Sweshi's Tutorials

theHarv3ster Tutorial

NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
theHarvester installation

I am running this tutorial on Kali Linux, I will start by first installing theHarvester tool. On recent versions of Kali Linux, the tool should be already pre-installed but incase it is not run the following command to install it

sudo apt install theharvester
theHarvester exmaple usage

This is a simple program that gathers subdomain names, email addresses, virtual hosts, open ports/banners and employee names from different public sources. It can search from various sources.

Penetration Testing: theharvester -d cyberacademy.ac.zm -l 10 -b all

In the command above, the target is cyberacademy.ac.zm, I then limit the number of results to 10 and the sources is all so that it searches through every source it has.

Penetration Testing: theharvester results.

When you look at the result, it shows various thins such as the autonomous systems the domain name is listed in, the interesting links on the website, the IP address, there is one email address shown and a few other hosts.

To get more options you can run the following command to list all the possible options

theHarvester -h Penetration Testing: theHarvester -h

From the result that comes, you will see that there are many sources but by using "-b all" you can search through everything. There are several options including the use of shodan to query discovered hosts, using proxies and so on. Try according to your needs.