[opensourcedex]

linkedin2username is a free, open source threat detection & response project written in Python and released under MIT. It has 1,872 GitHub stars, 224 forks and 1 open issues, and was last pushed 5 months ago. On this registry it ranks #44 of 61 tracked projects in Threat Detection & Response, with 5 head-to-head comparisons available.

What is linkedin2username?

linkedin2username is an OSINT tool for penetration testers and security researchers who need to generate lists of probable corporate usernames from a company's LinkedIn employee page.

What it is

linkedin2username is a Python command-line scraper that logs into LinkedIn with your own credentials, walks a target company's employee listings, and writes several files of candidate usernames in common corporate formats. It requires no LinkedIn API key — it is a pure web scraper driven through Selenium, spawning a temporary Chrome, Chromium, or Firefox window to perform the login. It sits in the Security & Privacy / Threat Detection & Response category alongside other open-source OSINT and pentesting tooling, and is released under the MIT licence.

The concrete problem it solves is that security teams need a username wordlist matching an organisation's naming convention before they can attempt password spraying, phishing, or credential-stuffing checks against that organisation. Deriving those formats by hand from a handful of employee profiles is slow and incomplete. linkedin2username replaces that manual enumeration with a single run that produces ready-made lists — first.last.txt, f.last.txt, flast.txt, firstl.txt, first.txt, lastf.txt, rawnames.txt, and a metadata.txt CSV containing full_name and occupation — optionally suffixed with an @domain.xxx address.

Key capabilities

  • Writes seven username-format files per run, from Joe.Schmoe-style first.last.txt through rawnames.txt containing full names like Joe Schmoe.
  • Emits a metadata.txt CSV mapping each full_name to the person's occupation.
  • Appends a corporate domain to every username with -n DOMAIN, for example -n targetco.com producing jschmoe@targetco.com.
  • Filters results by job-function keywords with -k, running a separate loop per keyword to potentially bypass the 1,000-record limit.
  • Attempts to get past LinkedIn's 1,000-result search cap by splitting queries across geographic regions with -g (--geoblast).
  • Controls enumeration breadth and pacing through -d DEATH loops of 25 results and -s SLEEP seconds between search loops.
  • Supports routing traffic through a proxy with -x PROXY and a custom output directory with -o OUTPUT, defaulting to li2u-output.

Who uses it and how

  • Penetration testers scoping an external engagement who need a target-specific username wordlist before attempting credential attacks against a corporate identity provider.
  • Red-team operators who run it against a named company profile — the -c value taken directly from the https://linkedin.com/company/targetco URL — to seed spear-phishing campaigns with realistic addresses.
  • OSINT researchers enumerating a firm's workforce alongside job titles, using the metadata.txt CSV to filter for roles of interest.
  • Testers working against LinkedIn's 1,000-record search ceiling who combine -k 'sales,human resources,information technology' with --geoblast to pull broader populations.
  • Practitioners using a LinkedIn account with many connections — ideally including second-degree ties at the target — because results degrade for accounts with few links to the company.

Getting started

Install uv, then from the repository root run uv sync to build the virtual environment and install dependencies, and launch a run with uv run python linkedin2username.py -c targetco — with Chrome, Chromium, or Firefox available in a standard path Selenium can discover.

How it compares

This registry names no comparable tools against which linkedin2username can be fairly contrasted, and the project's documentation offers no such comparison, so it stands alone here.

When to use it — and when not

You must operate a local browser that Selenium can drive, supply valid LinkedIn credentials, and accept that rate limiting kicks in when the "commercial search limit" is hit, with the possibility of your account being limited or banned. The tool depends on an undocumented LinkedIn interface and explicitly warns it may break whenever LinkedIn changes its site, so it is a poor fit for anyone needing a stable, long-lived pipeline or for users unwilling to risk their own account; the README itself advises reading the code fully before running it.

project readme (upstream, from github) — read inline

linkedin2username

OSINT Tool: Generate username lists from companies on LinkedIn.

This is a pure web-scraper, no API key required. You use your valid LinkedIn username and password to login, it will create several lists of possible username formats for all employees of a company you point it at.

