theharvester
Install command:
brew install theharvesterGather materials from public sources (for pen testers)
License: GPL-2.0-only
Development: Pull requests
Formula JSON API: /api/formula/theharvester.json
Formula code: theharvester.rb on GitHub
Bottle (binary package) installation support provided for:
| macOS on Apple Silicon |
golden gate | ✅ |
|---|---|---|
| tahoe | ✅ | |
| sequoia | ✅ | |
| Linux | ARM64 | ✅ |
| x86_64 | ✅ |
Current versions:
| stable | ✅ | 4.11.1 |
| head | ⚡️ | HEAD |
Revision: 4
Depends on:
| certifi | 2026.10.23 | Mozilla CA bundle for Python |
| cffi | 2.1.1 | C Foreign Function Interface for Python |
| libyaml | 0.2.5 | YAML Parser |
| pydantic | 2.14.3 | Data validation using Python type hints |
| python@3.15 | 3.15.2 | Interpreted, interactive, object-oriented programming language |
Depends on when building from source:
| cmake | 4.4.5 | Cross-platform make |
Uses from macOS: libffi, libxml2 (since macOS Ventura), libxslt
Binaries:
restfulHarvest,
theHarvester,
theharvester
Analytics:
| 30 days | 90 days | 365 days | |
|---|---|---|---|
| Installs | 412 | 1,647 | 5,027 |
Installs (--HEAD) | 1 | 3 | 7 |
| Installs on Request | 413 | 1,646 | 5,028 |
Installs on Request (--HEAD) | 1 | 3 | 7 |
| Build Errors | 1 |
Known vulnerabilities in the current version:
| GHSA-494j-54xm-rwp3 | AIOHTTP: Secure attribute not enforced for shared cookie |
| GHSA-5wr8-gcqf-gqf3 | aiohttp server lacks an initial request/header timeout |
| GHSA-6cjc-53gc-5rqm | AIOHTTP: Connector pool exhaustion via Max-Age overflow |
| GHSA-9xw5-w5jj-pvcg | AIOHTTP: File descriptor exhaustion in multipart requests |
| GHSA-f9xw-jh8m-3mwq | AIOHTTP: Absolute-form request targets can spoof Request.scheme |
| GHSA-gx76-c99x-2c96 | AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies |
| GHSA-pqxq-w44r-73xw | AIOHTTP: Pure-Python parser request smuggling |
| GHSA-45c3-73f7-pv4m (high) | dnspython dns.name.from_wire_parser() excessive CPU use |
| GHSA-4fvr-rgm6-gqmc | aiohttp: HTTP/1 Pipelined Requests Queue Without Limit |
| GHSA-xcgm-r5h9-7989 | aiohttp: Incomplete websocket frame payloads bypass memory limits |
| GHSA-4m7w-qmgq-4wj5 | aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections |
| GHSA-hpj7-wq8m-9hgp | aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges |
| GHSA-63hw-fmq6-xxg2 | aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines |
| GHSA-g3cq-j2xw-wf74 | aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup |
| GHSA-2fqr-mr3j-6wp8 (high) | aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence |
| GHSA-9x8q-7h8h-wcw9 | aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect |
| GHSA-3j69-69wj-xqx2 (medium) | UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps() |
| GHSA-mq44-7p77-q5h7 | AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate |
| GHSA-mfx4-hv73-q22v | AIOHTTP: HTTP request smuggling via WebSocket upgrade |
| GHSA-cq5v-8q36-5273 | AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) |
| GHSA-2g87-pp6c-29x5 | aiohttp: Multiple instances of excessive or unbounded memory/CPU use |
Data from Homebrew/advisory-database. Run brew vulns theharvester for a live check.