Skip to content
Deepak Gupta markRecon Atlas

Subdomain discovery

theHarvester

OSINT collector that gathers hostnames, emails, IPs, URLs, ASNs and breach names for a domain from 66 public sources.

Passive and active modesScope a pentestAudit your own exposure

18k stars · last push November 10, 2026 · 4.11.1 · GPL-2.0

GitHub repositoryOfficial docs

What it finds

theHarvester queries search engines, certificate transparency logs, passive DNS, code repositories and threat-intelligence platforms about a domain or organization. It labels each source by network behavior: P0 passive, P1 DNS, P2 direct contact. Evidence lands in a local SQLite store, reachable from the CLI, a REST API and the HarvestView web UI.

  • subdomains
  • email addresses
  • IP addresses
  • ASNs
  • URLs
  • people
  • breach names

Does it touch the target?

Has a passive mode and active modes. The active modes need the owner's permission.

README: "-b all runs every cataloged P0 passive source. P1 DNS and P2 direct sources require explicit selection." Active options include DNS resolution (-r), DNS brute force (-c), reverse DNS (-n), takeover checks (-t), API path scanning (-a) and screenshots (--screenshot).

API keys: README: the API key column refers to provider settings in api-keys.yaml; many sources run with no key, others are marked Required or Optional.

Install

Install with source
git clone https://github.com/laramies/theHarvester.git
cd theHarvester
uv sync
uv run theHarvester -h

From the project's documentation

Install with package
sudo apt update
sudo apt install theharvester
theHarvester -h

From the project's documentation

Install with docker
docker compose up --build -d

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

First run with two keyless passive sources
uv run theHarvester -d example.com -b crtsh,certspotter

From the project's documentation

Run every source that can contribute subdomains
uv run theHarvester -d example.com -b subdomains

From the project's documentation

Save results as JSONL plus JSON and XML reports
uv run theHarvester -d example.com -b crtsh,certspotter -f report

From the project's documentation

Collect passively, then resolve discovered hosts for a domain you control
AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh,certspotter -r

From the project's documentation

Output formats: jsonl, json, xml, sqlite

Limits the project documents

  • Requires Python 3.14 and uv for a source install.
  • Passive (P0) sources still send the target string to the selected providers.
  • Provider quotas and runtime safeguards still cap results even with --limit 0.
  • --no-hosts cannot be combined with actions that depend on hostnames.
  • The Docker image starts HarvestView, not an interactive CLI.

Deepak's take

Analysis, not documentation

Use it when
Use it when you need your organisation's publicly exposed email addresses alongside its hostnames, with a record of which source returned each finding.
Skip it when
Skip it when you only need a fast subdomain list; subfinder is lighter. For internet-wide host search by query, use uncover.
What it will miss
It will not find assets that no selected source has indexed, and a zero-result source is not proof of absence.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Listed under GitHub's reconnaissance topic. Licence: GPL-2.0. theHarvester is a trademark or project name of its owners; this library is not affiliated with it.