Skip to run evidence

Durable history

# Enumeration runs

0
Search enumeration runs ⌕
◇

No runs match this search.

## Opening the run desk

Loading local lifecycle and evidence records.

!

## Could not open the run desk

W

## No enumeration runs yet

Start an explicitly authorized finite run, or import theHarvester JSONL or SQLite results.

P0
  Passive collection is the default.
P1 / P2
  DNS and direct interaction stay off until selected.
Local
  One isolated worker owns one run at a time.

## -

-

### Lifecycle

### Authorized activity

### Result routes

Choose a route to inspect its evidence.

Scroll sideways for more result routes →

∅

#### No normalized evidence yet

Queued and running records remain visible before terminal evidence exists.

Filter this route

Filter each column below · Drag header dividers to resize

0
Execution outcomes0

Producer | Kind | Outcome | Results | Duration | Reason
--- | --- | --- | --- | --- | ---

Execution outcomes appear after a source or action begins.

### Screenshots

Only files captured inside this enumeration run are served.

Child process log

Choose only work you are authorized to perform. Passive sources are P0; DNS and direct interaction remain off until explicitly selected.

Target hostname or IP Use an explicitly authorized target. Result limit Applied per selected source. Whole-run deadline Termination grace is handled automatically.
Advanced execution controls
Result start offset Skip this many provider results before collection. Recursive DNS depth Zero keeps recursive discovery off. Recursive query budget Hard cap across all resolver vantages. Recursive runtime seconds Finite wall-clock cap for recursive discovery. DNS resolver addresses One or more IP addresses. Recursive DNS requires exactly three. Resolver text file Optional file with one IPv4 or IPv6 address per line. API endpoint paths Optional list for API endpoint interaction, one URL path per line. Leave empty to use the bundled list. Use configured proxies for discovery and takeover checks Exclude hostname results and host-dependent processing
Discovery sources
Filter sources
Add capability
Additional activity
P0 · Shodan enrichment Query Shodan for discovered IP evidence. P0 · RouteViews enrichment Enrich source-attributed IPs with external routing evidence. P1 · DNS lookup Reverse-query every discovered IPv4 address and each address in its /24. P1 · DNS resolution Resolve with the configured resolver addresses. P1 · DNS brute force Query candidate labels against DNS. P2 · Screenshots Contact resolved hosts and capture pages. P2 · Takeover checks Contact discovered hosts, through configured proxies when enabled, for takeover evidence. P2 · API endpoint interaction Contact the target for endpoint evidence.
P2 · Virtual-host discovery

Test harvested in-scope hostnames against every harvested literal IP that fits the shared request cap, breadth-first on HTTPS 443 then HTTP 80. This is harvested-candidate testing, not wordlist brute forcing. HTTP Host and TLS SNI stay aligned; candidate DNS and redirects are never used.

Probe harvested IPs for virtual hosts Literal-IP endpoint override Optional: probe only this endpoint instead of harvested IPs. Providing it also enables discovery. Additional candidate hostnames Optional: augment in-scope hostnames harvested during this run. Providing a name also enables discovery.
Advanced safety controls
Request budget Includes context, controls, candidates, and confirmations. Runtime seconds Hard wall-clock cap. Per-request timeout Seconds allowed for each request. Concurrency Maximum simultaneous candidate requests. Disable HTTPS certificate verification and record that choice

P0 selected · P1 off · P2 off

Choose theHarvester JSONL evidence or a closed, checkpointed SQLite database. Import never contacts the target or replays a run. SQLite stores run evidence but does not embed screenshot files.

⇧ Choose a JSONL or SQLite file JSONL maximum: 10 MiB. SQLite uses the server import limit.