Email Enumeration

Corporate emails are the raw material of two key attacks: password spraying (try one password against many accounts, see Password Spraying) and targeted phishing. Enumerating an organization’s emails means deducing its pattern (first.last@), collecting the existing ones, validating them without alerting, and cross-referencing leaks. A good email list is often the first step toward initial access.

Deduce the email pattern

Almost every company uses a consistent format:

first.last@target.com     jdoe@target.com        j.doe@target.com
firstlast@target.com      lastf@target.com        first@target.com

With a single known email (from the website, LinkedIn, a press release) you deduce the pattern and apply it to the whole employee list (see People OSINT).

Collect and generate

# collection from public sources
theHarvester -d target.com -b all        # emails, hosts, names
# generate emails from LinkedIn names with a pattern
crosslinked -f '{first}.{last}@target.com' "Target Inc"
# combine names + pattern
# (names from recon-personas) -> apply format -> candidate list

Validate without making noise

Before spraying, it’s worth knowing which emails actually exist:

# validation via SMTP/service responses (carefully)
o365spray --validate --domain target.com
# user enumeration on O365/Exchange/OWA
# (some responses distinguish "user doesn't exist" from "wrong password")
# syntax/MX verification
# "email verifier" tools -> confirm deliverability without sending

Careful: some validations generate traffic against the target (active) or login attempts; respect scope and avoid account lockouts.

Cross-reference leaks

HaveIBeenPwned       which emails appear in breaches? (in which breach)
Dehashed / LeakCheck  leaked credentials associated with those emails
# a leaked credential + reuse = direct access (see ad-spray)

What to do with the list

Password spraying against OWA/VPN/O365 (see Password Spraying) — with the lockout policy in mind.
Targeted phishing (see social engineering) with pretexts from recon-personas.
Valid-user enumeration on services that distinguish “exists/doesn’t exist”.

Email and domain security (SPF/DKIM/DMARC)

While at it, review the domain’s anti-spoofing posture (useful for phishing and defense):

dig target.com TXT | grep spf        # SPF
dig _dmarc.target.com TXT            # DMARC (p=none allows easier spoofing)
# DKIM by selector

A DMARC at p=none or absent makes spoofing the domain in phishing easier.

For the defense

Reduce exposure: minimize public emails on the website, anti-phishing training, MFA (breaks the value of a sprayed/leaked password), configure SPF+DKIM+DMARC at p=reject (prevents domain spoofing), monitor domain leaks (HIBP for business), and smart lockout against spraying.

Testing checklist

Email pattern deduced from a known email
Emails collected (theHarvester) and generated (crosslinked)
List cross-referenced with recon-personas names
Existence validation without triggering lockouts
Leaks checked (HIBP/Dehashed)
Domain SPF/DKIM/DMARC posture reviewed
List ready for spraying/phishing (within scope)