UBERSEC Cyber Security Homepage

Tutorials

TUTORIALS

UBERHARVEST TOOL USAGE

This page will provide uberharvest users some guidelines and examples for using the uberharvest tool

Please type the following command to see uberharvest help and all supported feature by uberharvest with the current release

root@ubuntu:~/uberharvest# ./uberharvest –help

THE RESULTS ARE

Welcome to UBERSEC direct email harvester (uberharvest)

INFORMATION:

This FREE tool was designed to get a user to enter a website or load a file with many URLs. Once the URL(s) have been entered, the harvest tool crawl through the website (and all the links within that website) searching for valid email addresses. The application can search for email addresses randomly (i.e. @ or the user can chose to search for email addresses for a specific domain (i.e. for www.ubersec.com the application can search for all @ubersec.com email addresses within the website). Then the user can chose to either print the results on the screen or save them into a file. In addition, the application can also be used to search for Mail Exchange (MX) server correspond with each URL that have been found by the application. Then that information can be used to test if the MX server is also an Open-Relay server or not.

TIP,
The information and emails can be used for penetration testing purposes. Yet, you are encouraged to not use that script for malicious purposes or hurting other people or any organizations.

USAGE:

Type ./uberharvest [option] and you are ready to roll.
Type ./uberharvest –load OR-l to get uberharvest to read website(s) from a text file

This option can help to extract emails more than just one website per search. Please assure that you only specify valid websites. For example,

http://www.ubersec.com

http://www.abcdef.edu

http://xxx.xxxxxxx.xxx => (x = whatever website you need to search through).

TIP,

If uberharvest recognizes a filename with the name: web.txt inside the vault/ directory, it will ask if you want to load that file first. So, place your website inside a filename named vault/web.txt
Type ./uberharvest –menu OR -m to load the mainmenu.
Type ./uberharvest –deep OR -de for really deep scanning of URL links.
Type ./uberharvest –verbose OR -v for complete verbosity.

TIP,

Anything with verbose usually takes longer. Just keep it in mind!
Type ./uberharvest –update OR -u for getting new updates.
Type ./uberharvest –development OR -d for development version.
Type ./uberharvest –mailserver OR -mx for scanning for email exchange servers.
Type ./uberharvest –relay OR -r for scanning for email exchange servers.

With -v option uberharvest will use NMAP to scan Operating System fingerprinting.
Type ./uberharvest -m OR -l AND –proxy for using proxy option while
using opetion <1> and <2> in the usage list above.

IP = The IP address of the proxy server SOCKET= The socket number for that IP Address

For example, –proxy 192.168.1.1:3128 OR 132.170.3.33:3128

TIP,

Refer to the anonymous.txt file for an anonymous proxy list. The list will get updated by ubersec as needed.
Type ./uberharvest –auto OR -a for automating:

– Email harvest
– MX collection
– Open-Relay search

DIRECTIONS:

Please refer to the README file since it actually contains some examples scenarios.

DISCLAIMER:

This tool was created by Yakov Goldberg for legal penetration testing purposes only. The tools is FREE of charge and must only be used for helping society and improving upon cyber security. That tool (uberharvest) was created to automate and make the life of security professionals a little easier. Thus, this tool MUST NOT be used to harm any entity or cuase an damage. Yakov Goldberg does not claim any responsibility for any information that is retrieved by using this tool and any other further reckless or intentional malicious or none malicious attacks that someone might or may attempt to do by using the information gathered from this tool.

*** Please report any bugs to the ubersec team at support(at)ubersec(dot)com ***

–SNIP–SNIP–SNIP–

You are done!

Now let’s scan a regular website for harvesting email addresses from this site. Please type the followings:

EXAMPLE 1

The following tag [-m] will load the uberharvest tool and require the user to type one URL address of a website he or she are interested in for harvesting email address.

root@ubuntu:~/uberharvest# ./uberharvest -m

Now you will be required to type a full website address that you would like to scan

Please enter a valid web address. For example, http://www.ubersec.com
Please enter the address:http://www.ubersec.com

I typed this full URL http://www.ubersec.com for scanning this website

QUESTION 1

Would you like to search for a specific email address domain? For example, @ubersec.com

[Y]es – The user will specify domain name (i.e. ubersec.com)

[N]o – The tool will search for random emails (i.e. <wildcard>@ <wildcard>.<wildcard>)

Please type Y or N:n

If you select [y], you will have to specify a domain name such as ubersec.com or @ubersec.com. In that case, uberharvest will search through the website and harvest all email that follow the <wildcard>@ubersec.com criteria.

