theHarvester — OSINT Email & Domain Recon

theHarvester gathers emails, names, subdomains, IPs and URLs from multiple public sources.

8 views Apr 2026 lazyhackers

Basic Recon (8)

theHarvester -d target.com -b all

Use all sources for recon

basic all

theHarvester -d target.com -b google

Google dorking for emails/subdomains

google

theHarvester -d target.com -b bing

Bing search for emails/subdomains

bing

theHarvester -d target.com -b linkedin

LinkedIn employee enumeration

linkedin employees

theHarvester -d target.com -b shodan

Shodan infrastructure intel

shodan infra

theHarvester -d target.com -b certspotter

Certificate transparency logs

certs ct

theHarvester -d target.com -b hunter

Hunter.io email discovery (API key required)

email hunter

theHarvester -d target.com -b dnsdumpster

DNS records via DNSDumpster

dns

Options & Output (7)

theHarvester -d target.com -b all -l 200

Limit to 200 search results

limit

theHarvester -d target.com -b google -f results

Save results to HTML and XML files

output

theHarvester -d target.com -b all -v

Verbose output

verbose

theHarvester -d target.com -b google -s 50

Start at result offset 50

offset

theHarvester -d target.com -b all -n

DNS reverse lookup on discovered IPs

dns reverse

theHarvester -d target.com -b all -c

DNS brute force with TLD expansion

dns bruteforce

theHarvester -d target.com -b all -t

Perform DNS TLD expansion

dns tld