Offensive Security Researcher & Quantum Cryptography Analyst

theHarvester: Complete Guide to OSINT, Email, and Subdomain Enumeration Using Kali Linux

Abdul Wahab Junaid
theHarvester: Complete Guide to OSINT, Email, and Subdomain Enumeration Using Kali Linux

theHarvester is one of the most widely recognized OSINT tools in the penetration testing world, originally created by Christian Martorella. It aggregates publicly available information about a target organization — email addresses, employee names, subdomains, open ports/banners, and IP addresses — by querying a wide range of passive sources including search engines (Google, Bing), Certificate Transparency logs (crt.sh), Shodan, LinkedIn, Hunter.io, and PGP key servers. It is typically the go-to tool for the “people and email” side of information gathering, complementing DNS-focused tools like Amass and Subfinder.

Installation

theHarvester is pre-installed on Kali Linux.

# Kali/Debian
sudo apt update && sudo apt install theharvester -y

# From source (any Linux distro with Python 3)
git clone https://github.com/laramies/theHarvester.git
cd theHarvester
python3 -m pip install -r requirements/base.txt --break-system-packages
python3 theHarvester.py --help

Verify installation:

theHarvester --help

Syntax

theHarvester -d DOMAIN -b SOURCE [OPTIONS]

Command-Line Options

FlagDescription
-d, --domain DOMAINTarget domain or company name to search
-b, --source SOURCEData source(s) to query — e.g., google, bing, crtsh, hunter, shodan, linkedin, all
-l, --limit NUMLimit the number of results returned per source
-S, --start NUMStart at a specific result offset (useful for paginated search engine sources)
-p, --port-scanEnable port scanning against discovered hosts using a common port list
-s, --shodanQuery Shodan for discovered hosts (requires Shodan API key configured)
-v, --virtual-hostPerform virtual host resolution (verify) on discovered hosts
-e, --dns-server SERVERSpecify a DNS server for resolution
-t, --dns-tldEnable TLD expansion during DNS enumeration
-n, --dns-lookupEnable DNS resolution of discovered hosts
-c, --dns-brutePerform DNS subdomain brute forcing
-f, --filename FILESave results to an HTML and XML file
-r, --take-overCheck discovered subdomains for potential subdomain takeover vulnerabilities

Basic Usage

theHarvester -d example.com -b crtsh

Expected output:

*******************************************************************
*  _   _                                                          *
* | |_| |__   ___    /\  /\__ _ _ ____   _____  ___| |_ ___ _ __  *
*  | __| '_ \ / _ \  / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *
*  | |_| | | |  __/ / __  / (_| | |   \ V /  __/\__ \ ||  __/ |    *
*   \__|_| |_|\___| \/ /_/ \__,_|_|    \_/ \___||___/\__\___|_|    *
*                                                                   *
* theHarvester 4.5.1                                               *
*******************************************************************

[*] Target: example.com
[*] Searching crtsh.

[*] Hosts found: 3
------------------
dev.example.com
www.example.com
mail.example.com

[*] Emails found: 0

Practical Examples

Example 1 — Basic Certificate Transparency search

theHarvester -d example.com -b crtsh

[*] Hosts found: 3
www.example.com
mail.example.com
dev.example.com

Example 2 — Search using Bing

theHarvester -d example.com -b bing

[*] Emails found: 2
info@example.com
support@example.com
[*] Hosts found: 2
www.example.com
mail.example.com

Example 3 — Query all available sources at once

theHarvester -d example.com -b all

[*] Emails found: 5
[*] Hosts found: 12
[*] IPs found: 4

Example 4 — Limit results and set a start offset

theHarvester -d example.com -b google -l 100 -S 0

[*] Hosts found: 8
[*] Emails found: 3

Example 5 — Enable DNS resolution of discovered hosts

theHarvester -d example.com -b crtsh -n

www.example.com:93.184.216.34
mail.example.com:93.184.216.35

Example 6 — Enable port scanning against discovered hosts

theHarvester -d example.com -b crtsh -p

www.example.com:
   Port 80 open
   Port 443 open

Example 7 — Query Shodan for discovered hosts (requires API key)

theHarvester -d example.com -b shodan -s

[*] Shodan info for 93.184.216.34
   Organization: Example Hosting
   Open ports: 80, 443

Example 8 — Save results to file

theHarvester -d example.com -b all -f example_results

[*] Saving report as example_results.html and example_results.xml

Example 9 — Check for subdomain takeover on discovered hosts

theHarvester -d example.com -b crtsh -r

[!] Possible subdomain takeover: legacy.example.com (CNAME points to unclaimed S3 bucket)

Common Use Cases

Automation with Bash

Run theHarvester against multiple sources and merge unique emails/hosts:

#!/bin/bash
# harvester_multi.sh
DOMAIN=$1
for SRC in crtsh bing duckduckgo hackertarget otx; do
    echo "[*] Source: $SRC"
    theHarvester -d "$DOMAIN" -b "$SRC" -f "harvester_${SRC}"
done

Extract and deduplicate all discovered emails from saved XML reports:

#!/bin/bash
grep -ohE '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}' harvester_*.xml | sort -u

Tips and Best Practices

Troubleshooting

ProblemCauseFix
Error: Missing API key for source XSource requires an API key not yet configuredAdd the relevant key to theHarvester/api-keys.yaml
Very few or zero results from Google/BingSearch engine CAPTCHA/rate limiting blocking automated queriesReduce query frequency, use -l to limit result volume, or rely more on crtsh/otx/hackertarget
-p port scan produces no resultsFirewall blocking outbound scans from your hostVerify from a different network or reduce scan speed
Subdomain takeover check (-r) gives false positiveCNAME target service is intermittently unavailable, not actually unclaimedManually verify with dig and check the service provider status before reporting

References

Exit mobile version