Here's what you get:

  • first.last.txt: Usernames like Joe.Schmoe
  • f.last.txt: Usernames like J.Schmoe
  • flast.txt: Usernames like JSchmoe
  • firstl.txt: Usernames like JoeS
  • first.txt Usernames like Joe
  • lastf.txt Usernames like SchmoeJ
  • rawnames.txt: Full name like Joe Schmoe
  • metadata.txt CSV file which is full_name,occupation

Optionally, the tool will append @domain.xxx to the usernames.

Warnings

Do not blame me if your LinkedIn account gets rate limited, or even banned. This is a security research tool - use it only after reading the code and fully understanding what it is doing.

I have not heard of any account bans since the tool was written, but rate limiting does occasionally kick in when the "commercial search limit" is hit. That has been temporary so far (measured monthly).

Using the tool

Pre-requisites

Install uv, then from the repo root run:

uv sync

This creates a virtual environment and installs all dependencies automatically. Run the tool with:

uv run python linkedin2username.py -c targetco

You'll also need Chrome, Chromium, or Firefox installed in typical paths that can be discovered by Selenium. A web browser will be spawned temporarily to handle the login.

Full usage

usage: linkedin2username.py [-h] -c COMPANY [-n DOMAIN] [-d DEPTH]
  [-s SLEEP] [-x PROXY] [-k KEYWORDS] [-g] [-o OUTPUT]

OSINT tool to generate lists of probable usernames from a given company's LinkedIn page.
This tool may break when LinkedIn changes their site.
Please open issues on GitHub to report any inconsistencies.

optional arguments:
  -h, --help            show this help message and exit
  -c COMPANY, --company COMPANY
                        Company name exactly as typed in the company linkedin profile page URL.
  -n DOMAIN, --domain DOMAIN
                        Append a domain name to username output.
                        [example: "-n targetco.com" would output jschmoe@targetco.com]
  -d DEPTH, --depth DEPTH
                        Search depth (how many loops of 25). If unset, will try to grab them
                        all.
  -s SLEEP, --sleep SLEEP
                        Seconds to sleep between search loops. Defaults to 0.
  -x PROXY, --proxy PROXY
                        Proxy server to use. WARNING: WILL DISABLE SSL VERIFICATION.
                        [example: "-p https://localhost:8080"]
  -k KEYWORDS, --keywords KEYWORDS
                        Filter results by a a list of command separated keywords.
                        Will do a separate loop for each keyword,
                        potentially bypassing the 1,000 record limit. 
                        [example: "-k 'sales,human resources,information technology']
  -g, --geoblast        Attempts to bypass the 1,000 record search limit by running
                        multiple searches split across geographic regions.
  -o OUTPUT, --output OUTPUT
                        Output Directory, defaults to li2u-output

Examples

You'll need to provide the tool with LinkedIn's company name. You can find that by looking at the URL for the company's page. It should look something like https://linkedin.com/company/targetco. It may or may not be as simple as the exact name of the company.

Here's an example to pull all employees of targetco:

$ python linkedin2username.py -c targetco

Here's an example to pull a shorter list and append the domain name @targetco.com to them:

$ python linkedin2username.py -c targetco -d 5 -n 'targetco.com'

Tips

Use an account with a lot of connections, otherwise you'll get crappy results. Adding a couple connections at the target company should help - this tool will work up to third degree connections. Note that LinkedIn will cap search results to 1000 employees max. You can use the features '--geoblast' or '--keywords' to bypass this limit. Look at help below for more details.

Toubleshooting

When LinkedIn changes things, the tool may break. The API used here is not documented, and it may take some fiddling around to get it working again. Please open issues if you notice something weird.

You can verify Selenium works on your machine like this:

$ python3

from selenium import webdriver
driver = webdriver.Firefox() # or webdriver.Chrome()
driver.get("https://linkedin.com/login")

You can try the --proxy flag to inspect traffic with Burp. Right now, it is not inspecting the logins from the Selenium browser as you can see pretty clearly what is happening there.

This is a security research tool. Use only where granted explicit permission from the network owner.

Frequently asked questions

Is linkedin2username free to use?

linkedin2username is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does linkedin2username do?

OSINT Tool: Generate username lists for companies on LinkedIn

What is linkedin2username written in?

linkedin2username is primarily written in Python. Its source is publicly available at https://github.com/initstring/linkedin2username, and it has 1,872 GitHub stars.