i Information gathering with theHarvester – All things in moderation

Information gathering with theHarvester

Introduction

TheHarvester is an open source reconnaissance tool. The objective of this program is to gather emails, subdomains, hosts, employee names, open ports and banners from different public sources like search engines, PGP key servers and SHODAN computer database.

TheHarvester mainly makes use of passive techniques and sometimes active techniques as well.

Passive discovery:

– google: google search engine – www.google.com

– google-profiles: google search engine, specific search for Google profiles

– bing: microsoft search engine – www.bing.com

– bingapi: microsoft search engine, through the API (you need to add your Key in the discovery/bingsearch.py file)

– pgp: pgp key server – pgp.rediris.es

– linkedin: google search engine, specific search for Linkedin users

– shodan: Shodan Computer search engine, will search for ports and banner of the discovered hosts (http://www.shodanhq.com/)

– vhost: Bing virtual hosts search

Active discovery:

– DNS brute force: this plugin will run a dictionary brute force enumeration

– DNS reverse lookup: reverse lookup of ip´s discovered in order to find hostnames

– DNS TDL expansion: TLD dictionary brute force enumeration

Source: https://code.google.com/p/theharvester/

[email protected]:~# theharvester 

*******************************************************************
*                                                                 *
* | |_| |__   ___    /\  /\__ _ _ ____   _____  ___| |_ ___ _ __  *
* | __| '_ \ / _ \  / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *
* | |_| | | |  __/ / __  / (_| | |   \ V /  __/\__ \ ||  __/ |    *
*  \__|_| |_|\___| \/ /_/ \__,_|_|    \_/ \___||___/\__\___|_|    *
*                                                                 *
* TheHarvester Ver. 2.6                                           *
* Coded by Christian Martorella                                   *
* Edge-Security Research                                          *
* [email protected]                                   *
*******************************************************************


Usage: theharvester options 

       -d: Domain to search or company name
       -b: data source: google, googleCSE, bing, bingapi, pgp
                        linkedin, google-profiles, people123, jigsaw, 
                        twitter, googleplus, all

       -s: Start in result number X (default: 0)
       -v: Verify host name via dns resolution and search for virtual hosts
       -f: Save the results into an HTML and XML file
       -n: Perform a DNS reverse query on all ranges discovered
       -c: Perform a DNS brute force for the domain name
       -t: Perform a DNS TLD expansion discovery
       -e: Use this DNS server
       -l: Limit the number of results to work with(bing goes from 50 to 50 results,
       -h: use SHODAN database to query discovered hosts
            google 100 to 100, and pgp doesn't use this option)

Examples:
        theharvester -d microsoft.com -l 500 -b google
        theharvester -d microsoft.com -b pgp
        theharvester -d microsoft -l 200 -b linkedin
        theharvester -d apple.com -b googleCSE -l 500 -s 300

Examples

We can control the sources of data to be used with theHarvester by using the -b switch. The sources of data that theHarvester supports are: google, googleCSE, bing, bingapi, pgp, linkedin, google-profiles, people123, jigsaw, twitter, googleplus, all

Example 1: Do passive scanning

Usage: #theHarvester -d [url] -l [limit the number of results] -b [search engine name] -f [save the results intol file]

[email protected]:~# theharvester -d hydrasky.com -b linkedin -l 500

*******************************************************************
*                                                                 *
* | |_| |__   ___    /\  /\__ _ _ ____   _____  ___| |_ ___ _ __  *
* | __| '_ \ / _ \  / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *
* | |_| | | |  __/ / __  / (_| | |   \ V /  __/\__ \ ||  __/ |    *
*  \__|_| |_|\___| \/ /_/ \__,_|_|    \_/ \___||___/\__\___|_|    *
*                                                                 *
* TheHarvester Ver. 2.6                                           *
* Coded by Christian Martorella                                   *
* Edge-Security Research                                          *
* [email protected]                                   *
*******************************************************************


[-] Searching in Linkedin..
    Searching 100 results..
    Searching 200 results..
    Searching 300 results..
    Searching 400 results..
    Searching 500 results..
Users from Linkedin:
====================
Kevin Delwiche
Lou Sirchis
Wouter Pieters

Example 2: Do active scanning – brute force subdomain using option -c

You shoud Copy the dictionary file name is “dns-names.txt” to “theHarvester/” folder.

