mirror of
https://github.com/laramies/theHarvester.git
synced 2026-08-26 15:52:22 +02:00
MattandGitHub
1a9b114a5d
* fix: complete DNS enumeration by default * test: avoid URL substring sanitizer alert
100 lines
3.6 KiB
Markdown
100 lines
3.6 KiB
Markdown
# Operator workflows
|
|
|
|
Start with the smallest source set and least active behavior that can answer the engagement question. Replace `example.com` only with an authorized target.
|
|
|
|
## Passive subdomain discovery
|
|
|
|
```bash
|
|
uv run theHarvester -d example.com -b crtsh,certspotter,commoncrawl
|
|
```
|
|
|
|
Use the [README source matrix](https://github.com/laramies/theHarvester/blob/dev/README.md#discovery-sources) to choose complementary sources. Adding every source usually increases noise, rate-limit failures, and runtime more than it improves a focused run.
|
|
|
|
## Save results for automation
|
|
|
|
```bash
|
|
uv run theHarvester -d example.com -b crtsh,certspotter -f report
|
|
```
|
|
|
|
Use `report.json` for automation and `report.xml` for the smaller legacy host/email representation. See [Results and Local Data](Results-and-Local-Data).
|
|
|
|
## DNS resolution
|
|
|
|
```bash
|
|
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
|
|
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh,certspotter -r
|
|
```
|
|
|
|
To control the resolvers used, create a resolver file with one IP address per line and pass its path:
|
|
|
|
```bash
|
|
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
|
|
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh -r resolvers.txt
|
|
```
|
|
|
|
DNS requests disclose candidate names to each selected resolver. Candidates from all selected sources are normalized and deduplicated before one run-wide phase queries A, AAAA, and CNAME at most once per hostname and record type. The phase runs at most 20 hostname jobs concurrently with per-query resolver timeouts and no default query-count or phase-runtime ceiling.
|
|
|
|
Reverse DNS (`-n`) uses an independent run-wide job set. It deduplicates addresses across overlapping discovered `/24` ranges and runs at most 20 PTR jobs concurrently with per-query resolver timeouts and no default request-count or phase-runtime ceiling.
|
|
|
|
## Shodan enrichment
|
|
|
|
Configure the Shodan key, then enrich resolved hosts:
|
|
|
|
```bash
|
|
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
|
|
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh -r -s
|
|
```
|
|
|
|
Shodan output is enrichment after discovery and is separate from what most discovery sources add to the consolidated result columns.
|
|
|
|
## DNS brute force
|
|
|
|
Use only an owned or explicitly authorized target:
|
|
|
|
```bash
|
|
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
|
|
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -c
|
|
```
|
|
|
|
DNS brute force actively tests candidate names. Do not run it against `example.com` or an unrelated third-party domain.
|
|
|
|
## Takeover checks
|
|
|
|
```bash
|
|
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
|
|
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh,certspotter -t
|
|
```
|
|
|
|
Treat matches as leads requiring manual confirmation. Do not claim a takeover from a fingerprint match alone.
|
|
|
|
## Screenshots
|
|
|
|
Install Chromium first, then choose an output directory:
|
|
|
|
```bash
|
|
uv run playwright install chromium
|
|
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
|
|
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh -r --screenshot screenshots
|
|
```
|
|
|
|
Screenshots actively open discovered web services and may retain sensitive page content.
|
|
|
|
## API-path scanning
|
|
|
|
```bash
|
|
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
|
|
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -a
|
|
```
|
|
|
|
Provide a custom path wordlist with `-w FILE`. This sends requests directly to the target and must be explicitly in scope.
|
|
|
|
## Diagnose one provider
|
|
|
|
When a combined run fails, rerun only the affected source with a conservative result limit:
|
|
|
|
```bash
|
|
uv run theHarvester -d example.com -b source-name -l 10
|
|
```
|
|
|
|
Check the provider's current status, authentication requirements, rate limits, and terms before reporting a tool defect.
|