# Theharvester

> Use for passive OSINT collection during authorized pentests. Trigger on email, domain, subdomain, and public-source metadata gathering to seed recon without active target interaction.

- Skill: `timsonner/theharvester` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/theharvester`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/theharvester/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/theharvester

---


# theHarvester

## Purpose

Use this skill for passive OSINT gathering when the engagement needs external intelligence with minimal direct interaction.

## Phase Fit

- Primary: Discovery and Reconnaissance
- Secondary: Threat Modeling and Test Planning

## Use When

- Need passive discovery of emails, hosts, or public-source metadata.
- Need recon seeds for later validation.
- Need low-impact external inventory enrichment.

## Avoid When

- Public-source collection would exceed the agreed privacy or scope boundary.
- Results would be treated as confirmed inventory without validation.

## Inputs

- Approved domain or brand scope
- Source selection and output requirements
- Validation threshold for later phases

## Procedure

1. Start with passive public sources only.
2. Separate raw OSINT leads from confirmed assets.
3. Use the results to guide DNS, web, or identity validation.
4. Record source provenance for reporting.
5. Preserve the exact source set for future comparison.

## Command Syntax

Replace sample domains with approved in-scope targets.

```bash
# Collect from all configured passive sources
theHarvester -d contoso.com -b all -l 500

# Collect from Google
theHarvester -d contoso.com -b google -l 300

# Collect from Bing
theHarvester -d contoso.com -b bing -l 300

# Collect emails, hosts, and IPs, output to HTML and XML
theHarvester -d contoso.com -b all -l 500 -f contoso-harvest

# Use Shodan for IP enrichment
theHarvester -d contoso.com -b shodan -l 100
```

## Evidence to Capture

- Public-source leads relevant to the approved target
- Exact source set and domain used
- What still requires validation before later testing

## Safety Boundaries

- Keep collection passive and within approved brand or domain scope.
- Treat all output as unverified until corroborated.