Back to Academy
RECON AUTOMATION

theHarvester: Gathering Emails, Subdomains, and Virtual Hosts

6 MIN READ
STRATEGIC INTEL
theHarvester: Gathering Emails, Subdomains, and Virtual Hosts Screenshot
Intelligence Capture

Early Stage Aggregation

theHarvester is designed for the 'reconnaissance' phase of an investigation. It gathers emails, names, subdomains, IPs, and URLs from different public sources.


Key Intelligence Sources

theHarvester pulls from a wide array of sources including search engines (Google, Bing), specialized databases (Shodan, CRT.sh), and professional networks (LinkedIn).


Why Use It?

It reduces the manual effort required to map out an organization's public-facing assets and employee list, providing a broad overview of the target's attack surface.


Share this Intel

Spread the methodology to harden the collective perimeter.

Share Intel

Clinical Mastery

Expert CLI Documentation & Tradecraft

Tool Reference

theHarvester

Aggressive reconnaissance tool for gathering public intel.

theHarvester -d [domain] -b [source]

Core Flags & Options

-d

The target domain you want to investigate.

-b

The source to search (google, bing, linkedin, shodan, crtsh, all).

-l

Limit the number of results to work through.

Expert Strings (Chaining & Automation)

Deep LinkedIn Search

theHarvester -d company.com -b linkedin

BENEFIT: Finds names and titles of employees currently working at the target organization.

Global Asset Grab

theHarvester -d company.com -b all -l 500

BENEFIT: Performs a massive sweep across all supported sources for maximum data density.

PRO TIP: Always pipe output into tee -a recon_log.txt to maintain a clinical audit trail of your investigation steps.