theHarvester

theHarvester is one of the most established passive reconnaissance tools in the OSINT toolkit, designed to gather email addresses, subdomains, employee names, open ports, and banners from public sources. Developed by the team at Edge-Security and maintained as part of Kali Linux, it queries dozens of data sources simultaneously including search engines, certificate transparency logs, and specialized APIs.

What theHarvester is used for: performing initial footprinting on target organizations, discovering employee email addresses for phishing simulations and social engineering research, enumerating subdomains as part of attack surface analysis, and aggregating information from multiple public sources in a single workflow.

What data theHarvester exposes: email addresses associated with a domain, subdomain hostnames and IP mappings, employee names scraped from LinkedIn and other sources, virtual hosts on the same IP, and open port banners from passive sources like Shodan. Sources include Google, Bing, DuckDuckGo, Hunter.io, Censys, Shodan, SecurityTrails, and many others depending on API key configuration.

theHarvester is command-line based, making it suitable for scripting and automation. A typical investigation starts by running theHarvester against the target domain with multiple sources enabled, reviewing discovered email formats (which reveal naming conventions for the whole organization), and then pivoting those email addresses into breach databases or LinkedIn searches.

Email format discovery: even if theHarvester only returns a handful of email addresses, the format they follow — firstname.lastname@domain.com or f.lastname@domain.com — allows investigators to construct additional addresses for any known employee name. Combined with LinkedIn data, this technique can enumerate large portions of an organization's email directory.

API requirements: many of theHarvester's most valuable sources require API keys, including Shodan, Hunter.io, SecurityTrails, and FullHunt. Running without these keys still produces useful results from search engine scraping, but the full picture requires configured credentials.

In a workflow: run theHarvester at the start of a domain investigation before more targeted queries. Use discovered subdomains to feed into DNS enumeration tools like Amass or DNS History, and discovered email addresses to query Have I Been Pwned and Emailrep for breach context and reputation data.