While running a social engineering campaign, a penetration tester gets a list of employees from social media and now wants to conduct a phishing exercise. Which of the following should the tester…

The correct answer is B. Hunter.io. After obtaining employee names, the immediate next step for a phishing campaign is often to discover their email addresses. Hunter.io is a service that helps find and verify email addresses for people at a domain (pattern discovery + verification). Using Hunter.io (or similar…

Submitted by emma.c· Mar 6, 2026Reconnaissance and enumeration

Question

While running a social engineering campaign, a penetration tester gets a list of employees from social media and now wants to conduct a phishing exercise. Which of the following should the tester use first?

Options

AWayback Machine
BHunter.io
CSpiderFoot
DSocial Engineering Toolkit

How the community answered

(26 responses)

B
88% (23)
C
8% (2)
D
4% (1)

Explanation

After obtaining employee names, the immediate next step for a phishing campaign is often to discover their email addresses. Hunter.io is a service that helps find and verify email addresses for people at a domain (pattern discovery + verification). Using Hunter.io (or similar tools) lets the tester build an accurate recipient list before crafting phishing content or campaigns.

Topics

#OSINT#social engineering#phishing#email address discovery

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice