19.3 theHarvester and Recon-ng (Overview)

By Ravindra Bagale Last updated: 27 September 2026

Aata don OSINT (open-source intelligence) tools baghuya. Doghanche kaam ekach – ek domain dila ki tyachyashi sambandhit emails, subdomains, hosts aani IPs gola karne. Farak asa ki theHarvester ek quick command aahe, aani Recon-ng ek framework aahe jyat modules aani database astat.

theHarvester collects names, emails, subdomains and IPs from many sources (search engines, certificate logs, DNS). Most sources are on the internet, so on a real target it is passive recon; its DNS brute-force option is active because it sends queries to the target's name server.

theHarvester -h                               # ALWAYS read this first – flags change between versions
theHarvester -d example.com -l 100 -b <source>  # typical shape: domain, result limit, data source

Option (check `-h`)	Typical meaning
`-d`	Domain to search
`-b`	Data source(s) to query
`-l`	Limit the number of results
`-c`	DNS brute force on the domain (active)
`-e`	Use a specific DNS server
`-f`	Save results to a file

Flags change between versions

theHarvester is updated often. Options get renamed, some sources are added or removed, and several need API keys. Before any lab, run theHarvester -h on your Kali and use the options it shows – do not copy commands blindly from old blogs, videos or even this book.

Recon-ng looks and feels like Metasploit: you create a workspace, install modules from its marketplace, set options and run. Results are stored in a database (hosts, contacts, domains), so one module's output feeds the next.

recon-ng
[recon-ng][default] > workspaces create lab
[recon-ng][lab] > options set NAMESERVER 192.168.56.20      # use the lab DNS server
[recon-ng][lab] > marketplace search brute
[recon-ng][lab] > marketplace install recon/domains-hosts/brute_hosts
[recon-ng][lab] > modules load recon/domains-hosts/brute_hosts
[recon-ng][lab][brute_hosts] > options set SOURCE lab.local
[recon-ng][lab][brute_hosts] > run
[recon-ng][lab][brute_hosts] > show hosts

Module names and marketplace contents can also change – use marketplace search and modules search to find the current names, and info inside a module to see its options.

Ravindra Bagale's Tip

Copying a theHarvester command from YouTube and getting an "unrecognized arguments" error happens in every batch. The reason is that the flags change between versions. First theHarvester -h, then the command. In Recon-ng too, many students forget to create a workspace and all the data gets mixed into default – use a separate workspace for each target.

Ravindra Bagale's Tip – मराठी

theHarvester ची command YouTube वरून copy केली आणि "unrecognized arguments" error आला – हे प्रत्येक batch मध्ये होतं. कारण flags version प्रमाणे बदलतात. पहिलं theHarvester -h, मग command. Recon-ng मध्ये पण बरेच students workspace बनवायला विसरतात आणि सगळा data default मध्ये mix होतो – प्रत्येक target साठी वेगळा workspace.

Ravindra Bagale's Tip – हिंदी

theHarvester का command YouTube से copy किया और "unrecognized arguments" error आया – यह हर batch में होता है. वजह यह है कि flags version के हिसाब से बदलते हैं. पहले theHarvester -h, फिर command. Recon-ng में भी बहुत से students workspace बनाना भूल जाते हैं और सारा data default में mix हो जाता है – हर target के लिए अलग workspace.

Lab

Run theHarvester -h on Kali and write down the current options for domain, source, DNS brute force and DNS server. Using those options, brute-force lab.local only against the lab DNS server 192.168.56.20 and compare the hosts found with your AXFR list from 19.2. Then repeat the job in Recon-ng using the brute_hosts module with NAMESERVER set to 192.168.56.20, and run show hosts. If you locked AXFR in 19.2, notice that brute forcing still finds common names like www, mail, vpn – that is why defenders also watch for NXDOMAIN bursts.