-: Right now we are going to see
how we can gather emails
for a certain company or a domain.
Remember, people are always weak at security.
If we managed to send
some malicious program
to someone working in a company,
and they run that program
we got our way in.
We can also use emails in something
like a brute force attack.
We can use them in the username fields.
There are many ways this could be useful,
but, for now let us just see how we can get them.
Since emails are public information,
we can test this on any domain we want.
To get emails, we are going to check out
two different options,
a tool called the Harvester,
that's installed in Kali Linux,
and a website called hunter.io.
Let's start with Harvester first.
So open up your terminal,
(computer mouse clicks)
and to just run the help menu from the Harvester,
we can type the tool name.
So just type the Harvester,
with capital H and press enter,
and this will output us
with a smaller help menu,
just like the whatweb tool did.
Once we specified its name,
we get its banner,
and some of the options that we can run.
It tells us since we try to run it
with just the name of the program,
that there is an error,
the following arguments are required.
So we need to specify the domain,
but before we specify the domain,
let us just run the bigger help manual,
so we can see all of our available options.
Okay, great.
Here it is.
So, we get the domain option.
So, we need to specify either a company name,
or domain name to search.
This is the limit,
limit of search results,
which is default equal to 500,
and all these other options are not
really of interest to us,
besides this last source option.
And this last source option,
we specify with dash B,
and we specify where we want to search for emails.
Now, we can need to specify one of these.
We can, for example, specify we want to search
for Twitter, LinkedIn, Bing, Google,
or we can simply just specify all
and it will go through
all of these,
in search for usernames, hosts and emails.
So let's try it out.
If I clear the screen,
type the Harvester,
and first thing we need to specify
is dash D for the domain,
and for this test,
I will go with this domain right here,
which is another university domain.
You can go either with this one,
or you can pick any website that you want,
and use it instead.
So, if I specified the Harvester dash D,
then the domain name,
the next option that I want to specify is dash B,
and remember dash B option is the source.
So where we want to search for the emails,
host names, and usernames,
and let us for the first try specify all,
and the last option is dash L,
which is the limit,
that is set by default, to be 500.
So we can either specify
more than that or less than that,
or we can simply just not specify dash L at all,
and it'll just, by default, scan 500 results.
So if we leave it just like this,
and I press, here, enter,
the running of this command will take some time.
It will search for different results,
it will search for host names,
it will search for user names,
and it'll also search for emails.
As we can see down here it says searching 300 results,
and this will go up to 500,
since we are using the default dash L option,
which is 500 results.
And it seems that we already got some users found.
Here are some of the names,
as well, as what do they do.
So this is already some result for us.
Let's just wait for all of this to finish,
and then we will go through all of the results
that we managed together.
Okay, so it is finished.
Let us check out what we got as an output.
So it searched through bunch of different platforms,
as we can see, LinkedIn, VirusTotal, Yahoo, Twitter,
but it didn't manage to find
any results for these platforms.
The only thing we got is these users right here,
but this is not what we looked for.
We wanted to find some email addresses,
or perhaps some usernames.
There is one thing with this Harvester tool.
From my personal experience,
this tool doesn't always work.
There are days when it gives amazing result,
but there are days when it doesn't find any emails,
or any hosts, just like you did in this case.
As it says, failed to detect a valid IP address
from this domain name.
We also didn't get any emails,
and I'm talking about scanning this same domain,
just on two different days.
That's why it is always good to,
in case you don't get any results,
for this tool, right now,
to scan it multiple times.
So, if I scan it once again,
and instead of dash B all,
I will select dash B,
and scan only from Google,
to see if I get any different results.
And if we still don't manage to get any results,
just try the same command either later or tomorrow,
and I guarantee you it will usually give you
a different result.
As we can see, we didn't manage to find anything
with this tool, that's why we got a second option.
And that second option, is a website hunter.io.
So let's go and visit that website.
Open up your Firefox,
(computer keyboard clicks)
and in the search bar, up here,
type hunter.io,
it'll automatically lead you to this website,
and we can see right here,
we got this search bar,
where we specify our company domain,
and we click on find email addresses.
But on this website,
you must first create an account,
and you either have a free account
or a paid account.
Technically you can even search
without creating an account,
but it will only show you first five results,
and they will be half blurred.
Let me show you.
If I go here,
and type the same domain name
that we used for Harvester,
and let me just enlarge this a little bit,
so you can see in greater detail.
And I click on find email addresses,
it will show me first five results,
and they will all be blurred.
Now you can technically,
try to figure out what these email addresses are,
but they will be blurred, nonetheless.
And down here, it also tells you
how much results it managed to gather.
It managed to gather 315 more results,
besides these five emails,
and those results will be available,
if you get a paid account.
With free account, however,
let me show you,
how free account looks like.
If I go and sign in,
and I sign into my account, for you,
just go and create an account right here,
and sign in, into your free account.
Once you create an account,
you should be able to have about
50 searches per month,
with the free account, as it says right here.
So we got zero out of 50,
and these monthly requests reset in about one month.
And as I mentioned, even with free account,
you also don't get all the results outputted,
but at least the emails that it gives you,
are not blurred.
Let's test it out.
If I type the domain name that we used
this entire video,
and click on search,
right now, I managed to get some of the results,
right here.
So I get up to 10 results
with its email addresses and with their names.
So we got the name and we also got the email addresses.
We get right here,
which pattern it used to find email addresses,
and all of these email addresses are also split
into different sections.
So if you click on IT/Engineering,
I will even get
what type of work does this person do,
Project Advisor, IT Engineering,
Production Engineering, Technical Editor,
as well, as their email addresses.
We also get from which sources
we managed to get these emails.
And if I go to all, right here,
and I remove this IT/Engineering,
down here we will also get
that there are 310 more results
for this domain name.
So, it is completely up to you,
whether you think you should get paid version for this.
Just keep in mind that with the paid version
you get much more results, than with the free version.
The bad side about the paid version
is that it isn't cheap at all.
If I go to my account up here,
and I click on subscription,
I can see down here which plan choices
I have available to purchase,
and you can see a thousand requests per month
will be around 50 euros per month.
So this is completely up to you,
but, nonetheless,
what we did learn in this video,
is different ways to gather emails
about a certain domain,
and I encourage you to also, later try out
this Harvester tool once again,
because it does know to give really good results,
once it works.
And one more thing,
is that at the end of this section
I will give you a tool
that is coded in Python 3
that will be able to gather even more emails
from a specified domain.
So, it will be even better
than these two options that I showed you right here,
and it will be our own tool.
I will give you its code,
and also show you how to run it,
and how it works.
Okay, good.
In the next video,
we're going to see
how we can install some additional tools
that we might need for information gathering.
See you there.