> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # theHarvester: Powerful OSINT Tool for Gathering Emails, Subdomains, and IPs from Public Sources - URL: https://darkwebinformer.com/theharvester-powerful-osint-tool-for-gathering-emails-subdomains-and-ips-from-public-sources/ - Published: 2024-08-30T17:34:07.000Z - Updated: 2025-09-04T22:27:05.000Z - Author: Dark Web Informer - Tags: OSINT, Tools GitHub: Last Commit: August 29th, 2024 --- ## What is this? [](https://github.com/laramies/theHarvester#what-is-this) theHarvester is a simple to use, yet powerful tool designed to be used during the reconnaissance stage of a red team assessment or penetration test. It performs open source intelligence (OSINT) gathering to help determine a domain's external threat landscape. The tool gathers names, emails, IPs, subdomains, and URLs by using multiple public resources that include: ## Passive modules: [](https://github.com/laramies/theHarvester#passive-modules) - anubis: Anubis-DB - - bevigil: CloudSEK BeVigil scans mobile application for OSINT assets (Requires an API key, see below.) - - baidu: Baidu search engine - [www.baidu.com](http://www.baidu.com/) - binaryedge: List of known subdomains (Requires an API key, see below.) - [https://www.binaryedge.io](https://www.binaryedge.io/) - bing: Microsoft search engine - [https://www.bing.com](https://www.bing.com/) - bingapi: Microsoft search engine, through the API (Requires an API key, see below.) - brave: Brave search engine - - bufferoverun: (Requires an API key, see below.) [https://tls.bufferover.run](https://tls.bufferover.run/) - censys: [Censys search engine](https://search.censys.io/) will use certificates searches to enumerate subdomains and gather emails (Requires an API key, see below.) [https://censys.io](https://censys.io/) - certspotter: Cert Spotter monitors Certificate Transparency logs - - criminalip: Specialized Cyber Threat Intelligence (CTI) search engine (Requires an API key, see below.) - [https://www.criminalip.io](https://www.criminalip.io/) - crtsh: Comodo Certificate search - [https://crt.sh](https://crt.sh/) - dnsdumpster: DNSdumpster search engine - [https://dnsdumpster.com](https://dnsdumpster.com/) - duckduckgo: DuckDuckGo search engine - [https://duckduckgo.com](https://duckduckgo.com/) - fullhunt: Next-generation attack surface security platform (Requires an API key, see below.) - [https://fullhunt.io](https://fullhunt.io/) - github-code: GitHub code search engine (Requires a GitHub Personal Access Token, see below.) - [www.github.com](http://www.github.com/) - hackertarget: Online vulnerability scanners and network intelligence to help organizations - [https://hackertarget.com](https://hackertarget.com/) - hunter: Hunter search engine (Requires an API key, see below.) - [https://hunter.io](https://hunter.io/) - hunterhow: Internet search engines for security researchers (Requires an API key, see below.) - [https://hunter.how](https://hunter.how/) - intelx: Intelx search engine (Requires an API key, see below.) - [http://intelx.io](http://intelx.io/) - netlas: A Shodan or Censys competitor (Requires an API key, see below.) - [https://app.netlas.io](https://app.netlas.io/) - onyphe: Cyber defense search engine (Requires an API key, see below.) - - otx: AlienVault open threat exchange - [https://otx.alienvault.com](https://otx.alienvault.com/) - pentestTools: Cloud-based toolkit for offensive security testing, focused on web applications and network penetration testing (Requires an API key, see below.) - - projecDiscovery: We actively collect and maintain internet-wide assets data, to enhance research and analyse changes around DNS for better insights (Requires an API key, see below.) - [https://chaos.projectdiscovery.io](https://chaos.projectdiscovery.io/) - rapiddns: DNS query tool which make querying subdomains or sites of a same IP easy! [https://rapiddns.io](https://rapiddns.io/) - rocketreach: Access real-time verified personal/professional emails, phone numbers, and social media links (Requires an API key, see below.) - [https://rocketreach.co](https://rocketreach.co/) - securityTrails: Security Trails search engine, the world's largest repository of historical DNS data (Requires an API key, see below.) - [https://securitytrails.com](https://securitytrails.com/) - \-s, --shodan: Shodan search engine will search for ports and banners from discovered hosts (Requires an API key, see below.) [https://shodan.io](https://shodan.io/) - sitedossier: Find available information on a site - [http://www.sitedossier.com](http://www.sitedossier.com/) - subdomaincenter: A subdomain finder tool used to find subdomains of a given domain - - subdomainfinderc99: A subdomain finder is a tool used to find the subdomains of a given domain - [https://subdomainfinder.c99.nl](https://subdomainfinder.c99.nl/) - threatminer: Data mining for threat intelligence - - tomba: Tomba search engine (Requires an API key, see below.) - [https://tomba.io](https://tomba.io/) - urlscan: A sandbox for the web that is a URL and website scanner - [https://urlscan.io](https://urlscan.io/) - vhost: Bing virtual hosts search - virustotal: Domain search (Requires an API key, see below.) - [https://www.virustotal.com](https://www.virustotal.com/) - yahoo: Yahoo search engine - zoomeye: China's version of Shodan (Requires an API key, see below.) - [https://www.zoomeye.org](https://www.zoomeye.org/) ## Active modules: [](https://github.com/laramies/theHarvester#active-modules) - DNS brute force: dictionary brute force enumeration - Screenshots: Take screenshots of subdomains that were found ## Modules that require an API key: [](https://github.com/laramies/theHarvester#modules-that-require-an-api-key) Documentation to setup API keys can be found at - - bevigil - Free upto 50 queries. Pricing can be found here: - binaryedge - $10/month - bing - bufferoverun - uses the free API - censys - API keys are required and can be retrieved from your [Censys account](https://search.censys.io/account/api). - criminalip - fullhunt - github - hunter - limited to 10 on the free plan, so you will need to do -l 10 switch - hunterhow - intelx - netlas - $ - onyphe -$ - pentestTools - $ - projecDiscovery - invite only for now - rocketreach - $ - securityTrails - shodan - $ - tomba - Free up to 50 search. - zoomeye ## Install and dependencies: [](https://github.com/laramies/theHarvester#install-and-dependencies) - Python 3.10+ - ## Comments, bugs, and requests: [](https://github.com/laramies/theHarvester#comments-bugs-and-requests) - [](https://twitter.com/laramies) Christian Martorella @laramies [cmartorella@edge-security.com](mailto:cmartorella@edge-security.com) - [](https://twitter.com/NotoriousRebel1) Matthew Brown @NotoriousRebel1 - [](https://twitter.com/jay%5Ftownsend1) Jay "L1ghtn1ng" Townsend @jay\_townsend1 ## Main contributors: [](https://github.com/laramies/theHarvester#main-contributors) - [](https://twitter.com/NotoriousRebel1) Matthew Brown @NotoriousRebel1 - [](https://twitter.com/jay%5Ftownsend1) Jay "L1ghtn1ng" Townsend @jay\_townsend1 - [](https://twitter.com/discoverscripts) Lee Baird @discoverscripts ## Thanks: [](https://github.com/laramies/theHarvester#thanks) - John Matherly - Shodan project - Ahmed Aboul Ela - subdomain names dictionaries (big and small)