Introduction
TheHarvester is an open source reconnaissance tool. The objective of this program is to gather emails, subdomains, hosts, employee names, open ports and banners from different public sources like search engines, PGP key servers and SHODAN computer database.
TheHarvester mainly makes use of passive techniques and sometimes active techniques as well.
Passive discovery:
– google: google search engine – www.google.com
– google-profiles: google search engine, specific search for Google profiles
– bing: microsoft search engine – www.bing.com
– bingapi: microsoft search engine, through the API (you need to add your Key in the discovery/bingsearch.py file)
– pgp: pgp key server – pgp.rediris.es
– linkedin: google search engine, specific search for Linkedin users
– shodan: Shodan Computer search engine, will search for ports and banner of the discovered hosts (http://www.shodanhq.com/)
– vhost: Bing virtual hosts search
Active discovery:
– DNS brute force: this plugin will run a dictionary brute force enumeration
– DNS reverse lookup: reverse lookup of ip´s discovered in order to find hostnames
– DNS TDL expansion: TLD dictionary brute force enumeration
Source: https://code.google.com/p/theharvester/
[email protected]:~# theharvester ******************************************************************* * * * | |_| |__ ___ /\ /\__ _ _ ____ _____ ___| |_ ___ _ __ * * | __| '_ \ / _ \ / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| * * | |_| | | | __/ / __ / (_| | | \ V / __/\__ \ || __/ | * * \__|_| |_|\___| \/ /_/ \__,_|_| \_/ \___||___/\__\___|_| * * * * TheHarvester Ver. 2.6 * * Coded by Christian Martorella * * Edge-Security Research * * [email protected] * ******************************************************************* Usage: theharvester options -d: Domain to search or company name -b: data source: google, googleCSE, bing, bingapi, pgp linkedin, google-profiles, people123, jigsaw, twitter, googleplus, all -s: Start in result number X (default: 0) -v: Verify host name via dns resolution and search for virtual hosts -f: Save the results into an HTML and XML file -n: Perform a DNS reverse query on all ranges discovered -c: Perform a DNS brute force for the domain name -t: Perform a DNS TLD expansion discovery -e: Use this DNS server -l: Limit the number of results to work with(bing goes from 50 to 50 results, -h: use SHODAN database to query discovered hosts google 100 to 100, and pgp doesn't use this option) Examples: theharvester -d microsoft.com -l 500 -b google theharvester -d microsoft.com -b pgp theharvester -d microsoft -l 200 -b linkedin theharvester -d apple.com -b googleCSE -l 500 -s 300
Examples
We can control the sources of data to be used with theHarvester by using the -b switch. The sources of data that theHarvester supports are: google, googleCSE, bing, bingapi, pgp, linkedin, google-profiles, people123, jigsaw, twitter, googleplus, all
Example 1: Do passive scanning
Usage: #theHarvester -d [url] -l [limit the number of results] -b [search engine name] -f [save the results intol file]
[email protected]:~# theharvester -d hydrasky.com -b linkedin -l 500 ******************************************************************* * * * | |_| |__ ___ /\ /\__ _ _ ____ _____ ___| |_ ___ _ __ * * | __| '_ \ / _ \ / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| * * | |_| | | | __/ / __ / (_| | | \ V / __/\__ \ || __/ | * * \__|_| |_|\___| \/ /_/ \__,_|_| \_/ \___||___/\__\___|_| * * * * TheHarvester Ver. 2.6 * * Coded by Christian Martorella * * Edge-Security Research * * [email protected] * ******************************************************************* [-] Searching in Linkedin.. Searching 100 results.. Searching 200 results.. Searching 300 results.. Searching 400 results.. Searching 500 results.. Users from Linkedin: ==================== Kevin Delwiche Lou Sirchis Wouter Pieters
Example 2: Do active scanning – brute force subdomain using option -c
You shoud Copy the dictionary file name is “dns-names.txt” to “theHarvester/” folder.
You can’t download from https://github.com/golismero/golismero/blob/master/tools/theHarvester/dns-names.txt
[email protected]:~/theHarvester# python theHarvester.py -d google.com -c -b google ******************************************************************* * * * | |_| |__ ___ /\ /\__ _ _ ____ _____ ___| |_ ___ _ __ * * | __| '_ \ / _ \ / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| * * | |_| | | | __/ / __ / (_| | | \ V / __/\__ \ || __/ | * * \__|_| |_|\___| \/ /_/ \__,_|_| \_/ \___||___/\__\___|_| * * * * TheHarvester Ver. 2.7 * * Coded by Christian Martorella * * Edge-Security Research * * [email protected] * ******************************************************************* [-] Searching in Google: Searching 0 results... Searching 100 results... [+] Emails found: ------------------ No emails found [+] Hosts found in search engines: ------------------------------------ [-] Resolving hostnames IPs... 210.245.14.148:support.google.com 42.112.11.88:www.google.com [-] Starting DNS brute force: Using DNS server: ns3.google.com zz.google.com [+] Hosts found after DNS brute force: 216.58.203.45:accounts.google.com 210.245.14.98:admin.google.com www2.l.google.com:ap.google.com 42.112.8.232:billing.google.com www.blogger.com:blog.google.com books.google.com:catalog.google.com books.google.com:catalogue.google.com 210.245.14.20:classroom.google.com www3.l.google.com:d.google.com www3.l.google.com:developers.google.com www3.l.google.com:directory.google.com dl.l.google.com:dl.google.com www2.l.google.com:download.google.com www2.l.google.com:downloads.google.com gmail.google.com:email.google.com 42.112.8.231:events.google.com www3.l.google.com:fi.google.com www3.l.google.com:finance.google.com www2.l.google.com:gd.google.com 210.245.14.84:gg.google.com groups.l.google.com:groups.google.com www3.l.google.com:help.google.com 42.112.8.232:home.google.com id.l.google.com:id.google.com images.l.google.com:images.google.com ipv6.l.google.com:ipv6.google.com keyhole.l.google.com:kh.google.com www3.l.google.com:labs.google.com mobile.l.google.com:m.google.com googlemail.l.google.com:mail.google.com mobile.l.google.com:mobile.google.com mt.l.google.com:mt.google.com news.l.google.com:news.google.com 216.239.32.10:ns.google.com 216.239.32.10:ns1.google.com 216.239.34.10:ns2.google.com 216.239.36.10:ns3.google.com www3.l.google.com:on.google.com www3.l.google.com:partners.google.com 210.245.14.227:photo.google.com 42.112.8.20:photos.google.com www3.l.google.com:postmaster.google.com www3.l.google.com:research.google.com sandbox.l.google.com:sandbox.google.com sb.l.google.com:sb.google.com www3.l.google.com:search.google.com www3.l.google.com:services.google.com www3.l.google.com:shopping.google.com www3.l.google.com:sms.google.com www3.l.google.com:support.google.com www3.l.google.com:tv.google.com large-uploads.l.google.com:upload.google.com feedsftp.l.google.com:uploads.google.com 64.9.224.68:vpn.google.com www3.l.google.com:vr.google.com voice-search.l.google.com:vs.google.com www3.l.google.com:w.google.com www3.l.google.com:wap.google.com www3.l.google.com:web.google.com www3.l.google.com:webmaster.google.com www3.l.google.com:ww.google.com 216.58.199.4:www.google.com www3.l.google.com:yp.google.com
