CEH Footprinting, Reconnaissance and Scanning Practice Question
During a penetration test, you execute `theHarvester -d example.com -b google,linkedin`. What type of data is this tool primarily designed to collect?
⚠ Common exam trap
Many exam-takers confuse theHarvester's passive OSINT collection with active reconnaissance tools like `dnsrecon` (for zone transfers) or `nmap` (for vulnerability scanning), leading them to select options C or D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Email addresses, subdomains, and employee names from public sources
TheHarvester is an open-source intelligence (OSINT) tool designed to gather publicly available information from search engines, PGP key servers, and social platforms. The command `-d example.com -b google,linkedin` instructs it to scrape Google and LinkedIn for email addresses, subdomains, and employee names associated with the target domain, which are classic footprinting data used in reconnaissance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Password hashes and user credentials from compromised databases
Why it's wrong here
theHarvester is an Open Source Intelligence (OSINT) tool designed to gather publicly available information, not to access or extract data from compromised databases. It operates by querying public search engines, social media platforms, and specialized databases like Shodan, making it incapable of retrieving private password hashes or user credentials from internal or breached systems. Its scope is strictly limited to information that is intentionally or unintentionally exposed to the public internet.
- ✓
Email addresses, subdomains, and employee names from public sources
Why this is correct
theHarvester excels at collecting crucial Open Source Intelligence (OSINT) such as email addresses, subdomains, and employee names by leveraging various public data sources. It systematically queries search engines like Google and Bing, social networks like LinkedIn, and specialized platforms like Shodan or Hunter.io, providing valuable initial reconnaissance data for penetration testers. This data is instrumental for crafting targeted phishing campaigns or identifying potential attack surfaces.
- ✗
DNS zone transfer information and TXT records
Why it's wrong here
theHarvester is not engineered to perform DNS zone transfers or directly query DNS TXT records. Its primary function involves passive information gathering from publicly accessible web resources and APIs, rather than active network protocol interactions like requesting a full DNS zone file from a name server. DNS zone transfers are a distinct enumeration technique typically performed with tools like `dig` or `nslookup`, which operate at a different layer of reconnaissance.
- ✗
Vulnerability scan results from Nessus and OpenVAS
Why it's wrong here
theHarvester is fundamentally an OSINT reconnaissance tool, not a vulnerability scanner like Nessus or OpenVAS. Its purpose is to gather publicly available organizational data, not to actively probe systems for software vulnerabilities, misconfigurations, or missing patches. Dedicated vulnerability assessment tools are designed to interact directly with target systems to identify security flaws, a function entirely separate from theHarvester's passive information collection.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.