHarvester -d example.com -b crtsh

[*] Hosts found: 3
www.example.com
mail.example.com
dev.example.com

Example 2 — Search using Bing

theHarvester -d example.com -b bing

[*] Emails found: 2
info@example.com
support@example.com
[*] Hosts found: 2
www.example.com
mail.example.com

Example 3 — Query all available sources at once

theHarvester -d example.com -b all

[*] Emails found: 5
[*] Hosts found: 12
[*] IPs found: 4

Example 4 — Limit results and set a start offset

theHarvester -d example.com -b google -l 100 -S 0

[*] Hosts found: 8
[*] Emails found: 3

Example 5 — Enable DNS resolution of discovered hosts

theHarvester -d example.com -b crtsh -n

www.example.com:93.184.216.34
mail.example.com:93.184.216.35

Example 6 — Enable port scanning against discovered hosts

theHarvester -d example.com -b crtsh -p

www.example.com:
   Port 80 open
   Port 443 open

Example 7 — Query Shodan for discovered hosts (requires API key)

theHarvester -d example.com -b shodan -s

[*] Shodan info for 93.184.216.34
   Organization: Example Hosting
   Open ports: 80, 443

Example 8 — Save results to file

theHarvester -d example.com -b all -f example_results

[*] Saving report as example_results.html and example_results.xml

Example 9 — Check for subdomain takeover on discovered hosts

theHarvester -d example.com -b crtsh -r

[!] Possible subdomain takeover: legacy.example.com (CNAME points to unclaimed S3 bucket)

Common Use Cases

• Harvesting employee email addresses for phishing/social-engineering campaign preparation during an authorized red team engagement.
• Discovering subdomains via Certificate Transparency and search-engine dorking as a complement to DNS-based tools.
• Identifying potential subdomain takeover vulnerabilities via dangling CNAME detection (-r).
• Building an initial target profile (hosts, IPs, emails) before deeper OSINT work in Recon-ng, Maltego, or SpiderFoot.
• Gathering data points to support a social engineering risk assessment report for a client.

Automation with Bash

Run theHarvester against multiple sources and merge unique emails/hosts:

#!/bin/bash
# harvester_multi.sh
DOMAIN=$1
for SRC in crtsh bing duckduckgo hackertarget otx; do
    echo "[*] Source: $SRC"
    theHarvester -d "$DOMAIN" -b "$SRC" -f "harvester_${SRC}"
done

Extract and deduplicate all discovered emails from saved XML reports:

#!/bin/bash
grep -ohE '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}' harvester_*.xml | sort -u

Tips and Best Practices

• Some sources (Google, Bing, LinkedIn) may require API keys or are subject to CAPTCHA/rate limiting — configure api-keys.yaml in the theHarvester config directory for best results.
• Use -b crtsh first — it requires no API key, is fast, and gives immediate subdomain results via Certificate Transparency logs.
• Combine theHarvester’s email-harvesting results with Holehe or GHunt to check which of those discovered emails have registered accounts on major platforms.
• Always use -f to save formatted HTML/XML reports for inclusion in a client-facing penetration test report.
• Re-run scans periodically for long engagements — Certificate Transparency logs and search engine indexes change over time, surfacing new subdomains.

Troubleshooting

References

• Official GitHub repository: https://github.com/laramies/theHarvester
• Kali Linux tool page: https://www.kali.org/tools/theharvester/
• crt.sh Certificate Transparency search: https://crt.sh/