Information Gathering Using TheHarvester

Objective

Learn how to use TheHarvester, an open-source intelligence-gathering tool, to collect information about a target domain. This lab demonstrates how attackers gather email addresses, subdomains, IPs, and other data to prepare for further exploitation.

Prerequisites

1. Kali Linux or Any Linux Distro with TheHarvester Installed:
   • Verify if TheHarvester is installed:

     theharvester -h
     

   • Install it if necessary:

     sudo apt update && sudo apt install theharvester
     

2. Target Domain:
   • Select a domain you own or have explicit permission to test.
3. Basic Understanding of OSINT (Open-Source Intelligence):
   • Familiarity with how data can be collected from public sources like search engines and social networks.

Step 1: Understanding TheHarvester

1. TheHarvester gathers data from multiple public sources such as:
   • Search engines: Google, Bing.
   • Social networks: LinkedIn, Twitter.
   • DNS databases.
   • Other APIs (e.g., Shodan, Hunter.io).
2. Tip: Explore the tool’s capabilities by reviewing its help menu:

   theharvester -h
   

Step 2: Basic Usage

1. Run TheHarvester to collect basic information about a domain:

   theharvester -d <target_domain> -b <source>
   

   • Replace <target_domain> with your target domain (e.g., example.com).
   • Replace <source> with a data source (e.g., google, bing, linkedin).

   Example:

   theharvester -d example.com -b google
   

2. Review the output:
   • Emails: Lists any email addresses discovered.
   • Subdomains: Identifies associated subdomains.
   • IP Addresses: Maps IPs linked to the target domain.

   Insight: This data helps attackers build a reconnaissance map.

Step 3: Searching Multiple Sources

1. Use all as the source to query multiple data providers:

   theharvester -d <target_domain> -b all
   

2. Note that this may take longer as TheHarvester queries all supported sources.
3. Tip: Cross-reference data from multiple sources for accuracy and completeness.

Step 4: Exporting Results

1. Save the output to a file for future analysis:

   theharvester -d <target_domain> -b <source> -f <output_file>
   

   • Replace <output_file> with the desired file name (e.g., results.txt).

   Example:

   theharvester -d example.com -b google -f example_results.txt
   

2. View the saved file:

   cat example_results.txt
   

Step 5: Advanced Options

1. Specifying Limit on Results:
   • Limit the number of results from a source:

     theharvester -d <target_domain> -b google -l 100
     

   • -l: Sets the maximum number of results (e.g., 100).
2. Including Virtual Hosts:
   • Discover virtual hosts associated with the domain:

     theharvester -d <target_domain> -b bing -v
     

   • -v: Enables virtual host detection.
3. Using Shodan API:
   • Query Shodan for additional data (requires API key):

     theharvester -d <target_domain> -b shodan
     

   • Tip: Add your Shodan API key to TheHarvester’s configuration file.
4. Finding LinkedIn Data:
   • Gather information from LinkedIn profiles:

     theharvester -d <target_domain> -b linkedin
     

Step 6: Interpreting Results

1. Analyze the collected data for:
   • Email Patterns: Identifying naming conventions (e.g., first.last@example.com).
   • Subdomains: Revealing potential entry points.
   • IP Addresses: Mapping the organization’s network footprint.
2. Cross-check findings with other tools like Nmap or Recon-ng for further verification.

Step 7: Mitigation Techniques

1. Reduce Public Exposure:
   • Minimize the amount of sensitive information available online.
2. Secure Email Addresses:
   • Use generic emails for public-facing contacts (e.g., info@example.com).
3. Monitor Public Data:
   • Regularly audit what information about your organization is publicly accessible.
4. Use WHOIS Privacy:
   • Protect domain registration data with WHOIS privacy services.

Additional Tips and Insights

1. Legal Considerations:
   • Use TheHarvester only on domains you own or have explicit permission to test.
2. Combining Tools:
   • Integrate TheHarvester results with other OSINT tools (e.g., Maltego, Recon-ng) for comprehensive analysis.
3. Practice Regularly:
   • Experiment with different sources and configurations to master TheHarvester’s functionality.
4. Explore Custom API Integrations:
   • Enhance your results by configuring APIs like Bing, Hunter.io, or VirusTotal in TheHarvester.

Key Takeaways

1. TheHarvester is a powerful OSINT tool for gathering emails, subdomains, IPs, and other data from public sources.
2. Effective use of TheHarvester can reveal valuable information about a target domain during the reconnaissance phase.
3. Reducing public exposure and monitoring online information are critical steps for mitigating risks from OSINT techniques.