Now that we know how to use the harvester to collect technical information,
let me show you how to use this tool to find information
about the people that work in this company.
As you may have noted, when you're running the technical searches,
the harvester already found some email addresses for us.
So let's run the same search again.
I'll use the harvester with the globomantics.com domain,
I'll limit to 500 search results, and the same data serves up as before,
which is Google, Yahoo, Bing, and DuckDuckGo.
Oh, no.
Take a look.
Because I've been doing too many searches, my IP got blocked by Google.
And this is something very normal when using their harvester,
so that's why I recommended using a VPN.
In here, I'm already tunneling my trafficked through Thailand.
Take a look.
If I check what my IP address is, it shows me that I'm located in Bangkok.
So let me pause this here and quickly change my VPN location.
Done.
If I refresh this page,
you can see that now my IP address is in the city of Riga in Latvia,
and hopefully Google has not blocked this IP yet.
So let me go back to the terminal, and then here,
let's run the exact same command.
Awesome.
Take a look.
Now it works.
With the new IP address from Latvia, I can now use the harvester again,
and that's why I recommend only searching for what you need.
Don't do massive searches otherwise your IP get blocked.
And as you can see, the harvester found some email addresses in here,
like alice@globomantics.com.
And those email addresses can be interesting for social engineering attacks,
so it is important taking note of them.
Another thing you can do is search for LinkedIn profiles,
but as Globomantics is a fake company,
I will search for people that works at Pluralsight using the harvester tool.
For that, I used this comment, python3, theHarvester.py,
and then the Pluralsight domain.
And after that, I'll use the flag ‑b,
and it specified the linkedin as data source.
When I this, theHarvester,
we only search on LinkedIn for people that worked at Pluralsight.
And again, this may take a little while, so let's speed up the video.
Done.
As we can see, we found tons of people that are working the company.
Pretty cool, right?
Again,
it is not illegal to strike this information since it's
publicly available on the LinkedIn.
The only difference is that we are automating the search using the harvester.
And I could even run the same command, but changing linkedin to twitter.
But as we can see, we couldn't find any Twitter accounts related to this domain.
Anyways, that's pretty cool, right?
We're able to find email addresses and LinkedIn profiles,
which could help us a lot to perform a social engineering attack.
And trust me, this is really useful when you're ______ engagement.
And the last thing I want to show you is the amount of
information we can get with the harvester.
If you run the harvester against the domain,
but not with the flag ‑b and the word all,
the harvester was searching all the data sources
for information about the domain.
And here, I'm using the nasa.org again since this is not an invasive search,
and we are only searching for publicly available information.
When we run this, it will take it up to half a hour to complete.
And although this kind of search brings a lot of information,
I personally don't like to run the full searches like this for two reasons.
First, as you can see here, our IP address gets quickly banned by Google.
And now, because we're in the middle of a search,
we cannot change our VPN servers,
so our results may not be that complete as we were doing single searches.
Also,
the second reason that I personally don't like to run this kind of full
search is that we see a lot of for useless information.
So, personally, I like to search for useful information first.
And then if we don't find anything interesting for me,
then I go for broader searches, like this one.
So, as usual, let me speed up this video,
and keep in mind that this search took about 23 minutes to complete.
Done.
As you can see, we have a lot of information.
But again, most of that information is useless and may slow down your process.
So again,
my recommendation is to first do specific searches like we've done our demos.
And then if we don't find anything interesting,
you can do a broad search like this one.