Right now, we are going to see how we can gather emails for a certain company or a domain.
Remember, people are always we get security.
If we manage to send some malicious program to someone working in a company and they run the program,
we got our way in.
We can also use emails in something like a brute force attack.
We can use them in the username fields.
There are many ways this could be useful, but for now, let's just see how we can get them.
Since emails are public information, we can test this on any domain.
We want to get emails.
We're going to check out two different options, a tool called the Harvester that's installed in clinics
and a website called Hunter Dot Io.
Let's start with Harvester first.
So open up your terminal and to just run the whole menu from the harvester, we can type the tool name.
So just type the harvester with Capital H and press enter and this will output us with a smaller help
menu, just like the what we did once we specified its name, we get its banner and some of the options
that we can run.
He tells us since we tried to run it with just the name of the program, that there is an error, the
following arguments are required.
So we need to specify the domain.
But before we specify the domain, let us just run the bigger health menu so we can see all of our available
options.
OK, great.
Here it is.
So we get the domain option.
So we need to specify either a company name or domain name to search.
This is the limit limit of search results, which is default equal to five hundred.
And all these other options are not really of interest to us besides this last source option and this
last source option would specify that would be.
And we specify where we want to search for emails now.
We can need to specify one of these if we can, for example, specify we want to search for Twitter,
LinkedIn, Bing, Google, or we can simply just specify all.
And it will go through all of these in search for usernames, posts and emails.
So let's try it out.
If I clear the screen, type the harvester.
And first thing we need to specify is Dashty for the domain and for this test, I will go with this
domain right here, which is another university domain.
You can go either with this one or you can pick any website that you want and use it instead.
So if you specify the Harvester Dashty, then the domain name.
The next option that I want to specify is Dasch B and remember that B option is the source.
So where we want to search for the emails, host names and user names and letters for the first try,
specify all.
And the last option is Dash L, which is the limit that is set by default to be five hundred, so we
can either specify more than that or less than that, or we can simply just not specify dash at all.
And it will just by default scan five hundred results.
So if we leave it just like this and I press here, enter the running of this command will take some
time, it will search for different results.
It will search for hostname, it will search for usernames, and it will also search for emails.
As we can see down here, it says searching three hundred results and this will go up to five hundred
since we are using the default option, which is five hundred results.
And it seems that we already got some users found.
Here are some of the names as well as what do they do.
So this is already some result for us.
Let's just wait for all of this to finish and then we will go through all of the results that we managed
to get.
OK, so it is finished, let us check out what we got as an output so it search through a bunch of different
platforms, as we can see, LinkedIn virus, total Yahoo!
Twitter, but it didn't manage to find any results for these platforms.
The only thing we got is these users right here.
But this is not what we looked for.
We wanted to find some email addresses or perhaps some usernames, there is one thing with this harvester
took from my personal experience, this tool doesn't always work.
There are days when it gives amazing result, but there are days when it doesn't find any emails or
any hosts, just like it did in this case, as it says, failed to detect a valid IP address from this
domain name.
We also didn't get any emails, and I'm talking about scanning this same domain just on two different
days.
That's why it is always good to, in case you don't get any results for this tool right now to scan
it multiple times.
So if we scan it once again and instead of Desh be all, I will select Begbie and scan only from Google
to see if I get any different results.
And if we still don't manage to get any results, just try the same command either later or tomorrow.
And I guarantee you it will usually give you a different result.
As we can see, we didn't manage to find anything with this, so that's why we got a second option.
And that second option is a website Hunter Dot Io.
So let's go and visit that website.
Open up your Firefox.
And in the search bar up here, type Hunter Dot Io, it will automatically lead you to this website
and we can see right here we got this search bar where we specify our company domain and we click on
find email addresses.
But on this website, you must first create an account and you either have a free account or a paid
account.
Technically, you can even search without creating an account, but it will only show you first five
results and there will be half blurred.
Let me show you, if I go here and type the same domain name that we used for Harvester.
And let me just enlarge this a little bit so you can see in greater detail and I click on find email
addresses.
It will show me first five results and they will all be blurred.
Now you can technically try to figure out what these email addresses are, but they will be blurred
nonetheless.
And down here, it also tells you how much results it manage together.
It managed together.
Three hundred and fifteen more results besides these five emails.
And those results will be available if you get a paid account with free account.
However, let me show you how free account looks like if I go in signing.
And I sign into my account for you, just go and create an account right here and sign it into your
free account.
Once you create an account, you should be able to have about 50 searches per month with the free account,
as it says right here.
So we got zero out of 50 and these monthly requests we set in about one month.
And as I mentioned, even with free account, you also don't get all the results outputted.
But at least the emails that it gives you are not blurred.
Let's test it out.
If I type the domain name that we used this entire video and click on Search.
Right now, I managed to get some of the results right here.
So I get up to 10 results with its email addresses and their names, so we got the name and we also
got the email addresses we get right here, which pattern it used to find email addresses.
And all of these email addresses are also split into different sections.
So if you click on it, the engineering.
I will even get what type of work does this person do?
Project adviser, I.T. engineering, production, engineering technical editor, as well as their email
addresses.
We also get from which sources we manage to get these emails.
And if I go to all right here and I remove this I.T. engineering down here, we will also get that there
are three hundred and ten more results for this domain name.
So it is completely up to you whether you think you should get paid version for this, just keep in
mind that with the paid version, you get much more results than with the free version.
The bad side about the paid version is that it isn't cheap at all.
If I go to my account up here and I click on subscription.
I can see down here which plan choices I have available to purchase, and you can see a thousand requests
per month will be around 50 euros per month.
So this is completely up to you, but nonetheless, what we did learn in this video is different ways
to gather emails about a certain domain.
And I encourage you to also later try out these harvestable once again, because it does no to give
really good results once it works.
And one more thing is that at the end of this section, I will give you a tool that is coding in Python
three that will be able to gather even more emails from a specified domain.
So it will be even better than these two options that they showed you right here.
And it will be our own tool.
I will give you its code and also show you how to run it and how it works.
OK, good.
In the next video, we're going to see how we can instill some additional tools that we might need for
information gathering there.