# Emails

## Overview

Finding emails that belong to company employees are important for getting a foothold into  [O365,](/external-pentest-playbook/attacking-login-portals/password-spraying-o365.md) [OWA ](/external-pentest-playbook/attacking-login-portals/password-spraying-owa.md) and other login portals. The more emails the better. 

## Hunting Emails

Finding emails from companies can be done using [Hunter.io](https://hunter.io/). The great thing about it is that it can identify email patterns such as **{first\_initial}{last\_name}@company.com.** If we then have the name Bob Jones we could try the email <bjones@company.com>

[Phonebook.ez](https://phonebook.cz/) is also useful in pulling large amounts of emails down from a organizational domain.

{% hint style="info" %}
You can take the dumped emails and use them to password spray simple passwords
{% endhint %}

You can use [Clearbit](https://chromewebstore.google.com/detail/clearbit-connect-free-ver/pmnhcgfcafcnkbengdcanjablaabjplo) to find much more than the other tools just by visiting the organizations website and opening the extension. Nah this thing crazy for real.

Using the **Forgot password** feature is also a valid way of verifying emails. Works for Gmail

{% embed url="<https://www.voilanorbert.com/>" %}

## Verifying Emails

{% embed url="<https://tools.emailhippo.com/>" %}

{% embed url="<https://email-checker.net/>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://pnpt.adot8.com/osint-fundamentals/emails.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.