theHarvester — OSINT Collector GuideStep-by-step theHarvester reference: harvest emails, subdomains and hosts from public sources for your own domain. Educational use only.FAQ

What is theHarvester?

theHarvester is an OSINT collector: give it your domain and a public source (Bing, crt.sh, ThreatMiner) and it returns emails, subdomains, hosts and IPs it found. It only reads public data — but it shows how much of your organization is already public.

Is theHarvester illegal?

It queries public search engines and certificate logs, which is passive recon. Still, run it only on your own domains or permitted targets, and never spam or harass harvested addresses.

What does -b do?

-b picks the data source: bing, crtsh, threatminer, urlscan and more. Different sources see different slices, so run two or three and merge the results for full coverage.

How do I find subdomains with it?

Run theHarvester -d example.com -b crtsh. Certificate transparency logs record every TLS certificate, including subdomains — a goldmine attackers check first, so you should check yours.

Why does it find old emails?

Search engines cache for years. An address from a 2019 PDF still appears today and still gets phished. That persistence is why generic contact addresses beat personal ones.

What is the difference between active and passive recon?

Passive (theHarvester, crt.sh) reads third-party public data without touching the target. Active (Nmap, Gobuster) sends packets to the target. Passive is quieter and safer to start with.

How do I use the results?

Feed discovered subdomains into Subfinder/Gobuster for active checks, hand emails to your phishing-training team, and delete or protect anything that should never have been public.

How do I shrink my footprint?

Use generic contact emails, strip document metadata before uploading, delete stale DNS records, and search your own domain monthly. If theHarvester finds it in seconds, so does everyone else.

All tools · Sitemap · Games