theHarvester

theHarvester gathers open-source intelligence about a domain or organization from search engines, certificate transparency logs, DNS datasets, code repositories, threat-intelligence platforms, and other public sources. It normalizes hostnames, email addresses, IP addresses, URLs, ASNs, people, breach names, and structured evidence from optional actions.

Use theHarvester during the early reconnaissance stage of an authorized security assessment. Run it only against targets you own or have explicit permission to test.

Quick start

theHarvester requires Python 3.14 and uv. The repository's .python-version lets uv select the required Python version automatically:

git clone https://github.com/laramies/theHarvester.git
cd theHarvester
uv sync
uv run theHarvester -d example.com -b crtsh,certspotter

This first run uses two P0 passive sources that need no API key. Passive means the target is not contacted directly, but the selected providers still receive the target string. The terminal reports each source outcome and any retained findings. A source can complete with zero findings, stop early with partial evidence, or fail without erasing evidence retained by other sources.

See the installation guide for packaged distributions and platform-specific setup.

Choose how to work

Interface	Best for	Start with
CLI	One-off reconnaissance and shell workflows	uv run theHarvester -h
HarvestView	Local run history, evidence review, hostname changes, and schedules	uv run harvestview
REST API	Authenticated local automation and integrations	http://127.0.0.1:5000/docs

The CLI, REST API, and HarvestView share one finite-run engine and normalized evidence model. HarvestView provides the local browser interface.

Common workflows

Query several P0 passive sources:

uv run theHarvester -d example.com -b crtsh,certspotter,commoncrawl

Three discovery sources run at once by default. Use -j or --source-workers to change the worker count. Every selected source still runs.

Run every source that can contribute subdomains:

uv run theHarvester -d example.com -b subdomains

Combine capability selectors, or mix them with explicit source names:

uv run theHarvester -d example.com -b emails,urls,certspotter

Capability selectors form a union and choose which sources run. They do not discard other result types returned by those sources. Available selectors are subdomains, emails, ips, asns, urls, people, and breaches. -b all runs every cataloged P0 passive source. P1 DNS and P2 direct sources require explicit selection.

Pass --limit 0 to remove the shared per-source result cap and local page ceilings. Provider quotas and runtime safeguards still apply. If a provider or safety limit stops a source after retaining results, the run keeps them and records a partial outcome with the stop reason.

Exclude hostname results while retaining other result types:

uv run theHarvester -d example.com -b emails,ips,urls --no-hosts -f non-host-results

--no-hosts skips hostname-only sources and omits hostname results while keeping other result types. It cannot be combined with actions that depend on hostnames. HarvestView and the REST API expose the same option as no_hosts.

Save results as JSONL:

uv run theHarvester -d example.com -b crtsh,certspotter -f report

This writes report.jsonl for automation and interchange plus report.json and report.xml compatibility reports. Completed runs are also retained in the local SQLite evidence store.

Resolve discovered hosts for an authorized domain with the default resolver list:

AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh,certspotter -r

List every option and its current behavior:

uv run theHarvester -h

Activity and scope

P0, P1, and P2 describe observable network behavior, not confidence or importance.

Class	Network behavior	Examples
P0	Queries an existing provider or dataset without directing traffic toward the target	Search, certificate transparency, code, and passive DNS providers
P1	Queries DNS about authorized names or addresses	Resolution, brute force, recursive DNS, and reverse lookup
P2	Contacts a target endpoint or causes equivalent direct interaction	HTTP, TLS, screenshots, takeover checks, virtual hosts, ports, and API paths

P1 and P2 activity runs only when you select it. A discovered related hostname, network, ASN, or URL remains review evidence and does not expand the authorized target automatically. The exact hostname matters: www.example.test and example.test are different targets unless the engagement authorizes both.

Common active options include DNS resolution (-r), DNS brute force (-c), reverse DNS (-n), recursive DNS (--dns-recursive-depth), takeover checks (-t), API path scanning (-a), and screenshots (--screenshot). A takeover indicator is evidence for review, not proof that a provider resource can be claimed.

Read Responsible use and scope before active work. Operator workflows covers limits, resolvers, proxies, and action-specific behavior. With explicit proxy mode enabled, supported discovery and actions fail closed when no proxy is available instead of sending a direct request.

A practical engagement workflow

1. Record the exact targets and activity the engagement authorizes.
2. Start with a bounded P0 run and inspect every source outcome, including zero-result and partial sources.
3. Add only the P1 or P2 actions the engagement authorizes for that target.
4. Review normalized results, retained DNS evidence, stop reasons, and artifacts together.
5. Compare finalized runs with matching targets, source sets, limits, and resolvers collected in comparable time windows.
6. Export the required evidence, then pause or delete schedules and verify that no queued or running work remains when authorization ends.

Architecture at a glance

From authorized target to retained evidence

HarvestView local control and evidence

Read run results correctly

theHarvester reports control flow, evidence quality, and producer outcomes separately: