theHarvester
OSINT: emails, subdomains and hosts of an organisation from public sources.
Public information gatherer for a domain. It queries search engines, certificate transparency, passive DNS and breach databases to pull emails, employee names, subdomains and IPs without touching the client infrastructure. In a real engagement it is the first step: the emails it returns are the raw material for the user list you later feed into a password spray.
Family Recon, DNS & OSINT
Flags -d -b -l -f
Concepts Credential Hunting, Username enumeration
Cheatsheet DNS · 53
Installation
sudo apt install -y theharvesterUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.