Recon
Turn a company name into formatted employee identities
Passive LinkedIn employee enumeration through search engine results.
overview
What crosslinked does
CrossLinked sits early in OSINT or spray prep: company name in, formatted identities out, before password spraying or phishing simulation consumes the list.
Set -f to the org username or email pattern, narrow engines with --search, and optionally route via --proxy or --proxy-file. Output is a folder of formatted names for the next node.
Trickest runs CrossLinked as a managed Recon node. Prefer it over theHarvester when the job is LinkedIn-name focused rather than broad multi-source OSINT.
use cases
Where crosslinked fits
Build an employee name list
Give CrossLinked a company name and it scrapes search engines for LinkedIn profiles, returning the people associated with that organization.
Generate username and email patterns
Apply a format string so each name becomes a username or email in the organization's exact convention, ready for spraying or phishing tests.
Stay passive during recon
Collect identities through public search results instead of authenticated LinkedIn scraping, so the recon leaves no trace on the target's account systems.
Rotate proxies for large runs
Load a proxy file so a wide enumeration spreads across addresses and avoids tripping search-engine rate limits.
reference
crosslinked inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| company-name | STRING | · | Target company name to enumerate employees for (positional argument). |
| format | STRING | -f | Name format, for example {first}.{last}@domain.com or domain\{f}{last}. |
| search-engine | STRING | --search | Search engines to scrape (default google,bing). |
| timeout | STRING | -t | Max timeout per search in seconds (default 20, 0 for none). |
| proxy-file | FILE | --proxy-file | Load proxies from a file for rotation across a large run. |
| proxy | STRING | --proxy | Route requests through a single proxy as IP:Port. |
Showing key inputs. crosslinked exposes 6 inputs in total.
example
Run crosslinked
# scrape Google and Bing for names, format as corporate emailscrosslinked -f '{first}.{last}@example.com' --search google,bing -t 20 example[*] Starting CrossLinked search engine enumeration[*] Scraping google, bing for example LinkedIn profiles[+] 28 employee names collected, formatting as {first}.{last}@example.com[+] Writing results to names.txtlaura.nguyen@example.comamara.okafor@example.comsofia.delgado@example.comrami.haddad@example.commarco.bianchi@example.comguidance
Choosing crosslinked
Reach for CrossLinked when you need LinkedIn employee names formatted as usernames or emails for spraying or phishing tests. Use theHarvester when you need emails and hosts from many sources at once.
theharvester
Broad OSINT across many sources. Wider than CrossLinked's LinkedIn-name focus.
infoga
Email-focused OSINT. Complements CrossLinked name-to-username output.
pymeta
Usernames from document metadata. A different source for the same identity goal.
faq
crosslinked questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run crosslinked yourself
A company name feeds CrossLinked, which scrapes search engines for LinkedIn profiles and writes formatted usernames as a queryable output.
Facts on this page come from the live Trickest tool library.