# theHarvester (otlite)

Find emails, subdomains and names for a domain

- Takes: Domain
- Install: `otlite install theharvester`, into its own virtualenv
- Pinned: [github.com/laramies/theHarvester at fd832de](https://github.com/laramies/theHarvester/tree/fd832dee7936458a4f6e2029bf37ba6797228676)
- Command: `theHarvester`
- Python: 3.12 or newer
- Verified: 22 Sept 2026, version 4.11.1 on Ubuntu 26.04 LTS via WSL2, Python 3.12.14
- Licence: GPL-2.0
- Source: https://github.com/laramies/theHarvester

otlite is the no-Docker edition of OTInstaller for Linux and macOS: [install it](https://otinstaller.com/otlite) with `curl -fsSL https://get.otinstaller.com/otlite | sh`.

## Run it

| Input | otlite command | theHarvester receives |
| --- | --- | --- |
| Domain | `otlite run theharvester -- d:example.com` | `theHarvester --domain example.com` |

Arguments after `--` that aren't typed inputs go to the tool unchanged.

## Before you run it

- **Needs Python 3.12 or newer.** Its current release, 4.11.1, requires it. otlite checks your Python before installing and says which version to use; `otlite doctor` lists the tools your Python can't run.

## API keys

- `SHODAN_API_KEY` (optional): `otlite keys set SHODAN_API_KEY`
- `HUNTER_API_KEY` (optional): `otlite keys set HUNTER_API_KEY`

Keys live in `~/.otlite/.env`, readable only by you, and each tool receives only the keys it declares.

## What a run leaves

- `results/theharvester/example.com/<time>_theharvester_example.com_<run id>.txt`
- `results/theharvester/example.com/<time>_theharvester_example.com_<run id>.meta.json`
- `results/theharvester/example.com/<time>_theharvester_example.com_<run id>.envelope.json`

The envelope is the same shape for every tool: the tool and version, the input, timing, exit code and status, the emails, domains, IP addresses and URLs found in the output, and the output file's path, hash and size. `otlite results --tool theharvester` lists saved runs, `otlite extract theharvester` pulls out indicators and `otlite diff theharvester example.com` compares the two latest runs.

## With other tools

`otlite run --all d:example.com` and `otlite auto example.com` run it with every other installed tool that takes the same input.

## Related tools

- [Spiderfoot](https://otinstaller.com/otlite/tools/spiderfoot.md): SpiderFoot automates OSINT for threat intelligence and mapping your attack surface
- [Bbot](https://otinstaller.com/otlite/tools/bbot.md): The recursive internet scanner for hackers
- [Sublist3r](https://otinstaller.com/otlite/tools/sublist3r.md): Fast subdomain enumeration tool using multiple search engines and certificate transparency logs
- [Dnstwist](https://otinstaller.com/otlite/tools/dnstwist.md): Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation
- [Torbot](https://otinstaller.com/otlite/tools/torbot.md): Dark Web OSINT Tool
- [Ivre](https://otinstaller.com/otlite/tools/ivre.md): Network recon framework

[All 47 otlite tools](https://otinstaller.com/otlite/tools) · [otlite docs](https://otinstaller.com/docs/otlite.md)