01 · Product name
theHarvester
Collect emails, names, and hosts from public sources.
Published by Christian Martorella and contributors.
In short
theHarvester is a command-line collector for emails, names, subdomains, IPs, and URLs tied to a domain. It queries public sources such as search engines, certificate logs, and other indexes. It is free, open source, and shipped with Kali. It does not validate that an address is live. Confirm a result before you cite it.
Product pricing strategy
02
Free
theHarvester is free. You do not buy a seat to use what the project publishes.
Yes. It is free and open source. Some optional data sources require an API key that may have its own price.
Utility and features
03
theHarvester, started by Christian Martorella, is still the short command for “what names are public for this domain?” Sources rotate as websites change their terms and their HTML. A source that worked last year may return nothing today. That is normal. Treat the output as a harvest, then verify.
- Targets. Usually a domain. Results can include emails, employee-style names, hosts, and URLs, depending on the source you selected.
- Sources. You pick engines and datasets with a source flag. Some need API keys. crt.sh-style certificate data and search indexes fail differently, so run more than one source.
- Limits. It finds published strings. It does not prove the mailbox exists, that the person still works there, or that the host is in scope.
It overlaps Amass and Subfinder on hostnames and does a better job than either on email-shaped strings found in public pages and indexes. It is not a breach search. Have I Been Pwned and Intelligence X answer a different question. Run it passively, keep the source flag in your notes, and do not send mail to addresses you harvested just to see who answers.
- 1
Install theHarvester from the project repo or your distribution packages.
- 2
Run it against a domain you are allowed to research, with one or two sources you can explain.
- 3
Save the output. Note the date and the source flag beside the file.
- 4
Verify emails and hosts with a second tool before they go into a report or a scope.
Caveats
04
theHarvester is a free collector. It repeats what search engines, PGP keyservers, and certificate logs already show. Those sources are incomplete, cached, and sometimes wrong. An email in the output can be a spam trap, a dead mailbox, or a name the tool parsed out of a sentence.
It is not authorization to send mail, to brute-force logins, or to scan the hosts. Pair it with Amass or Subfinder for names and with Hunter when you want that vendor’s own data. Record which sources you enabled.
Screenshots
05
Potential use cases
06
- You have permission to assess a domain and you want the names public sources already published. Run theHarvester against that domain with the sources you select. You get emails, hosts, and sometimes people-strings from search indexes and certificate logs. Pivot the hostnames into a passive Amass or Subfinder run instead of guessing a wordlist. A harvested email pattern is a pattern, not proof the mailbox exists.
- Certificate transparency already shows names you did not want to brute-force. Use theHarvester’s certificate and search sources, export the list, and mark the source on each row. Pivot a name that looks like remote access to DNSDumpster or Shodan for a different view of the same DNS, still passively. Search engines omit and invent. Do not mail the addresses.
- A new analyst needs to see the difference between a string and an account. Run one domain, open two of the email hits in a browser, and show which ones are real pages versus search snippets. The lesson is the output. Hunter is the pivot when you need a vendor’s pattern and a deliverability check rather than a scrape of public pages.
Hard cases
The case where the first result is easy to over-read.
The email pattern is treated as a staff list
The output suggests firstname.lastname at the domain. That is a guess the sources supported, not a directory. Do not generate a hundred addresses and do not try them against a login. If you need a published role address, check Hunter and the company’s own site, and cite the page. Keep the harvested list as a lead sheet with the date and the sources.
Questions
Is theHarvester free?
Yes. It is free and open source. Some optional data sources require an API key that may have its own price.
Does theHarvester hack email accounts?
No. It collects addresses and hostnames that public sources already expose. It does not log in to mailboxes.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
theHarvester repository
https://github.com/laramies/theHarvesterDocumentation
theHarvester README
https://github.com/laramies/theHarvester/blob/master/README.md