{"id":3253,"date":"2012-01-31T15:29:43","date_gmt":"2012-01-31T15:29:43","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3253"},"modified":"2017-10-21T00:39:22","modified_gmt":"2017-10-20T16:39:22","slug":"theharvester-gather-e-mail-accounts-subdomains-hosts-employee-names-information-gathering-tool","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2012\/01\/theharvester-gather-e-mail-accounts-subdomains-hosts-employee-names-information-gathering-tool\/","title":{"rendered":"theHarvester &#8211; Gather E-mail Accounts, Subdomains, Hosts, Employee Names"},"content":{"rendered":"<p>theHarvester is a tool for gathering e-mail accounts, subdomain names, virtual hosts, open ports\/ banners, and employee names from different public sources (search engines, pgp key servers).<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2012\/01\/theHarvester-Gather-E-mail-Accounts-Subdomains-Hosts-Employee-Names-640x350.jpg\" alt=\"theHarvester - Gather E-mail Accounts, Subdomains, Hosts, Employee Names\" width=\"640\" height=\"350\" class=\"aligncenter size-medium wp-image-4852\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2012\/01\/theHarvester-Gather-E-mail-Accounts-Subdomains-Hosts-Employee-Names-640x350.jpg 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2012\/01\/theHarvester-Gather-E-mail-Accounts-Subdomains-Hosts-Employee-Names-1024x561.jpg 1024w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2012\/01\/theHarvester-Gather-E-mail-Accounts-Subdomains-Hosts-Employee-Names.jpg 1456w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>Is a really simple tool, but very effective for the early stages of a penetration test or just to know the visibility of your company on the Internet.<\/p>\n<h2>theHarvester Information Gathering Sources<\/h2>\n<p>The sources supported are:<\/p>\n<h4>Passive theHarvester Methods<\/h4>\n<ul>\n<li><strong>google:<\/strong> google search engine<\/li>\n<li><strong>googleCSE:<\/strong> google custom search engine<\/li>\n<li><strong>google-profiles:<\/strong> google search engine, specific search for Google profiles<\/li>\n<li><strong>bing:<\/strong> microsoft search engine<\/li>\n<li><strong>bingapi:<\/strong> microsoft search engine, through the API (you need to add your Key)<\/li>\n<li><strong>dogpile:<\/strong> Dogpile search engine<\/li>\n<li><strong>pgp:<\/strong> pgp key server &#8211; mit.edu<\/li>\n<li><strong>linkedin:<\/strong> google search engine, specific search for Linkedin users<\/li>\n<li><strong>vhost:<\/strong> Bing virtual hosts search<\/li>\n<li><strong>twitter:<\/strong> twitter accounts related to an specific domain (uses google search)<\/li>\n<li><strong>googleplus:<\/strong> users that works in target company (uses google search)<\/li>\n<li><strong>yahoo:<\/strong> Yahoo search engine<\/li>\n<li><strong>baidu:<\/strong> Baidu search engine<\/li>\n<li><strong>shodan:<\/strong> Shodan Computer search engine, will search for ports and banners<\/li>\n<\/ul>\n<h4>Active theHarvester Methods<\/h4>\n<ul>\n<li>DNS brute force: this plugin will run a dictionary brute force enumeration<\/li>\n<li>DNS reverse lookup: reverse lookup of IPs discovered in order to find hostnames<\/li>\n<li>DNS TDL expansion: TLD dictionary brute force enumeration<\/li>\n<\/ul>\n<h3>How to use theHarvester<\/h3>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>Searching emails accounts for the domain microsoft.com, it will work with the first 500 google results:<\/p>\n<pre>.\/theharvester.py -d microsoft.com -l 500 -b google<\/pre>\n<p>Searching emails accounts for the domain microsoft.com in a PGP server, here it&#8217;s not necessary to specify the limit.<\/p>\n<pre>.\/theharvester.py -d microsoft.com -b pgp<\/pre>\n<p>Searching for user names that works in the company microsoft, we use google as search engine, so we need to specify the limit of results we want to use:<\/p>\n<pre>.\/theharvester.py -d microsoft.com -l 200 -b linkedin<\/pre>\n<p>Searching in all sources at the same time, with a limit of 200 results:<\/p>\n<pre>.\/theHarvester.py -d microsoft.com -l 200 -b all<\/pre>\n<p>There are some other tools you can check out too like:<\/p>\n<p>&#8211; <a href=\"https:\/\/www.darknet.org.uk\/2017\/06\/snitch-information-gathering-tool-via-dorks\/\">snitch &#8211; Information Gathering Tool Via Dorks<\/a><br \/>\n\u2013 <a href=\"https:\/\/www.darknet.org.uk\/2016\/07\/dmitry-deepmagic-information-gathering-tool\/\">DMitry \u2013 Deepmagic Information Gathering Tool<\/a><br \/>\n\u2013 <a href=\"https:\/\/www.darknet.org.uk\/2015\/03\/wig-cms-identification-information-gathering-tool\/\">wig \u2013 CMS Identification &#038; Information Gathering Tool<\/a><\/p>\n<p>You can download theHarvester here:<\/p>\n<p><a href=\"https:\/\/github.com\/laramies\/theHarvester\/archive\/2.7.zip\">theHarvester-2.7.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/laramies\/theHarvester\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>theHarvester is a tool for gathering e-mail accounts, subdomain names, virtual hosts, open ports\/ banners, and employee names from different public sources (search engines, pgp key servers). Is a really simple tool, but very effective for the early stages of a penetration test or just to know the visibility of your company on the Internet. [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"theHarvester is a tool for gathering e-mail accounts, subdomain names, virtual hosts, open ports\/ banners, and employee names from different public sources.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[9],"tags":[7281,7283,2345,3105,47,7282],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3253"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=3253"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3253\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=3253"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=3253"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=3253"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}