If you select [n], the uberharvest tool will search through the target website and harvest all emails (i.e. <wildcard>@ <wildcard>.<wildcard>)

QUESTION 2

Would you like to save output to a text file?

[Y]es – The output will be saved to a file

[N]o – The output will be displayed on the screen

Please type Y or N: n

If you select [n], the output will be displayed on the screen only.

If you select [y], the output will be save on a results will be saved to a file in the [vault/] folder

QUESTION 3

Would you like to search only for URLs that are specific for the website that you are interested?

HINT,

For example, if your website is http://www.ubersec.com if you say [Y], uberharvest will only search for emails within links the belong to ubersec.com rather than jumping to other websites.

[Y]es – Uberharvest will only search for emails in links that belong to that website (i.e. ubersec.com)

[N]o – Uberharvest will search for emails also in other links that are referenced in the website.

Please type Y or N:n

If you select [n], uberharvest tool will search through www.ubersec.com website, get all other links mention in the ubersec website and finally the tool will search within these links for all other email addresses.

If you select [y], uberharvest tool will search through www.ubersec.com website, get only the links that belongs to ubersec.com and finally search within these links for all other email addresses.

Press [Enter] and off we go…

THE RESULTS ARE

tutorial_1

I deleted most of the emails from the image above to not disclose other entities emails.

You are done!

EXPLANATION

The results above indicate that the uberharvest tool was able to harvest emails by crawling www.ubersec.com website. The email addresses in the list belong to other entities as well. However, if you want to get more granular with your results and only get emails associated with ubersec.com then you can specific that you want only emails associated with ubersec.com domain in questions 1 and then you need to select [yes] in question 3. The example shown below.

EXAMPLE 2

The following tag [-m] will load the uberharvest tool and require the user to type one URL address of a website he or she are interested in for harvesting email address. Likewise, the following tag [-v] will cause uberharvest to print the scanning in a verbose mode. The [verbose] option is good for debugging but bad for accuracy.

root@ubuntu:~/uberharvest# ./uberharvest –m -v

Verbose is [ON]

Please enter a valid web address. For example, http://www.ubersec.com
Please enter the address:http://www.ubersec.com

I typed this full URL http://www.ubersec.com for scanning this website

QUESTION 1

Would you like to search for a specific email address domain? For example, @ubersec.com

[Y]es – The user will specify domain name (i.e. ubersec.com)

[N]o – The tool will search for random emails (i.e. <wildcard>@ <wildcard>.<wildcard>)

Please type Y or N:y

Please enter the email domain name. For example, @ubersec.com

Please enter it now: ubersec.com

You have selected: @ubersec.com

QUESTION 3

Would you like to search only for URLs that are specific for the website that you are interested?

HINT,

For example, if your website is http://www.ubersec.com if you say [Y], uberharvest will only search for emails within links the belong to ubersec.com rather than jumping to other websites.

[Y]es – Uberharvest will only search for emails in links that belong to that website (i.e. ubersec.com)

[N]o – Uberharvest will search for emails also in other links that are referenced in the website.

Please type Y or N:y

THE RESULTS ARE

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

http://ubersec.com/

['support@ubersec.com', 'support@ubersec.com']
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

http://ubersec.com/tutorials/

['support@ubersec.com', 'support@ubersec.com']
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

http://ubersec.com/downloads/

HTTP Error 403: Forbidden
Code 403 is Forbidden
No email address was found!
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

http://blog.ubersec.com/index.php

['support@ubersec.com','subject=/C=US/ST=VIRGINIA/L=NORFOLK/O=UBERSEC/OU=WEB/CN=UBERSEC/emailAddress=support@ubersec.com','support@ubersec.com','support@ubersec.com']
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

http://ubersec.com/links/