A penetration tester is designing a phishing campaign and wants to build list of users (or the target organization. Which of the following techniques would be the MOST appropriate? (Select TWO)

WHOIS database queries return domain registration and organizational contact data, not a list of individual employee usernames or email accounts.

Job listings reveal roles and technologies in use but typically do not enumerate specific current employees needed for a targeted phishing user list.

Scraping the company website may surface a few staff names from pages such as 'About Us,' but it is far less comprehensive than social networks or direct social engineering for building a full user list.

Social networking sites such as LinkedIn expose employee names, email formats, roles, and organizational structure, making them ideal passive OSINT sources for enumerating users at a target organization.

Socially engineering the corporate call center can directly elicit employee names, departments, and contact details from staff who may not verify the caller's identity, yielding verified user information.