MattandGitHub
1fd5749e52
* Model active evidence in result persistence * Expose active action diagnostics * Persist truthful DNS action evidence * Persist direct action evidence * feat: add authenticated durable run API v1 * Make API file interchange JSONL-only * Harden API evidence boundaries * Remove API rate limiter * Unify API runs with result persistence * Support target action runs * Keep DNS resolver selection action-neutral * Add action-neutral CLI resolver selection * Preserve API evidence across JSONL round trips * Complete HarvestView API run parity * Harden HarvestView run API contracts * Remove obsolete bundled network snapshots Delete the unused bundled AWS IP-range and resolver snapshots while preserving operator-supplied resolver file input. * refactor: canonicalize URL results * docs: define a bounded test budget * Standardize hostname and IP result names * fix(api): avoid duplicate evidence conflicts
3.0 KiB
Operator workflows
Start with the smallest source set and least active behavior that can answer the engagement question. Replace example.com only with an authorized target.
Passive subdomain discovery
uv run theHarvester -d example.com -b crtsh,certspotter,commoncrawl
Use the README source matrix to choose complementary sources. Adding every source usually increases noise, rate-limit failures, and runtime more than it improves a focused run.
Save results for automation
uv run theHarvester -d example.com -b crtsh,certspotter -f report
Use report.json for automation and report.xml for the smaller legacy host/email representation. See Results and Local Data.
DNS resolution
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh,certspotter -r
To control the resolvers used, create a resolver file with one IP address per line and pass its path:
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh -r resolvers.txt
DNS requests disclose candidate names to each selected resolver.
Shodan enrichment
Configure the Shodan key, then enrich resolved hosts:
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh -r -s
Shodan output is enrichment after discovery and is separate from what most discovery sources add to the consolidated result columns.
DNS brute force
Use only an owned or explicitly authorized target:
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -c
DNS brute force actively tests candidate names. Do not run it against example.com or an unrelated third-party domain.
Takeover checks
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh,certspotter -t
Treat matches as leads requiring manual confirmation. Do not claim a takeover from a fingerprint match alone.
Screenshots
Install Chromium first, then choose an output directory:
uv run playwright install chromium
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh -r --screenshot screenshots
Screenshots actively open discovered web services and may retain sensitive page content.
API-path scanning
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -a
Provide a custom path wordlist with -w FILE. This sends requests directly to the target and must be explicitly in scope.
Diagnose one provider
When a combined run fails, rerun only the affected source with a conservative result limit:
uv run theHarvester -d example.com -b source-name -l 10
Check the provider's current status, authentication requirements, rate limits, and terms before reporting a tool defect.