retour aux outils back to tools Ducklings

theHarvester

Outil OSINT pour récupérer emails, sous-domaines, IPs et noms d'employés depuis des sources publiques. Interroge des moteurs de recherche, Shodan, VirusTotal, et plus. OSINT tool for gathering emails, subdomains, IPs, and employee names from public sources. Queries search engines, Shodan, VirusTotal, and more.

↗ https://github.com/laramies/theHarvester

Overview

theHarvester collects email addresses, employee names, subdomains, IP addresses, and URLs from public sources including Google, Bing, DuckDuckGo, LinkedIn, Shodan, VirusTotal, and certificate transparency logs. Essential for the initial passive recon phase.

Basic Usage

Search Google for emails and subdomains

theHarvester -d target.com -b google

Bing search

theHarvester -d target.com -b bing

Multiple sources

theHarvester -d target.com -b google,bing,linkedin,shodan,virustotal

All sources

theHarvester -d target.com -b all

Limit results

theHarvester -d target.com -b google -l 200

Start at result N (for pagination)

theHarvester -d target.com -b bing -S 100

Sources

Passive/no-API sources

theHarvester -d target.com -b baidu,bing,bingapi,certspotter,crtsh,dnsdumpster,\
duckduckgo,google,hackertarget,hunter,otx,rapiddns,sublist3r,threatcrowd,\
threatminer,trello,twitter,urlscan,yahoo

API-required sources (configure in api-keys.yaml)

theHarvester -d target.com -b shodan,virustotal,securitytrails,censys

API Key Configuration

Edit /etc/theHarvester/api-keys.yaml or ~/.theHarvester/api-keys.yaml:

shodan:
  key: YOUR_KEY
virustotal:
  key: YOUR_KEY
hunter:
  key: YOUR_KEY
securitytrails:
  key: YOUR_KEY

Output

Save results to XML

theHarvester -d target.com -b google -f results

Save to HTML

theHarvester -d target.com -b google -f results.html

JSON output (newer versions)

theHarvester -d target.com -b google -f results.json

DNS Brute-Force

Enable DNS brute-force with results

theHarvester -d target.com -b google -c

Custom DNS server

theHarvester -d target.com -b google -e 8.8.8.8

Enable virtual host resolution

theHarvester -d target.com -b google -v

Tips

  • Start with passive sources (google,bing,crtsh,dnsdumpster) before using API-key sources
  • Email addresses found can seed password spraying or phishing campaigns
  • LinkedIn often reveals employee names for targeted attacks
  • Combine with hunter.io (API) for professional email pattern discovery
Help / Man page 
theHarvester [options]

-d domain         Domain to search
-l limit          Limit the number of results (default: 500)
-S start          Start with result N
-b source         Data source(s): all, google, bing, linkedin, shodan, etc.
-e DNS server     DNS server to resolve discovered hosts
-c                DNS brute-force
-f file           Save results to HTML/XML file
-v                Verify host name via DNS resolution
-n                Perform a reverse lookup of all ranges
-r                Enable DNS TLD expansion

Vue d’ensemble

theHarvester collecte des adresses email, noms d’employés, sous-domaines, adresses IP et URLs depuis des sources publiques incluant Google, Bing, DuckDuckGo, LinkedIn, Shodan, VirusTotal, et les logs de certificate transparency. Indispensable pour la phase initiale de reconnaissance passive.

Utilisation de base

# Rechercher sur Google des emails et sous-domaines
theHarvester -d target.com -b google

# Recherche Bing
theHarvester -d target.com -b bing

# Sources multiples
theHarvester -d target.com -b google,bing,linkedin,shodan,virustotal

# Toutes les sources
theHarvester -d target.com -b all

# Limiter les résultats
theHarvester -d target.com -b google -l 200

# Commencer au résultat N (pour la pagination)
theHarvester -d target.com -b bing -S 100

Sources

# Sources passives/sans API
theHarvester -d target.com -b baidu,bing,bingapi,certspotter,crtsh,dnsdumpster,\
duckduckgo,google,hackertarget,hunter,otx,rapiddns,sublist3r,threatcrowd,\
threatminer,trello,twitter,urlscan,yahoo

# Sources nécessitant une API (à configurer dans api-keys.yaml)
theHarvester -d target.com -b shodan,virustotal,securitytrails,censys

Configuration des clés API

Éditer /etc/theHarvester/api-keys.yaml ou ~/.theHarvester/api-keys.yaml :

shodan:
  key: YOUR_KEY
virustotal:
  key: YOUR_KEY
hunter:
  key: YOUR_KEY
securitytrails:
  key: YOUR_KEY

Sortie

# Sauvegarder les résultats en XML
theHarvester -d target.com -b google -f results

# Sauvegarder en HTML
theHarvester -d target.com -b google -f results.html

# Sortie JSON (versions récentes)
theHarvester -d target.com -b google -f results.json

Brute-force DNS

# Activer le brute-force DNS avec les résultats
theHarvester -d target.com -b google -c

# Serveur DNS personnalisé
theHarvester -d target.com -b google -e 8.8.8.8

# Activer la résolution de virtual hosts
theHarvester -d target.com -b google -v

Conseils

  • Commencer par les sources passives (google,bing,crtsh,dnsdumpster) avant d’utiliser des sources nécessitant une clé API
  • Les adresses email trouvées peuvent alimenter des campagnes de password spraying ou de phishing
  • LinkedIn révèle souvent des noms d’employés utiles pour des attaques ciblées
  • Combiner avec hunter.io (API) pour découvrir des patterns d’emails professionnels
Aide / Page de manuel 
theHarvester [options]

-d domain         Domain to search
-l limit          Limit the number of results (default: 500)
-S start          Start with result N
-b source         Data source(s): all, google, bing, linkedin, shodan, etc.
-e DNS server     DNS server to resolve discovered hosts
-c                DNS brute-force
-f file           Save results to HTML/XML file
-v                Verify host name via DNS resolution
-n                Perform a reverse lookup of all ranges
-r                Enable DNS TLD expansion