theHarvester Cheat Sheet

theHarvester pulls emails, subdomains, hostnames, and employee names for a target domain by querying a wide range of public sources — search engines, certificate transparency logs, DNS, and specialized services like Shodan — in a single run instead of checking each one by hand.

Red Team / Offensive Use

theHarvester's output feeds directly into later phases: a subdomain list expands the attack surface beyond the main domain, and a confirmed email-naming convention (first.last@example.com vs. flast@example.com) turns a list of employee names from LinkedIn into a real target list for a phishing simulation or password-spray attempt. It's almost always one of the first tools run in the recon phase of an authorized engagement, alongside manual DNS and certificate-transparency checks.

Established Cheatsheet

laramies/theHarvester — the official repository, with the full list of supported data sources and required API keys for the ones that need them.

PWNMI's Top 5 Use Cases

• theHarvester -d example.com -b all — query every supported source at once; the broadest first pass against a new target
• theHarvester -d example.com -b crtsh — certificate transparency only; fast, free, no API key required, and often the single highest-signal source for subdomains
• theHarvester -d example.com -b google -l 200 — search-engine results, limited to 200 per source; useful when you specifically want indexed pages rather than DNS/cert data
• theHarvester -d example.com -b shodan — cross-references discovered hosts against Shodan for exposed services (requires a Shodan API key)
• theHarvester -d example.com -b all -f results — save output to file; do this by default, results are easy to lose track of across a long recon phase

Next step

New to OSINT entirely? Start with OSINT Fundamentals for the methodology this tool fits into, or see Shodan for finding exposed services by fingerprint rather than domain name.