theHarvester Cheat Sheet

OSINT gathering for emails, subdomains, hosts, and employee names from public sources.

Reconnaissance & OSINTbreachemailosintsubdomainUpdated 2026-06-02

Overview

theHarvester collects emails, subdomains, IPs, and URLs from search engines, PGP servers, Shodan, Hunter, and other sources. Useful for phishing assessments, password spraying prep (when authorized), and external footprinting.

Authorized testing only. Harvesting employee emails may implicate privacy laws and program rules—document purpose and obtain approval.

Install

sudo apt install -y theharvester

pip install theHarvester

theHarvester -h

Essential commands

All sources for domain

theHarvester -d target.example.com -b all

Specific source

theHarvester -d target.example.com -b google

Limit results

theHarvester -d target.example.com -b bing -l 500

Common workflows

DNS brute + virtual host discovery —

theHarvester -d target.example.com -b crtsh,dnsdumpster

theHarvester -d target.com -c

Save to file —

theHarvester -d target.example.com -b all -f harvester_results

Shodan / API key sources —

theHarvester -d target.example.com -b shodan -k SHODAN_API_KEY

Active DNS search —

theHarvester -d target.example.com -b urlscan,otx

Flags reference

`-d`	Domain
`-b`	Data source (google, bing, linkedin, all, etc.)
`-l`	Limit results
`-f`	Save HTML/JSON/XML to basename
`-k`	API key (or config file)
`-c`	DNS brute force / TLD expansion
`-v`	Verbose
`-s`	Start IP for SHODAN search
`-p`	Port scan IPs found (use cautiously)

Tips

Configure /etc/theHarvester/api-keys.yaml for paid sources.
Validate emails before use in social engineering or spray campaigns.
Cross-reference with linkedin2username-style workflows only if RoE allows.
Newer versions use theHarvester vs legacy theharvester—check your install.