> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/osint-fundamentals/emails.md).

# Emails

## Overview

Finding emails that belong to company employees are important for getting a foothold into  [O365,](/external-pentest-playbook/attacking-login-portals/password-spraying-o365.md) [OWA ](/external-pentest-playbook/attacking-login-portals/password-spraying-owa.md) and other login portals. The more emails the better. 

## Hunting Emails

Finding emails from companies can be done using [Hunter.io](https://hunter.io/). The great thing about it is that it can identify email patterns such as **{first\_initial}{last\_name}@company.com.** If we then have the name Bob Jones we could try the email <bjones@company.com>

[Phonebook.ez](https://phonebook.cz/) is also useful in pulling large amounts of emails down from a organizational domain.

{% hint style="info" %}
You can take the dumped emails and use them to password spray simple passwords
{% endhint %}

You can use [Clearbit](https://chromewebstore.google.com/detail/clearbit-connect-free-ver/pmnhcgfcafcnkbengdcanjablaabjplo) to find much more than the other tools just by visiting the organizations website and opening the extension. Nah this thing crazy for real.

Using the **Forgot password** feature is also a valid way of verifying emails. Works for Gmail

{% embed url="<https://www.voilanorbert.com/>" %}

## Verifying Emails

{% embed url="<https://tools.emailhippo.com/>" %}

{% embed url="<https://email-checker.net/>" %}