loading
Loading content
loading
Recon
Passive LinkedIn employee enumeration through search engine results.
overview
CrossLinked sits early in OSINT or spray prep: company name in, formatted identities out, before password spraying or phishing simulation consumes the list.
Set -f to the org username or email pattern, narrow engines with --search, and optionally route via --proxy or --proxy-file. Output is a folder of formatted names for the next node.
Trickest runs CrossLinked as a managed Recon node. Prefer it over theHarvester when the job is LinkedIn-name focused rather than broad multi-source OSINT.
use cases
Give CrossLinked a company name and it scrapes search engines for LinkedIn profiles, returning the people associated with that organization.
Apply a format string so each name becomes a username or email in the organization's exact convention, ready for spraying or phishing tests.
Collect identities through public search results instead of authenticated LinkedIn scraping, so the recon leaves no trace on the target's account systems.
Load a proxy file so a wide enumeration spreads across addresses and avoids tripping search-engine rate limits.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| company-name | STRING | · | Target company name to enumerate employees for (positional argument). |
| format | STRING | -f | Name format, for example {first}.{last}@domain.com or domain\{f}{last}. |
| search-engine | STRING | --search | Search engines to scrape (default google,bing). |
| timeout | STRING | -t | Max timeout per search in seconds (default 20, 0 for none). |
| proxy-file | FILE | --proxy-file | Load proxies from a file for rotation across a large run. |
| proxy | STRING | --proxy | Route requests through a single proxy as IP:Port. |
Showing key inputs. crosslinked exposes 6 inputs in total.
example
# scrape Google and Bing for names, format as corporate emailscrosslinked -f '{first}.{last}@example.com' --search google,bing -t 20 example[*] Starting CrossLinked search engine enumeration[*] Scraping google, bing for example LinkedIn profiles[+] 28 employee names collected, formatting as {first}.{last}@example.com[+] Writing results to names.txtlaura.nguyen@example.comamara.okafor@example.comsofia.delgado@example.comrami.haddad@example.commarco.bianchi@example.comguidance
Reach for CrossLinked when you need LinkedIn employee names formatted as usernames or emails for spraying or phishing tests. Use theHarvester when you need emails and hosts from many sources at once.
Broad OSINT across many sources. Wider than CrossLinked's LinkedIn-name focus.
Email-focused OSINT. Complements CrossLinked name-to-username output.
Usernames from document metadata. A different source for the same identity goal.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A company name feeds CrossLinked, which scrapes search engines for LinkedIn profiles and writes formatted usernames as a queryable output.
Facts on this page come from the live Trickest tool library.