Identifying Users

MITRE ATT&CK, Reconnaissance, Technique T1589

Creating Username Lists

Once we have identified a list of employee names, we can place them into a list to use throughout the engagement in multiple phases.

Below are my personal recommendations:

  1. Identify the username schema that the organization uses.

  2. Collect emails from, Data breaches, Phonebook, etc

  3. Run tooling against LinkedIn, Google, etc

  4. Run BridgeKeeper against any names identified to place them into the correct format.

  5. Place all of the identified usernames into a file and run sort -u to clean up the file.

  6. Verify these against the domain controller if possible, alternatively utilize all of these emails in external phishing campaigns.

Helpful Commands to Create a List

# Grep a list of emails from a .JSON (or any other) file:
grep -E -o "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b" file.txt

# Quick awk magic to add "" after every username:
awk '{print $0 ""}' usernames.txt

# Quick sed magic to remove "" after every email:
sed 's/@.*//' emails.txt

Email Lookup Services

Using Tools Available on GitHub

Locating Breached Credentials

Parsing data breaches to obtain previously compromised credentials can assist an attacker in obtaining initial access to a company by performing credential stuffing attacks.


Last updated