The section your link pointed to isn't on theharvester's page any more, so we've brought you to the top.
theHarvester gathers open-source intelligenceopen-source intelligenceOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. about a domain or organization from search engines, certificate transparency logs, DNS datasets, and other public sources.
theHarvester -d example.com -b sherlockeye uv run theHarvester -d example.com -b sherlockeye theHarvester -d example.com -b mojeek theHarvester -d example.com -b shodaninternetdb theHarvester -d example.com -b thc # In api-keys.yml: hackertarget: key: YOUR_API_KEY_HERE # Then run: theHarvester -d example.com -b hackertarget theHarvester -d <target-domain> -b venacus pipx install theharvester theHarvester -d example.com -b fullhunt theHarvester -d example.com -b n45ht theHarvester -d example.com -b censys --censys-limit 100 restfulHarvest
theHarvester is an open-source reconnaissance tool that gathers open-source intelligence about a domain or organization from search engines, certificate transparency logs, DNS datasets, code repositories, and threat-intelligence platforms, pulling together hostnames, email addresses, IP addresses, ASNs, people, and breach names into one normalized run. It is run as a command-line tool, with an optional local browser workflow for reviewing results, and results can be exported as JSON, JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory., XML, or SQLite for further analysis. It's built for practitioners doing the early passive-recon stage of an authorized security assessment, such as penetration testers and red teamers, rather than for ongoing monitoring. It sits in the OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. and passive-recon category, aggregating sources that teams would otherwise query separately. Started in 2011, it remains active, with 140 contributors, nearly 300 commits in the past year, and a release 79 days ago.
theHarvester gathers open-source intelligence about a domain or organization from search engines, certificate transparency logs, DNS datasets, and other public sources.
queries search engines, certificate transparency logs, DNS datasets, and code repositories in one run and normalizes the results into a single set of hostnames and addresses, with provenance for where each came from
pulls IP and ASN data from DNS and passive sources and reports them alongside the hostnames they resolve from, without touching the target directly
checks breach and credential-intelligence sources such as Dehashed and Hudson Rock and lists breach names tied to the domain or its email addresses
runs an optional takeover check against the enumerated subdomain list and flags the ones pointing at unclaimed or dangling services
enriches discovered IPs against Shodan InternetDB and reports open ports and vulnerability data for each one
records the original command-line arguments inside the exported report, and can write structured output to JSONL or SQLite so the evidence and its source provenance survive for later analysis
No command matches.
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Nine scores for theharvester, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
See how much detail theharvester puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
20 entries
No entries match these filters.
Issue, contributor and maintainer activity in laramies/theHarvester, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
starlette 0.50.0 in its imagehigh on CISA's exploited list
theharvester 4.11.1 builds its image from uv.lock, which locks starlette 0.50.0. That version has GHSA-86qp-5c8j-p5mr and 2 other high or critical flaws.
Fixed in starlette 1.3.1. No theharvester release includes it yet; its main branch already has it.
GHSA-86qp-5c8j-p5mr advisory Checked Nov 3 against theharvester 4.11.1
anyio 4.12.1 in its imagecritical
theharvester 4.11.1 builds its image from uv.lock, which locks anyio 4.12.1. That version has GHSA-82r6-8w77-94w6.
Fixed in anyio 4.14.2. No theharvester release includes it yet; its main branch already has it.
GHSA-82r6-8w77-94w6 advisory Checked Nov 3 against theharvester 4.11.1
certifi 2026.5.20 in its imagecritical
theharvester 4.11.1 builds its image from uv.lock, which locks certifi 2026.5.20. That version has GHSA-6q48-6c7w-9gw2.
Fixed in certifi 2026.10.18. No theharvester release includes it yet.
GHSA-6q48-6c7w-9gw2 advisory Checked Nov 3 against theharvester 4.11.1
aiohttp 3.14.0 in its imagehigh
theharvester 4.11.1 builds its image from uv.lock, which locks aiohttp 3.14.0. That version has GHSA-2g87-pp6c-29x5 and 3 other high or critical flaws.
Fixed in aiohttp 3.14.4. No theharvester release includes it yet; its main branch already has it.
GHSA-2g87-pp6c-29x5 advisory Checked Nov 3 against theharvester 4.11.1
dnspython 2.8.0 in its imagehigh
theharvester 4.11.1 builds its image from uv.lock, which locks dnspython 2.8.0. That version has GHSA-45c3-73f7-pv4m.
Fixed in dnspython 2.9.0. No theharvester release includes it yet.
GHSA-45c3-73f7-pv4m advisory Checked Nov 3 against theharvester 4.11.1
soupsieve 2.8.1 in its imagehigh
theharvester 4.11.1 builds its image from uv.lock, which locks soupsieve 2.8.1. That version has GHSA-2wc2-fm75-p42x and 1 other high or critical flaw.
Fixed in soupsieve 2.8.4. No theharvester release includes it yet; its main branch already has it.
GHSA-2wc2-fm75-p42x advisory Checked Nov 3 against theharvester 4.11.1
urllib3 2.7.0 in its imagehigh
theharvester 4.11.1 builds its image from uv.lock, which locks urllib3 2.7.0. That version has GHSA-8988-9cw3-xx77 and 1 other high or critical flaw.
Fixed in urllib3 2.8.0. No theharvester release includes it yet.
GHSA-8988-9cw3-xx77 advisory Checked Nov 3 against theharvester 4.11.1
We check the lockfiles its release builds images from: 1 Python. Go modules, other lockfiles and vendored code aren't checked.
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →