← retour aux outils back to tools

# theHarvester

Outil OSINT pour récupérer emails, sous-domaines, IPs et noms d'employés depuis des sources publiques. Interroge des moteurs de recherche, Shodan, VirusTotal, et plus. OSINT tool for gathering emails, subdomains, IPs, and employee names from public sources. Queries search engines, Shodan, VirusTotal, and more.

↗ https://github.com/laramies/theHarvester

## Overview

theHarvester collects email addresses, employee names, subdomains, IP addresses, and URLs from public sources including Google, Bing, DuckDuckGo, LinkedIn, Shodan, VirusTotal, and certificate transparency logs. Essential for the initial passive recon phase.

## Basic Usage

Search Google for emails and subdomains

    theHarvester -d target.com -b google

Bing search

    theHarvester -d target.com -b bing

Multiple sources

    theHarvester -d target.com -b google,bing,linkedin,shodan,virustotal

All sources

    theHarvester -d target.com -b all

Limit results

    theHarvester -d target.com -b google -l 200

Start at result N (for pagination)

    theHarvester -d target.com -b bing -S 100

## Sources

Passive/no-API sources

    theHarvester -d target.com -b baidu,bing,bingapi,certspotter,crtsh,dnsdumpster,\
    duckduckgo,google,hackertarget,hunter,otx,rapiddns,sublist3r,threatcrowd,\
    threatminer,trello,twitter,urlscan,yahoo

API-required sources (configure in api-keys.yaml)

    theHarvester -d target.com -b shodan,virustotal,securitytrails,censys

## API Key Configuration

Edit `/etc/theHarvester/api-keys.yaml` or `~/.theHarvester/api-keys.yaml`:

    shodan:
      key: YOUR_KEY
    virustotal:
      key: YOUR_KEY
    hunter:
      key: YOUR_KEY
    securitytrails:
      key: YOUR_KEY

## Output

Save results to XML

    theHarvester -d target.com -b google -f results

Save to HTML

    theHarvester -d target.com -b google -f results.html

JSON output (newer versions)

    theHarvester -d target.com -b google -f results.json

## DNS Brute-Force

Enable DNS brute-force with results

    theHarvester -d target.com -b google -c

Custom DNS server

    theHarvester -d target.com -b google -e 8.8.8.8

Enable virtual host resolution

    theHarvester -d target.com -b google -v

## Tips

- Start with passive sources (`google,bing,crtsh,dnsdumpster`) before using API-key sources
- Email addresses found can seed password spraying or phishing campaigns
- LinkedIn often reveals employee names for targeted attacks
- Combine with `hunter.io` (API) for professional email pattern discovery

Help / Man page

    theHarvester [options]

    -d domain         Domain to search
    -l limit          Limit the number of results (default: 500)
    -S start          Start with result N
    -b source         Data source(s): all, google, bing, linkedin, shodan, etc.
    -e DNS server     DNS server to resolve discovered hosts
    -c                DNS brute-force
    -f file           Save results to HTML/XML file
    -v                Verify host name via DNS resolution
    -n                Perform a reverse lookup of all ranges
    -r                Enable DNS TLD expansion

## Vue d’ensemble

theHarvester collecte des adresses email, noms d’employés, sous-domaines, adresses IP et URLs depuis des sources publiques incluant Google, Bing, DuckDuckGo, LinkedIn, Shodan, VirusTotal, et les logs de certificate transparency. Indispensable pour la phase initiale de reconnaissance passive.

## Utilisation de base

    # Rechercher sur Google des emails et sous-domaines
    theHarvester -d target.com -b google

    # Recherche Bing
    theHarvester -d target.com -b bing

    # Sources multiples
    theHarvester -d target.com -b google,bing,linkedin,shodan,virustotal

    # Toutes les sources
    theHarvester -d target.com -b all

    # Limiter les résultats
    theHarvester -d target.com -b google -l 200

    # Commencer au résultat N (pour la pagination)
    theHarvester -d target.com -b bing -S 100

## Sources

    # Sources passives/sans API
    theHarvester -d target.com -b baidu,bing,bingapi,certspotter,crtsh,dnsdumpster,\
    duckduckgo,google,hackertarget,hunter,otx,rapiddns,sublist3r,threatcrowd,\
    threatminer,trello,twitter,urlscan,yahoo

    # Sources nécessitant une API (à configurer dans api-keys.yaml)
    theHarvester -d target.com -b shodan,virustotal,securitytrails,censys

## Configuration des clés API

Éditer `/etc/theHarvester/api-keys.yaml` ou `~/.theHarvester/api-keys.yaml` :

    shodan:
      key: YOUR_KEY
    virustotal:
      key: YOUR_KEY
    hunter:
      key: YOUR_KEY
    securitytrails:
      key: YOUR_KEY

## Sortie

    # Sauvegarder les résultats en XML
    theHarvester -d target.com -b google -f results

    # Sauvegarder en HTML
    theHarvester -d target.com -b google -f results.html

    # Sortie JSON (versions récentes)
    theHarvester -d target.com -b google -f results.json

## Brute-force DNS

    # Activer le brute-force DNS avec les résultats
    theHarvester -d target.com -b google -c

    # Serveur DNS personnalisé
    theHarvester -d target.com -b google -e 8.8.8.8

    # Activer la résolution de virtual hosts
    theHarvester -d target.com -b google -v

## Conseils

- Commencer par les sources passives (`google,bing,crtsh,dnsdumpster`) avant d’utiliser des sources nécessitant une clé API
- Les adresses email trouvées peuvent alimenter des campagnes de password spraying ou de phishing
- LinkedIn révèle souvent des noms d’employés utiles pour des attaques ciblées
- Combiner avec `hunter.io` (API) pour découvrir des patterns d’emails professionnels

Aide / Page de manuel

    theHarvester [options]

    -d domain         Domain to search
    -l limit          Limit the number of results (default: 500)
    -S start          Start with result N
    -b source         Data source(s): all, google, bing, linkedin, shodan, etc.
    -e DNS server     DNS server to resolve discovered hosts
    -c                DNS brute-force
    -f file           Save results to HTML/XML file
    -v                Verify host name via DNS resolution
    -n                Perform a reverse lookup of all ranges
    -r                Enable DNS TLD expansion