CEH Footprinting, Reconnaissance and Scanning Practice Question
Which command-line tool is specifically designed to extract email addresses, subdomains, and other information from public sources (e.g., search engines, social media) for a given domain?
⚠ Common exam trap
Test-takers frequently confuse theHarvester with Nmap or Metasploit because all three are used in reconnaissance, but only theHarvester specializes in passive OSINT gathering from public sources rather than active scanning or exploitation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
theHarvester
theHarvester is a dedicated open-source intelligence (OSINT) tool designed to gather emails, subdomains, IPs, and employee names from public sources such as Google, Bing, LinkedIn, and PGP key servers. It specifically targets a given domain and queries search engines and social media APIs to extract this reconnaissance data, making it the correct choice for this task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Metasploit
Why it's wrong here
Metasploit is a powerful open-source penetration testing framework primarily utilized for developing, testing, and executing exploit code against remote target machines. Its core functionality revolves around vulnerability exploitation, payload delivery, and post-exploitation activities, such as privilege escalation and data exfiltration, rather than passive information gathering from public internet sources. While it can leverage gathered intelligence, it is not an OSINT tool itself.
- ✗
Nmap
Why it's wrong here
Nmap (Network Mapper) is a renowned open-source utility designed for network discovery and security auditing, employing various packet types to identify live hosts, open ports, running services, and operating system versions on a target network. Its primary function involves active network scanning, which directly interacts with targets to gather information about their infrastructure, making it distinct from passive OSINT tools that collect data from publicly available sources without direct interaction.
- ✓
theHarvester
Why this is correct
theHarvester is a specialized command-line tool explicitly engineered for passive information gathering, or Open Source Intelligence (OSINT), by querying public data sources. It systematically extracts valuable intelligence such as email addresses, subdomains, hostnames, employee names, and banner information from search engines like Google and Bing, as well as public databases like Shodan and Hunter.io, without directly interacting with the target network.
- ✗
Wireshark
Why it's wrong here
Wireshark is a widely used graphical user interface (GUI) network protocol analyzer that allows users to interactively browse and inspect data from a live network or from a previously saved capture file. Its core purpose is to capture and analyze individual data packets in real-time as they traverse a network, providing deep insight into network communications and troubleshooting, which is fundamentally different from gathering publicly available information about an organization or individual.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.