19.3 theHarvester and Recon-ng (Overview)

By Ravindra Bagale Last updated: 27 September 2026

Aata don OSINT (open-source intelligence) tools baghuya. Doghanche kaam ekach – ek domain dila ki tyachyashi sambandhit emails, subdomains, hosts aani IPs gola karne. Farak asa ki theHarvester ek quick command aahe, aani Recon-ng ek framework aahe jyat modules aani database astat.

theHarvester collects names, emails, subdomains and IPs from many sources (search engines, certificate logs, DNS). Most sources are on the internet, so on a real target it is passive recon; its DNS brute-force option is active because it sends queries to the target's name server.

theHarvester -h                               # ALWAYS read this first – flags change between versions
theHarvester -d example.com -l 100 -b <source>  # typical shape: domain, result limit, data source

Option (check `-h`)	Typical meaning
`-d`	Domain to search
`-b`	Data source(s) to query
`-l`	Limit the number of results
`-c`	DNS brute force on the domain (active)
`-e`	Use a specific DNS server
`-f`	Save results to a file

Flags change between versions

theHarvester is updated often. Options get renamed, some sources are added or removed, and several need API keys. Before any lab, run theHarvester -h on your Kali and use the options it shows – do not copy commands blindly from old blogs, videos or even this book.

Recon-ng looks and feels like Metasploit: you create a workspace, install modules from its marketplace, set options and run. Results are stored in a database (hosts, contacts, domains), so one module's output feeds the next.

recon-ng
[recon-ng][default] > workspaces create lab
[recon-ng][lab] > options set NAMESERVER 192.168.56.20      # use the lab DNS server
[recon-ng][lab] > marketplace search brute
[recon-ng][lab] > marketplace install recon/domains-hosts/brute_hosts
[recon-ng][lab] > modules load recon/domains-hosts/brute_hosts
[recon-ng][lab][brute_hosts] > options set SOURCE lab.local
[recon-ng][lab][brute_hosts] > run
[recon-ng][lab][brute_hosts] > show hosts

Module names and marketplace contents can also change – use marketplace search and modules search to find the current names, and info inside a module to see its options.

Ravindra Bagale's Tip

theHarvester chi command YouTube varun copy keli aani "unrecognized arguments" error aala – he pratyek batch madhe hota. Karan flags version pramane badaltat. Pahila theHarvester -h, mag command. Recon-ng madhe pan khup students workspace banvayla visartat aani sagla data default madhe mix hoto – pratyek target sathi vegla workspace.

Lab

Run theHarvester -h on Kali and write down the current options for domain, source, DNS brute force and DNS server. Using those options, brute-force lab.local only against the lab DNS server 192.168.56.20 and compare the hosts found with your AXFR list from 19.2. Then repeat the job in Recon-ng using the brute_hosts module with NAMESERVER set to 192.168.56.20, and run show hosts. If you locked AXFR in 19.2, notice that brute forcing still finds common names like www, mail, vpn – that is why defenders also watch for NXDOMAIN bursts.