Gather emails, names and subdomains from public sources
Python OSINT tool that collects emails, names, subdomains, IPs and URLs about a domain from search engines and public data sources.
theHarvester queries a range of public sources (search engines, certificate transparency, DNS datasets and APIs) to build a picture of an organisation's external footprint early in an assessment. Some sources require API keys.
It is included in common security distributions and is typically used in the reconnaissance phase of authorised penetration tests and red team exercises.
GPL-2.0-only · GNU GPL v2 · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: GPL-2.0.
No published advisory found for theHarvester in GitHub repository advisories. That does not mean the tool has no vulnerabilities.
Sources: GitHub repository advisories · checked 2026-10-20.
OSINT automation for footprinting
OSINT automation tool with a web UI and more than 200 modules that gather data on IPs, domains, emails, names and more from public sources.
Attack surface mapping and asset discovery
OWASP project for in-depth attack surface mapping: discovers domains, subdomains, IP ranges and related assets using DNS and many public data sources.
Fast passive subdomain enumeration
ProjectDiscovery's subdomain discovery tool that queries passive online sources, built for speed and easy chaining with other tools.
Asynchronous TCP port scanner for large ranges
Internet-scale port scanner that sends SYN packets asynchronously with its own TCP/IP stack, designed to scan very large address ranges quickly.
Fast web fuzzer for content and parameter discovery
Fast web fuzzer written in Go, used to discover hidden files, directories, virtual hosts and parameters by replacing a FUZZ keyword with wordlist entries.
