/osint-employees

description: Gather employee names + email patterns for password spray prep. Pipeline theHarvester (search engines + CT logs) -> derive names from email local-parts -> username-anarchy expansion. LinkedIn search is opt-in via --with-linkedin. Output -> recon/<target>/osint/. Usage /osint-employees <target.com> [--with-linkedin] [--with-pydictor-social]

/osint-employees

Gather employee names and email patterns for the spray-prep phase. Read-only OSINT — no auth probing.

Usage

/osint-employees target.com
/osint-employees target.com --with-linkedin                    # add CrossLinked LinkedIn search
/osint-employees target.com --with-pydictor-social             # add personal-style password candidates
/osint-employees target.com --company "Acme Corp"              # override auto-detected company name
/osint-employees target.com --sources duckduckgo,crtsh --limit 200

Pipeline

1. **theHarvester** — emails + names from search engines + CT logs

• Default sources: `duckduckgo,brave,yahoo,mojeek,crtsh,certspotter,hackertarget,otx`
• All free, no API keys required, no LinkedIn-specific scraping

2. **Derive names** from email local-parts (`john.smith@x.com` → `John Smith`)

• Ambiguous patterns (`jsmith@x.com`) are skipped — not enough signal

3. **(opt) CrossLinked** — LinkedIn employee names via Google/Bing dorks

• `--with-linkedin` opts in
• Uses search engines only; no LinkedIn auth required

4. **username-anarchy** — expand "First Last" into 32+ username permutations

• `john`, `j.smith`, `jsmith`, `smithj`, `js`, `john.smith`, etc.

5. **(opt) pydictor --extend** — personal-style password candidates

• `--with-pydictor-social` opts in
• Generates `firstname2025!`, `firstname123` style mutations

Output

recon/<target>/osint/
├── theharvester.json      # raw theHarvester output
├── emails.txt             # extracted emails (unique)
├── employee-names.txt     # "First Last" per line
├── usernames.txt          # all username permutations
└── (personal-passwords.txt if --with-pydictor-social)

Why opt-in for LinkedIn

CrossLinked queries Google/Bing for `site:linkedin.com "Company Name"` — public search, no LinkedIn auth required. But some BBP programs classify LinkedIn-based employee identification under "social engineering reconnaissance" which they don't permit. **Read the program scope before running with `--with-linkedin`**.

Why the default is conservative

For mature, security-conscious targets (Twilio, Stripe, etc.) the default sources often return very few emails — that's expected. These companies have good email hygiene. Add `--with-linkedin` for those targets if scope permits.

What this does NOT do

• **No LinkedIn auth scraping** — LinkedInDumper was intentionally excluded from PR #1 (requires LinkedIn account, OPSEC cost).
• **No paid OSINT** — DeHashed, IntelX, Shodan, Censys all skipped (no API key required by default).
• **No spray execution** — PR #5 will add `/spray` (with mandatory scope check and lockout warning).
• **No automated combining** — `usernames.txt` and `wordlists/ranked.txt` are kept separate; you manually combine before spray.

Dependencies

Install once: `./install_tools.sh --with-credential-attack`

Underlying tool

`tools/osint_employees.sh <target> [flags]` — call directly if you prefer a non-slash interface.