The word lists provided with InSpy are just text files. The one we are using is a list of
titles. The following is a subset of one of the word lists. If a title is not included in
either of the title word lists (the difference is the length), you can just add them to the
file.
chairman
president
executive
deputy
manager
staff
chief
director
partner
owner
treasurer
secretary
associate
supervisor
foreman
counsel
As mentioned before, you can search things like job listings for technology used by a
company. The same is true for LinkedIn listings. Because the profiles are essentially
resumes that people will sometimes use to submit for job applications, details are
often included about the responsibilities of a particular person in any given position.
Because of that, we can potentially get a list of technology in use at a company. This
can also be done using InSpy. Whereas before we were using the empspy module, we
will use the techspy module this time. The command syntax is the same. All we need
to do is switch out the module and the word list. You can see this in
Example 3-5
.
Example 3-5. InSpy using the TechSpy module
root@rosebud:~# inspy --techspy /usr/share/inspy/wordlists/tech-list-large.txt oreilly
InSpy 2.0.3
What InSpy is doing is searching for the company name and then looking for refer‐
ences in the profiles to the different technologies listed in the word list. One thing to
note about InSpy is that it isn’t currently installed by default in Kali. To be able to use
it, I needed to install it.
Recon-NG
Although Recon-NG is also about automating data gathering, it’s deep enough to get
its own section.
Recon-NG
is a framework and uses modules to function. It was devel‐
oped as a way to perform reconnaissance against targets and companies by searching
through sources. Some of these sources will require that you get programmatic access
