TheHarvester: Emails, subdomains and names harvester for OSINT

github.com

90 points·axiomdata316··10 comments

I've used TH on many engagements as a starting point for osint. great tool that does a pretty decent job of collecting initial info.

Can some of these tools and methods be considered unauthorized access to servers? For instance, subdomain enumeration can often accessing an URL that isn’t meant to be accessed by the public and isn’t linked anywhere.

I wonder how this is affected by the last ruling,

“US Supreme Court Restricts Scope of Computer Fraud and Abuse Act [pdf]” - https://news.ycombinator.com/item?id=27382752 - from a couple days ago.

If they don’t block access to the service, what rights do you have to read headers sent from the server?

If I enumerate your sub domains using Google or Cloudflare’s public dns servers, what unauthorised access took place? I don’t need to make an http(s) request to find out if a sub domain exists (except perhaps when you’re using wildcard sub domains).

A related tool: https://github.com/OWASP/Amass

I just gave it a try and it did not work very well. I'm sure it could be useful for some cases, but it does far worse than a human can do scraping search engines.

Check out recon-ng

Did you try all the different sources (-b option)? The results can vary dramatically. Also, some of the sources require you to provide API credentials, but run without warning (and without results) if you don't.

assetfinder from Tomnomnom is a great tool for sub-domain enumeration:

https://github.com/tomnomnom/assetfinder

There's also Spiderfoot, which does quite a good job.

Reply on news.ycombinator.com