OSINT Tool: Generate username lists from companies on LinkedIn.
This is a pure web-scraper, no API key required. You use your valid LinkedIn username and password to log in, it will create several lists of possible username formats for all employees of a company you point it at.
Use an account with a lot of connections, otherwise, you’ll get crappy results. Adding a couple of connections at the target company should help – this tool will work up to third-degree connections. Note that LinkedIn will cap search results to 1000 employees max. You can use the features ‘–geoblast’ or ‘–keywords’ to bypass this limit. Look at the help below for more details.
Here’s what you get:
- first.last.txt: Usernames like Joe.Schmoe
- flast.txt: Usernames like JSchmoe
- firstl.txt: Usernames like JoeS
- first.txt Usernames like Joe
- rawnames.txt: Full name like Joe Schmoe
Optionally, the tool will append @domain.xxx to the usernames.
Two small updates:
- A small fix to url-encode special characters in company names, contributed by @ihack4falafel.
- Changed the URL from which to grab the initial CSRF token – old URL was becoming unreliable.
git clone https://github.com/initstring/linkedin2username.git
You’ll need to provide the tool with LinkedIn’s company name. You can find that by looking at the URL for the company’s page. It should look something like https://linkedin.com/company/uber-com. It may or may not be as simple as the exact name of the company.
Here’s an example to pull all employees of Uber:
$ python linkedin2username.py firstname.lastname@example.org uber-com
Here’s an example to pull a shorter list and append the domain name @uber.com to them:
$ python linkedin2username.py email@example.com uber-com -d 5 -n 'uber.com'
Copyright (c) 2018 InitString