Skip to content
HackIndex logo

HackIndex

Email Address Discovery and Harvesting

3 min read Apr 11, 2026

Overview

Email discovery finds addresses associated with a person or organisation using passive and semi-passive sources. The goal is a candidate list of real addresses to verify and investigate further. Starting points are typically a full name combined with a domain, a company name, or a known address you want to expand on.

Hunter.io

Hunter finds email addresses published on the web and associated with a domain. It returns confirmed addresses, the sources they were found on, and the organisation's email pattern.

Query a domain for all associated addresses:

┌──(kali㉿kali)-[~]
└─$ curl -s "https://api.hunter.io/v2/domain-search?domain=$DOMAIN&api_key=$HUNTER_API_KEY" | jq '.data.emails[].value' 
"[email protected]"
"[email protected]"
"[email protected]"

Find a specific person's address at a domain:

┌──(kali㉿kali)-[~]
└─$ curl -s "https://api.hunter.io/v2/email-finder?domain=$DOMAIN&first_name=$FIRST&last_name=$LAST&api_key=$HUNTER_API_KEY" | jq '.data.email' 
"[email protected]"

Hunter also returns the organisation's email pattern in the domain search response. If it shows first.last as the pattern, you can generate addresses for any name at that domain with high confidence.

theHarvester

theHarvester collects email addresses from multiple public sources including search engines, PGP key servers, and certificate transparency logs. It is useful for broad discovery across sources that Hunter does not cover.

┌──(kali㉿kali)-[~]
└─$ theHarvester -d $DOMAIN -b all -l 500 
[*] Emails found: 12
------------------
[email protected]
[email protected]
[email protected]

Use -b google,bing,linkedin to limit to specific sources if a full run is too slow or noisy. The LinkedIn source requires a valid LinkedIn session cookie configured in the tool settings.

Google Dorking for Email Addresses

Search engines index email addresses that appear in publicly accessible documents, forum posts, and web pages. Targeted dorks surface addresses that harvesting tools miss:

"@example.com" site:example.com
"@example.com" filetype:pdf
"@example.com" filetype:xlsx OR filetype:csv
"firstname.lastname" "@example.com"
"contact" OR "email" "@example.com"

Document filetypes are especially productive. Spreadsheets, PDFs, and Word documents published accidentally often contain internal distribution lists, staff directories, or contact sheets with dozens of addresses.

PGP Key Servers

Developers and security researchers frequently publish their email addresses on public PGP key servers when uploading signing keys. Search by name or domain:

┌──(kali㉿kali)-[~]
└─$ curl -s "https://keys.openpgp.org/vks/v1/search?q=$DOMAIN" | grep -oE '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}'

GitHub Commit History

Git commits include the author's email address by default and this data is publicly visible in commit history on GitHub and other public repositories. Organisations and individuals frequently expose personal or internal email addresses through code commits.

Search GitHub for commits from a domain:

┌──(kali㉿kali)-[~]
└─$ curl -s "https://api.github.com/search/commits?q=author-email:$DOMAIN&per_page=100" -H "Accept: application/vnd.github.cloak-preview" | jq '.items[].commit.author.email' | sort -u

For a specific repository, clone it and extract all commit emails from the log:

┌──(kali㉿kali)-[~]
└─$ git log --format='%ae' | sort -u

Email Pattern Derivation

Once you have the organisation's email pattern from Hunter or from analysing discovered addresses, you can generate addresses for any target at that organisation. Common patterns:

firstname.lastname@@domain.com
f.lastname@@domain.com
firstname.l@@domain.com
flastname@@domain.com
firstnamelastname@@domain.com
firstname@@domain.com

Generated addresses need verification before use. Pass them to the email verification workflow to confirm which ones are live.

References