A Pentester's Guide – Part 2 (OSINT – LinkedIn is not just for jobs)
If you read my last article on OSINT, you'll know a little bit on how to find dirt on companies, their assets, and how to do all of that passively. This installment focuses on researching individuals employed at specific organizations. LinkedIn is a very useful tool for enumerating users, and their emails.
'Generating' Email Addresses
As mentioned in the previous article, hunter.io is a great resource for searching company email addresses, which provides organizational email structure breakdowns.
Stage 1 – Figure Out the Naming Conventions
Using google.com as an example, we can identify email patterns. After observing emails like hsimpson@google.com and jsmith@google.com, analysts can deduce the structure as "{firstinitial}{lastname}@{companyname}.com." This could vary by organization, but we can quickly come up with the naming convention, and then we can move onto stage 2.
Hunter.io displays a "most common pattern" section to facilitate this analysis.
Stage 2 – Get the Employees and Generate the Emails
LinkedIn facilitates obtaining employee name lists through Google dorking techniques, using tools like GoogLinked. When coupled with ProxyDock (another shameless plug), you can scrape google all day with impunity.
Users must modify scripts before execution, replacing default arguments with target company names and email domains. Output can be piped to files for processing.
The resulting output generates multiple email addresses through a process that uses Google dorking to capture LinkedIn titles, then applies identified formatting conventions.
Script customization requires modifying the names.each section based on discovered company formats. tarr[0] and tarr[-1] are firstname and lastname respectively. Note, things can get a bit whacky when middle names are introduced. So just know this is not a fool proof method.
Generated email lists can be passed to weleaksinfo.com for additional reconnaissance.
Bonus: Password Spraying
During pentests, generated email lists support targeted password spraying operations. Traditional approaches—testing one email against multiple passwords—risk triggering SIEM alerts or account lockouts affecting production systems.
An alternative method, attributed to atoscher, is to try each email with a single password, such as Summer2018, or Fall2018. This exploits quarterly password rotation policies, which often result in weaker password creation due to user memory constraints. Rotating through VPN services, user agents, and testing against legitimate services like Gmail, Microsoft Lync, and SharePoint significantly reduces blocking risk.
That's all for this week my fellow haxors! Stay tuned, next week I am going to bring you 'Active Recon – Deeper than Nmap', the name might change, we'll see.