What is theHarvester?
theHarvester collects open-source intelligence from search engines, certificate transparency logs, DNS datasets, code repositories and threat-intelligence providers. It normalizes findings such as hostnames, email addresses, IP addresses, URLs, ASNs, people and breach names for early reconnaissance in authorized security assessments.
Operators can use the command line, the HarvestView local browser interface or an authenticated REST API. Local installation requires Python and uv; Docker Compose runs HarvestView and the API rather than the normal interactive command line. Runs retain evidence locally and support exports for review and automation.
Passive discovery queries external providers, which still receive the target string. DNS operations and direct target interactions require explicit selection and authorization. Results distinguish successful, partial and failed collection, so missing findings should not automatically be interpreted as evidence of absence.
The quick start needs Python 3.14 and uv. A first run such as uv run theHarvester -d example.com -b crtsh,certspotter uses two passive sources that need no API key, and three discovery sources run at once by default.
Key capabilities
- Public-source discovery Collects domain and organization intelligence from public datasets and providers.
- Evidence retention Stores normalized findings locally with source outcomes, stop reasons and retained artifacts.
- Local review HarvestView supports run creation, history inspection, evidence review and scheduling.
- Automation and export Provides an authenticated REST API and exports evidence in JSONL with compatibility reports.
- Hostname comparison Compares finalized, comparable runs and marks differences affected by incomplete sources as uncertain.
- Optional active checks Supports explicitly selected DNS operations, screenshots, takeover checks and API-path scanning.
Where theHarvester fits
theHarvester fits the initial reconnaissance stage of an authorized security assessment, where analysts gather public evidence before choosing any additional network activity. Its command line supports shell workflows, while HarvestView and the REST API support local review, repeated collection and integration with other processes.
Before deployment, operators should verify the authorized targets and activities, provider credential requirements, quotas and local runtime dependencies. HarvestView should remain on loopback unless TLS and network access controls are added. Scheduled work also needs review when authorization ends: pausing a schedule does not cancel runs already queued or running.
Reviews of theHarvester
Be the first to share your experience with theHarvester.
Write a review
Loading review form…
Alternatives to theHarvester
God's Eye ViewGod's Eye View combines public aircraft, satellite, earthquake and camera feeds in a Cesium globe. Run it locally, inspect each data source, add optional voice control and connect agents through MCP.SSherlockSherlock searches social networks for accounts matching supplied usernames. It runs from the command line, supports local installation or Docker, and exports findings for further review.