Skip to content

Instantly share code, notes, and snippets.

@TheRealXaiL
Last active July 10, 2025 11:39
Show Gist options
  • Select an option

  • Save TheRealXaiL/a20f425f7f9acdc8d70ad253efe79b91 to your computer and use it in GitHub Desktop.

Select an option

Save TheRealXaiL/a20f425f7f9acdc8d70ad253efe79b91 to your computer and use it in GitHub Desktop.
emails:
You are performing OSINT for an upcoming penetration test. For the target domain [TARGET_DOMAIN], identify all known employee email addresses by:
1. Searching the web and X for publicly listed emails @TARGET_DOMAIN.
2. Searching LinkedIn for current and former employees of the company associated with TARGET_DOMAIN.
3. Scraping the target website for metadata in documents like PDFs and Microsoft suite files (e.g., using browse_page on document URLs to extract author names, etc.), and add any identified names.
4. For each identified employee name, guess email formats as firstname.lastname@TARGET_DOMAIN; handle common nicknames by including variants (e.g., mike/michael, bill/william, rob/robert, nick/nicholas, etc.).
5. Search deeper across multiple pages/sources for more employees.
6. Compile a unique list of all found/guessed emails in CSV format (column: email), including inline citations for sources using .
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment