Quick start

These examples use the IANA-reserved example.com domain as inert test data. Replace it only with a target that is within your authorized scope.

Run a small passive query

From a source checkout:

uv run theHarvester -d example.com -b crtsh,certspotter

From Kali or another installed package, omit uv run:

theHarvester -d example.com -b crtsh,certspotter

This queries two passive certificate sources and prints consolidated findings. Passive does not mean private: the selected providers receive the target string.

Save a report

uv run theHarvester -d example.com -b crtsh,certspotter -f report

This writes report.json and report.xml in the current directory. JSON contains more result types and is the better automation format. See Results and Local Data.

Resolve discovered hosts

DNS resolution creates additional network activity. Use it only within scope:

AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh,certspotter -r

Pass a resolver IP, comma-separated resolver IPs, or a file containing one resolver IP per line:

AUTHORIZED_DOMAIN='replace-with-a-domain-you-control'
uv run theHarvester -d "$AUTHORIZED_DOMAIN" -b crtsh -r resolvers.txt

Choose sources deliberately

The README source matrix shows the result types and credential requirements for every current source.

Do not start with -b all. It contacts many independent services and can consume quotas. It also increases runtime and makes provider failures harder to isolate.

Choose a small group of sources that provides the result types you need.

Use theHarvester -h for the current option and source list.