theHarvester/docs/wiki/Operator-Workflows.md

Operator workflows

Start with the smallest source set and least active behavior that can answer the engagement question. Replace example.com only with an authorized target.

Passive subdomain discovery

uv run theHarvester -d example.com -b crtsh,certspotter,commoncrawl

Use the README source matrix to choose complementary sources. Adding every source usually increases noise, rate-limit failures, and runtime more than it improves a focused run.

Save results for automation

uv run theHarvester -d example.com -b crtsh,certspotter -f report

Use report.json for automation and report.xml for the smaller legacy host/email representation. See Results and Local Data.

DNS resolution

AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh,certspotter -r

To control the resolvers used, create a resolver file with one IP address per line and pass its path:

AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh -r resolvers.txt

DNS requests disclose candidate names to each selected resolver. Candidates from all selected sources are normalized and deduplicated before one run-wide phase queries A, AAAA, and CNAME at most once per hostname and record type. The phase runs at most 20 hostname jobs concurrently with per-query resolver timeouts and no default query-count or phase-runtime ceiling.

Reverse DNS (-n) uses an independent run-wide job set. It deduplicates addresses across overlapping discovered /24 ranges and runs at most 20 PTR jobs concurrently with per-query resolver timeouts and no default request-count or phase-runtime ceiling.

Shodan enrichment

Configure the Shodan key, then enrich resolved hosts:

AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh -r -s

Shodan output is enrichment after discovery and is separate from what most discovery sources add to the consolidated result columns.

DNS brute force

Use only an owned or explicitly authorized target:

AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -c

DNS brute force actively tests candidate names. Do not run it against example.com or an unrelated third-party domain.

Takeover checks

AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh,certspotter -t

Treat matches as leads requiring manual confirmation. Do not claim a takeover from a fingerprint match alone.

Screenshots

Install Chromium first, then choose an output directory:

uv run playwright install chromium
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh -r --screenshot screenshots

Screenshots actively open discovered web services and may retain sensitive page content.

API-path scanning

AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -a

Provide a custom path wordlist with -w FILE. This sends requests directly to the target and must be explicitly in scope.

Diagnose one provider

When a combined run fails, rerun only the affected source with a conservative result limit:

uv run theHarvester -d example.com -b source-name -l 10

Check the provider's current status, authentication requirements, rate limits, and terms before reporting a tool defect.