root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat theharvester.md
// recon

theHarvester

21 Jul 2026 · 5 min read
reconcheatsheetstheharvester
theHarvester is an OSINT tool that collects emails, employee names, hosts and subdomains for a domain by querying public sources such as search engines, certificates and third-party APIs. It is one of the first pieces of the reconnaissance phase, because it maps out an organization's external attack surface without directly touching its systems. It is run with -d for the domain and -b to pick the sources.

The key nuance is the difference between passive and active collection. With -b you query third-party sources and leave no trace on the target, but options like -c (DNS brute force) or -p (port scanning) do generate direct traffic against the infrastructure. On top of that, many sources (Shodan, Censys, SecurityTrails, Intelligence X, GitHub) require an API key configured in api-keys.yaml: without one, those sources return little or nothing.

1. Beginner level — sources and basic collection

THEHARVESTER cheat sheet — Beginner
CommandWhat it does
theHarvester -d dom.com -b allOSINT from all sources
theHarvester -d dom.com -b googleGoogle only
theHarvester -d dom.com -b bingBing only
theHarvester -d dom.com -b linkedinEmployees on LinkedIn
theHarvester -d dom.com -b crtshSubdomains via crt.sh
theHarvester -d dom.com -l 500 -b googleLimit the results
theHarvester -d dom.com -b all -f outSave to HTML/XML
theHarvester -d dom.com -b all -S 100Start at result N
theHarvester -d dom.com -b dnsdumpsterSubdomains via DNSdumpster
theHarvester -hShow the help
theHarvester -d dom.com -b hackertargetHackerTarget source
theHarvester -d dom.com -b otxAlienVault OTX
theHarvester -d dom.com -b duckduckgoDuckDuckGo source
theHarvester -d dom.com -b all -vVerify the hosts (resolve)

2. Advanced level — active DNS and APIs

THEHARVESTER cheat sheet — Advanced
CommandWhat it does
theHarvester -d dom.com -b all -f reportFull report (JSON/XML)
theHarvester -d dom.com -b all -nReverse DNS lookup of the range
theHarvester -d dom.com -b all -cDNS brute force
theHarvester -d dom.com -b all -tDetect typo domains (TLD)
theHarvester -d dom.com -b shodanEnrichment with Shodan (API)
theHarvester -d dom.com -b censysData from Censys (API)
theHarvester -d dom.com -b all -pPort scan of the found hosts
theHarvester -d dom.com -b securitytrailsSecurityTrails source (API)
theHarvester -d dom.com -b all -rDNS resolution of the results
cat ~/.theHarvester/api-keys.yamlConfigure the API keys
theHarvester -d dom.com -b github-codeSearch in GitHub code
theHarvester -d dom.com -b all -e 8.8.8.8Specific DNS server
theHarvester -d dom.com -b all | tee harvest.txtSave all the output
theHarvester -d dom.com -b intelxIntelligence X source (API)

3. Details people miss

  • -b all is slow and noisy: it walks through every source and some fail on timeout or rate limit. For quick recon, pick specific sources (-b crtsh,bing,otx) instead of all of them.
  • Paid sources (Shodan, Censys, SecurityTrails, Intelligence X, GitHub) need an API key in ~/.theHarvester/api-keys.yaml. If you don't set it, those sources are silently skipped and you'll think there's no data.
  • -b is passive (it queries third parties), but -c, -p and -n directly touch the target's infrastructure. Don't use them without explicit authorization if you need to stay off the radar.
  • Always verify subdomains with -v or -r: many sources return historical or non-existent hosts, and resolving them via DNS leaves you only the ones that are live.
  • The binary name has an internal capital letter: it's theHarvester, not theharvester. It's a very common typo that makes the command fail.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.