<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-employee-profiling
description: >-
  Profile organizational employees through OSINT sources to map roles,
  relationships, credentials, and social engineering vectors using LinkedIn,
  public records, and data aggregators.
domain: cybersecurity
subdomain: osint-recon
tags:
  - employee-profiling
  - linkedin-osint
  - social-engineering
  - org-chart
  - human-intelligence
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  theHarvester, CrossLinked, linkedin2username, h8mail, Maltego,
  Hunter.io, PhoneInfoga, Sherlock, Holehe, GHunt.
metadata:
  mitre-attack:
    - "T1589.001"  # Gather Victim Identity Information: Credentials
    - "T1589.002"  # Gather Victim Identity Information: Email Addresses
    - "T1589.003"  # Gather Victim Identity Information: Employee Names
    - "T1591.004"  # Gather Victim Org Information: Identify Roles
---

# Conducting Employee Profiling

## Overview

Employee profiling maps an organization's personnel through publicly available
information. This technique identifies key decision-makers, IT staff,
developers, and security team members. It reveals email formats, credential
patterns, and social engineering opportunities. The intelligence supports
phishing campaigns, pretexting scenarios, and password spraying attacks during
authorized engagements.

## Prerequisites

- theHarvester for email and name discovery
- CrossLinked or linkedin2username for LinkedIn scraping
- Hunter.io API key for email pattern verification
- h8mail for credential breach checking
- PhoneInfoga for phone number OSINT
- Sherlock for username enumeration across platforms

```bash
pip install theHarvester h8mail holehe
go install github.com/m8sec/crosslinked@latest
pip install phoneinfoga sherlock-project
```

## Quick Reference

| Task | Command |
|------|---------|
| Harvest emails | `theHarvester -d target.com -b all -l 500` |
| LinkedIn names | `crosslinked -f '{first}.{last}@target.com' "Target Corp"` |
| Email verify | `curl -s "https://api.hunter.io/v2/domain-search?domain=target.com&api_key=$HUNTER_KEY"` |
| Breach check | `h8mail -t user@target.com --config h8mail_config.ini` |
| Username enum | `sherlock username --print-found` |
| Phone lookup | `phoneinfoga scan -n "+15551234567"` |
| Account check | `holehe user@target.com` |
| Email format | `curl -s "https://api.hunter.io/v2/email-finder?domain=target.com&first_name=John&last_name=Smith&api_key=$HUNTER_KEY"` |

## Workflow

### Step 1: Name Discovery

Identify employees from public sources.

```bash
# theHarvester — emails and names from search engines
theHarvester -d target.com -b google,bing,linkedin,yahoo -l 500 -f harvest.json

# CrossLinked — LinkedIn employee scraping
crosslinked -f '{first}.{last}@target.com' "Target Corporation" -o employees.txt

# linkedin2username — generate email lists
linkedin2username -c "Target Corporation" -n 200 -d 3 -o linkedin_users.txt
```

### Step 2: Email Pattern Discovery

Determine the organization's email naming convention.

```bash
# Hunter.io — domain email pattern
curl -s "https://api.hunter.io/v2/domain-search?domain=target.com&api_key=$HUNTER_KEY" \
  | jq '{pattern: .data.pattern, emails: [.data.emails[].value]}'

# Verify specific email
curl -s "https://api.hunter.io/v2/email-verifier?email=j.smith@target.com&api_key=$HUNTER_KEY" \
  | jq '.data.status'

# Phonebook.cz — email enumeration
curl -s "https://phonebook.cz/api/v1/search?query=target.com&type=email" \
  | jq -r '.results[]'
```

### Step 3: Social Media Correlation

Map employees across social platforms.

```bash
# Sherlock — username across platforms
sherlock "john.smith.target" --print-found --csv --output sherlock_results/

# Holehe — check email registration on services
holehe user@target.com --only-used --no-color

# GHunt — Google account analysis (if applicable)
ghunt email user@target.com
```

### Step 4: Credential Exposure Check

Verify if employee credentials appear in breach databases.

```bash
# h8mail — breach data search
h8mail -t user@target.com --config h8mail_config.ini -o breaches.json

# Bulk check from employee list
h8mail -t employees.txt --config h8mail_config.ini -o bulk_breaches.json
```

### Step 5: Build Organizational Profile

Compile findings into a structured intelligence report.

```bash
# Merge all sources
cat harvest.json linkedin_users.txt employees.txt | sort -u > all_employees.txt

# Generate org chart data
node agent.js --domain target.com --full --output org_profile.json
```

## Detection Opportunities

- LinkedIn connection requests from unfamiliar profiles may indicate profiling
- Hunter.io verification requests generate email delivery attempts
- Sherlock-style username enumeration creates login page hits across platforms
- h8mail queries against breach databases may trigger monitoring alerts

## Verification

- [ ] Employee names harvested from multiple sources
- [ ] Email naming convention identified and validated
- [ ] Key personnel mapped (IT, security, executives, developers)
- [ ] Social media profiles correlated across platforms
- [ ] Credential exposure checked via breach databases
- [ ] Organizational hierarchy and reporting structure documented

## References

- [theHarvester](https://github.com/laramies/theHarvester)
- [CrossLinked](https://github.com/m8sec/crosslinked)
- [Hunter.io](https://hunter.io/api-documentation)
- [Sherlock](https://github.com/sherlock-project/sherlock)
- [h8mail](https://github.com/khast3x/h8mail)
- [PhoneInfoga](https://github.com/sundowndev/phoneinfoga)

---
v1.0 | Validated: 2026-03-17