You can’t download from https://github.com/golismero/golismero/blob/master/tools/theHarvester/dns-names.txt

[email protected]:~/theHarvester# python theHarvester.py -d google.com -c -b google

*******************************************************************
*                                                                 *
* | |_| |__   ___    /\  /\__ _ _ ____   _____  ___| |_ ___ _ __  *
* | __| '_ \ / _ \  / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *
* | |_| | | |  __/ / __  / (_| | |   \ V /  __/\__ \ ||  __/ |    *
*  \__|_| |_|\___| \/ /_/ \__,_|_|    \_/ \___||___/\__\___|_|    *
*                                                                 *
* TheHarvester Ver. 2.7                                           *
* Coded by Christian Martorella                                   *
* Edge-Security Research                                          *
* [email protected]                                   *
*******************************************************************


[-] Searching in Google:
    Searching 0 results...
    Searching 100 results...


[+] Emails found:
------------------
No emails found

[+] Hosts found in search engines:
------------------------------------
[-] Resolving hostnames IPs... 
210.245.14.148:support.google.com
42.112.11.88:www.google.com

[-] Starting DNS brute force:
Using DNS server: ns3.google.com
zz.google.com
[+] Hosts found after DNS brute force:

216.58.203.45:accounts.google.com
210.245.14.98:admin.google.com
www2.l.google.com:ap.google.com
42.112.8.232:billing.google.com
www.blogger.com:blog.google.com
books.google.com:catalog.google.com
books.google.com:catalogue.google.com
210.245.14.20:classroom.google.com
www3.l.google.com:d.google.com
www3.l.google.com:developers.google.com
www3.l.google.com:directory.google.com
dl.l.google.com:dl.google.com
www2.l.google.com:download.google.com
www2.l.google.com:downloads.google.com
gmail.google.com:email.google.com
42.112.8.231:events.google.com
www3.l.google.com:fi.google.com
www3.l.google.com:finance.google.com
www2.l.google.com:gd.google.com
210.245.14.84:gg.google.com
groups.l.google.com:groups.google.com
www3.l.google.com:help.google.com
42.112.8.232:home.google.com
id.l.google.com:id.google.com
images.l.google.com:images.google.com
ipv6.l.google.com:ipv6.google.com
keyhole.l.google.com:kh.google.com
www3.l.google.com:labs.google.com
mobile.l.google.com:m.google.com
googlemail.l.google.com:mail.google.com
mobile.l.google.com:mobile.google.com
mt.l.google.com:mt.google.com
news.l.google.com:news.google.com
216.239.32.10:ns.google.com
216.239.32.10:ns1.google.com
216.239.34.10:ns2.google.com
216.239.36.10:ns3.google.com
www3.l.google.com:on.google.com
www3.l.google.com:partners.google.com
210.245.14.227:photo.google.com
42.112.8.20:photos.google.com
www3.l.google.com:postmaster.google.com
www3.l.google.com:research.google.com
sandbox.l.google.com:sandbox.google.com
sb.l.google.com:sb.google.com
www3.l.google.com:search.google.com
www3.l.google.com:services.google.com
www3.l.google.com:shopping.google.com
www3.l.google.com:sms.google.com
www3.l.google.com:support.google.com
www3.l.google.com:tv.google.com
large-uploads.l.google.com:upload.google.com
feedsftp.l.google.com:uploads.google.com
64.9.224.68:vpn.google.com
www3.l.google.com:vr.google.com
voice-search.l.google.com:vs.google.com
www3.l.google.com:w.google.com
www3.l.google.com:wap.google.com
www3.l.google.com:web.google.com
www3.l.google.com:webmaster.google.com
www3.l.google.com:ww.google.com
216.58.199.4:www.google.com
www3.l.google.com:yp.google.com


Leave a Reply