# Operator workflows

Start with the smallest source set and least active behavior that can answer the engagement question. Replace `example.com` only with an authorized target.

## Passive subdomain discovery

```bash
uv run theHarvester -d example.com -b crtsh,certspotter,commoncrawl
```

Use the [README source matrix](https://github.com/laramies/theHarvester/blob/dev/README.md#discovery-sources) to choose complementary sources. Adding every source usually increases noise, rate-limit failures, and runtime more than it improves a focused run.

## Save results for automation

```bash
uv run theHarvester -d example.com -b crtsh,certspotter -f report
```

Use `report.jsonl` for automation, provenance, and run interchange. The same command also writes `report.json` and `report.xml` compatibility files. See [Results and Local Data](Results-and-Local-Data).

## DNS resolution

```bash
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh,certspotter -r
```

To control the resolvers used, create a resolver file with one IP address per line and pass its path:

```bash
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh -r resolvers.txt
```

DNS requests disclose candidate names to each selected resolver. Candidates from all selected sources are normalized and deduplicated before one run-wide phase queries A, AAAA, and CNAME at most once per hostname and record type. The phase runs at most 20 hostname jobs concurrently with per-query resolver timeouts and no default query-count or phase-runtime ceiling.

Reverse DNS (`-n`) uses an independent run-wide job set. It deduplicates addresses across overlapping discovered `/24` ranges and runs at most 20 PTR jobs concurrently with per-query resolver timeouts and no default request-count or phase-runtime ceiling.

## Shodan enrichment

Configure the Shodan key, then enrich resolved hosts:

```bash
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh -r -s
```

Shodan host enrichment runs after discovery and is separate from the `shodan` source's subdomain results.

## DNS brute force

Use only an owned or explicitly authorized target:

```bash
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -c
```

DNS brute force actively tests candidate names. Do not run it against `example.com` or an unrelated third-party domain.

## Takeover checks

```bash
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh,certspotter -t
```

Treat matches as leads requiring manual confirmation. Do not claim a takeover from a fingerprint match alone.

## Screenshots

Install Chromium first, then choose an output directory:

```bash
uv run playwright install chromium
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh -r --screenshot screenshots
```

Screenshots actively open discovered web services and may retain sensitive page content.

## API-path scanning

```bash
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -a
```

Provide a custom path wordlist with `-w FILE`. This sends requests directly to the target and must be explicitly in scope.

## Diagnose one provider

When a combined run fails, rerun only the affected source with a conservative result limit:

```bash
uv run theHarvester -d example.com -b source-name -l 10
```

Check the provider's current status, authentication requirements, rate limits, and terms before reporting a tool defect.