Imagine you are on a red team engagement or penetration testing campaign. After performing footprinting, you got some IP addresses that belong to your target organization. Next, you scanned for any vulnerable services that are exposed to internet. You found some exposed services like SSH, VPN etc but none of them are vulnerable and require authentication.
You tried most common credentials used but that did not work. Next, you decided to try password cracking, but for this you require usernames before trying to crack the password. So, the choices before you are to guess usernames and passwords both or get the most common usernames and then try password cracking.
Most organizations use the name of the employee or a combination or variation of that as username. So, we need to…
