OSINT on People & Organizations

The overwhelming majority of breaches do not begin with a clever exploit against a server. They begin with a person — someone who clicked a link, reused a password, or answered a phone call from a stranger who knew just enough to sound legitimate. Firewalls, patches, and segmentation all assume the attacker has to break in; the human path lets them simply log in. That is why serious reconnaissance spends most of its effort on people, not packets.

The goal of this phase is a roster: a list of employees, their roles, their email addresses and usernames, and the predictable patterns wrapped around all of it. Humans are creatures of convention — companies use one email format for everyone, people reuse the same password across a dozen sites, and almost everyone broadcasts where they work and what they do. Each of those conventions is a foothold. Build the roster well and the later phases — phishing, password attacks, social engineering — almost write themselves.

Almost every organization uses a single, consistent email convention for its staff, and that convention is trivially recoverable. Find two or three real addresses — from a press release, a LinkedIn contact, a support thread, a leaked document — and the pattern reveals itself: firstname.lastname@, finitial+lastname@, flast@, or one of a handful of common variants. Once you know the format, you no longer need to find addresses; you can generate them. Pull a roster of names from public profiles, run them through the format, and you have probable email addresses for the entire company.

The same exercise yields usernames, and usernames are quietly valuable. Corporate login portals, VPNs, and mail systems usually accept a username (often just the email's local part), and knowing valid usernames is half of a password attack — you spray a common password across every account instead of guessing both halves of the pair. A confirmed list of who exists turns a blind brute-force into a targeted, far more efficient campaign.

• theHarvester — a staple recon tool that scrapes search engines and public sources for email addresses, names, and subdomains tied to a target domain.
• hunter.io — indexes email addresses by company and will tell you the dominant format outright, with a confidence score.
• phonebook.cz — returns all known email addresses, subdomains, and URLs for a domain from its dataset.
• clearbit and similar enrichment services — map a domain to employee names, roles, and contact details pulled from public business data.

Professional social networks — LinkedIn chief among them — are an organization's org chart published voluntarily. Walk the employee list and you can reconstruct the reporting structure: who manages whom, which teams exist, who sits in finance, who runs IT, and who holds the keys to sensitive systems. That structure tells you who is worth impersonating and who is worth targeting. An email that appears to come from the CFO carries weight; a request sent to the person who can approve a wire transfer is the one that pays off.

The same profiles reveal who is new. A "started this month" badge marks someone still learning the building, unsure of the norms, and eager to please — in other words, far easier to phish than a ten-year veteran who has seen every trick. New hires are a recon goldmine for exactly that reason.

And people advertise their tech stack without realizing it. Engineers list the platforms they administer, certifications name specific products, and project descriptions mention versions. But the richest single source is job postings: when an organization hires, it publishes a detailed list of exactly what it runs. A req asking for five years of experience with a named firewall, a specific cloud platform, a particular EDR, and a version of an ERP system is the company handing you its architecture diagram. You learn what to research for vulnerabilities before you have sent a single packet.

Years of mass data breaches have left enormous troves of leaked credentials in public and semi-public circulation. Services like Have I Been Pwned let you check which addresses at a target domain have appeared in known breaches, and aggregators such as Dehashed go further, exposing the associated passwords, hashes, and other personal details that leaked alongside them. Feed in a company domain and you often get back a list of employee accounts caught in past compromises.

The reason this matters is credential reuse. People do not invent a fresh, strong password for every account; they pick one they can remember and use it everywhere — personal email, a hobby forum, and, all too often, the corporate VPN. So a password that leaked from some unrelated site three years ago is frequently still valid somewhere that matters today. A breach dump is not just historical trivia; it is a list of passwords to try, and a depressing share of them still work.

Treat anything in these sources as a hypothesis to validate carefully and within the bounds of your authorization — not as a free pass. The point of gathering it is to understand the target's exposure exactly as a real adversary would, then prove the risk responsibly rather than exploit it recklessly.

Every public document an organization publishes — a PDF brochure, a DOCX report, an XLSX template — carries metadata the author rarely thinks about. Embedded in the file are author names, internal usernames, the exact software and version used to create it, edit history, and sometimes full internal file paths like C:\Users\jdoe\Finance\Q3\. Each of those is a gift: usernames confirm the naming convention, software versions point at vulnerabilities, and internal paths reveal how the network is laid out. Tools like exiftool read this metadata out of any single file, and FOCA automates the process — crawling a target's site for documents, harvesting their metadata in bulk, and assembling the results into a map of users and systems.

Public code repositories are the other rich vein. Developers push to GitHub and GitLab constantly, and in the rush, secrets slip through: hardcoded passwords, cloud API keys, database connection strings, internal hostnames, and private endpoints committed straight into source. A single leaked key can hand an attacker live access with no exploitation at all — just authentication with credentials the company published itself. Searching an organization's repos, and the personal repos of its engineers, for these accidents is a standard and frequently rewarding part of recon.

Gathering all of this leaves a trail, so disciplined researchers separate their work from themselves. Rather than browsing target profiles from a personal account — which can notify the target and tie the activity to a real identity — they use a dedicated research identity, sometimes called a sock puppet: a clean, purpose-built persona kept entirely apart from their own. As the roster grows, link-analysis tools like Maltego help make sense of it, pulling together people, emails, domains, and breach records into a single visual graph so the connections between scattered facts become obvious.

All of this is powerful, and all of it is constrained by authorization. Open-source intelligence is collected to understand and prove an organization's exposure under an agreed scope — not to harass individuals, not to act on people's personal data, and not to wander outside what you are permitted to touch. The discipline that separates a professional from an attacker is restraint: gather what a real adversary could, demonstrate the risk responsibly, and stop there.

Which points straight at the defense. Everything in this lesson is something an organization can shrink:

• Minimize public exposure. Audit what employee profiles, job postings, and the company site reveal about structure and tooling, and trim what does not need to be public.
• Scrub document metadata. Strip author names, usernames, paths, and version data from files before they are published.
• Scan repositories for secrets. Run automated secret-scanning on every repo, rotate anything that has leaked, and never commit credentials in the first place.
• Assume reused passwords are already known. Enforce unique passwords, multi-factor authentication, and proactive checks against breach data — treat any leaked credential as compromised everywhere.

With the human picture assembled, the next step is to turn search engines themselves into a precision recon instrument — coaxing public indexes to surface the exposed files, logins, and devices that ordinary searching hides.