Information Gatheringosintlinkedinusernameenumerationscraping

linkedin2username

OSINT tool that generates username lists from companies on LinkedIn. Pure web-scraper requiring valid LinkedIn credentials, no API key needed.

Description

linkedin2username is designed to create lists of possible username formats for all employees of a specified company by scraping LinkedIn. Users provide their valid LinkedIn username and password to log in, enabling the tool to access and extract employee data from the company's LinkedIn page.

Use cases include reconnaissance for penetration testing, username enumeration for password spraying attacks, and gathering intelligence on target organizations. It supports customization like appending domains to usernames and controlling search depth.

The tool may break if LinkedIn updates their site structure; issues should be reported on GitHub for quick fixes. It relies on web scraping techniques rather than official APIs.

How It Works

The tool uses Selenium with Chromium driver to automate browser interactions, logging into LinkedIn with provided credentials. It scrapes the target company's LinkedIn page, iterating through employee lists in loops of 50 based on specified depth, generating probable username formats from extracted data. Proxy support and sleep intervals help evade detection.

Installation

bash
sudo apt install linkedin2username

Flags

-h, --helpshow this help message and exit
-c, --company COMPANYCompany name exactly as typed in the company linkedin profile page URL.
-n, --domain DOMAINAppend a domain name to username output. [example: "-n uber.com" would output user@uber.com]
-d, --depth DEPTHSearch depth (how many loops of 50). If unset, will try to grab them all.
-s, --sleep SLEEPSleep interval between requests
-x, --proxy PROXYProxy server for requests
-k, --keywords KEYWORDSKeywords for filtering
-gGenerate output file
-o, --output OUTPUTOutput file path

Examples

Show the help message and usage information
linkedin2username -h
Generate username lists for Uber company from LinkedIn
linkedin2username -c Uber
Generate usernames for Uber and append uber.com domain (e.g., user@uber.com)
linkedin2username -c Uber -n uber.com
Search Uber employees to depth of 5 loops (250 profiles)
linkedin2username -c Uber -d 5
Scrape Uber with 10-second sleep between requests
linkedin2username -c Uber -s 10
Use specified proxy for scraping Uber
linkedin2username -c Uber -x http://proxy:8080
Output Uber usernames to specified file
linkedin2username -c Uber -o usernames.txt
Updated 2026-04-16kali.org ↗