CEH Footprinting, Reconnaissance and Scanning Practice Question
A penetration tester is performing reconnaissance and wants to identify email addresses associated with a target domain. Which tool is specifically designed for this purpose?
⚠ Common exam trap
Watch out — candidates often confuse Shodan (a device search engine) with a tool for email harvesting, or they assume Maltego's broad OSINT capabilities make it the best choice, but theHarvester is the only option specifically designed for automated email address extraction from public sources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
theHarvester
TheHarvester is specifically designed for passive reconnaissance to gather email addresses, subdomains, and other open-source intelligence (OSINT) from public sources like search engines, PGP key servers, and the SHODAN database. It directly queries these sources to extract email addresses associated with a target domain, making it the correct tool for this task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Nmap
Why it's wrong here
Nmap (Network Mapper) is fundamentally a network exploration and security auditing tool designed for host discovery, port scanning, and operating system detection. It operates by sending raw IP packets to target hosts and analyzing their responses to map network topology and identify running services. While crucial for understanding network infrastructure, Nmap does not possess the capability to actively search for or extract email addresses from public web pages or databases, making it unsuitable for email harvesting.
- ✓
theHarvester
Why this is correct
theHarvester is an open-source intelligence (OSINT) tool specifically engineered for gathering publicly available information, including email addresses, subdomains, hostnames, and employee names. It achieves this by querying various public data sources such as search engines (e.g., Google, Bing), PGP key servers, and social media platforms like LinkedIn. This targeted approach makes theHarvester highly effective during the reconnaissance phase for compiling lists of potential email targets from publicly accessible information.
- ✗
Shodan
Why it's wrong here
Shodan functions as a specialized search engine that indexes banners from internet-connected devices and services, providing insights into open ports, service versions, and geographic locations. Its primary utility lies in discovering exposed industrial control systems, webcams, or databases by analyzing metadata from network services. However, Shodan is not designed to actively crawl websites or public records to extract email addresses, thus it cannot fulfill the objective of email harvesting.
- ✗
Maltego
Why it's wrong here
Maltego is a powerful graphical link analysis tool primarily used for visualizing relationships between various entities, such as individuals, organizations, domains, and IP addresses, through a process of data mining and correlation. While it can integrate with "transforms" to incorporate email address findings from other sources, its core strength is in mapping and visualizing complex connections rather than directly performing dedicated email harvesting from public sources. It serves as an analytical platform, not a primary email collection engine.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.