Email Harvesting

MITRE ATT&CK™ Account Discovery - Technique T1087

Theory

We may attempt to obtain a list of email addresses and accounts from a domain or website. This is part of passive reconnaissance. It can provide us with useful information and help us gain initial access.

Practice

Bash

We can recursively crawl a website and pipe it over a regex to extract emails.

# Recursively get emails on a website with wget
wget -r -O crawl.txt https://target.url
grep -haio "\b[a-z0-9.-]\+@[a-z0-9.-]\+\.[a-z]\{2,4\}\+\b" crawl.txt

# Get emails one a specific page with curl
curl -kfsSL https://target.url | grep -hio "\b[a-z0-9.-]\+@[a-z0-9.-]\+\.[a-z]\{2,4\}\+\b"

theHarvester

Whois