linkedin2username Cheatsheet
OSINT tool that generates username lists from a company’s LinkedIn employee page.
Installation
git clone https://github.com/initstring/linkedin2username.git
cd linkedin2username
pip3 install -r requirements.txt
Basic Syntax
python3 linkedin2username.py -u <linkedin_email> -c <company_id> [options]
Options
| Option | Description | Example |
|---|---|---|
-u EMAIL | LinkedIn login email (required) | -u user@email.com |
-c COMPANY_ID | LinkedIn company ID (required) | -c 1234 |
-p PASS | LinkedIn password (prompts if omitted) | -p Password123 |
-n DEPTH | Page depth to scrape (default: 25) | -n 50 |
-d DELAY | Delay between requests in seconds | -d 3 |
-g | Get geolocation data for users | |
-o OUTPUT | Output directory | -o ./results |
--keyword KEYWORD | Filter by keyword/title | --keyword engineer |
Finding Company ID
- Go to the company’s LinkedIn page
- Click “See all employees”
- The URL will contain the company ID:
https://www.linkedin.com/search/results/people/?currentCompany=%5B"COMPANY_ID"%5D
Usage Examples
Basic Scrape
python3 linkedin2username.py -u user@email.com -c 1234
Deep Scrape with Delay
python3 linkedin2username.py -u user@email.com -c 1234 -n 100 -d 5
Filter by Title
python3 linkedin2username.py -u user@email.com -c 1234 --keyword "IT"
Output Files
The tool generates multiple username format files automatically:
| File | Format | Example |
|---|---|---|
first.last.txt | First.Last | john.smith |
flast.txt | FLast | jsmith |
firstl.txt | FirstL | johns |
first_last.txt | First_Last | john_smith |
rawnames.txt | Full names | John Smith |
Workflow for Password Spraying
- Scrape LinkedIn for company employees
- Use generated username lists as input for Kerbrute to validate which users exist in the domain
- Spray validated users with common passwords
python3 linkedin2username.py -u user@email.com -c 1234
kerbrute userenum -d domain.local --dc 172.16.5.5 flast.txt
kerbrute passwordspray -d domain.local --dc 172.16.5.5 valid_users.txt 'Welcome1'
Tips
- LinkedIn may rate-limit or flag automated scraping — use delays (
-d) - A LinkedIn premium account may return more results
- Combine output with common username wordlists for better coverage
- Always validate generated usernames with Kerbrute before spraying