Guest blog by Michael Paulie.

Throughout investigations, working ongoing missing persons cases with organizations like Trace Labs, or having fun with CTFs, LinkedIn can be a valuable source of information on people of interest.  Information including email addresses, phone numbers, work locations and friends, family, and colleagues are just some of the data that can be obtained to pivot off of.  However, unless you have some connections on LinkedIn, which bring you into others 2nd or 3rd degree networks you will not be able to see information on their profiles.

Once you’ve created a persona for a sock puppet and email address, see this article on OSINTCurio.us or this wonderful write up and flow by @jakecreps, creating an account in LinkedIn is fairly quick and only requires email verification. Here are 4 quick steps to get your account into the networks of others on LinkedIn.

Build Out Your Profile

If you want connections there will need to be some effort put into the profile to be believable, especially when you are starting with 0 connections. I like to pick a profession such as Project Management because a Project Manager title can easily blend into the sea of other PMs at large organizations. Add a couple jobs, university, and a relevant certification or two like PMP or Agile.  I will then search out and request to join a few groups specific to the profession and certification. These groups will normally add you without even noticing that you have zero connections.

Set your profile as “Open to work”

This tells recruiters that you are open to discuss jobs that you might be a fit for and makes it more likely for them to connect with you.

Join LION Groups

Now that you have a nice well rounded profile, it’s time to make some connections. LION stands for LinkedIn Open Networkers and are people who have declared they are open networkers for reasons such as marketing, sales, business connections, or for the sake of having the most connections. No matter, these people are your gateway to making your LinkedIn account useful. Search LinkedIn for “Lion” in groups and request membership to at least 10 of the LION groups you find with the most members.

Within a day I am usually accepted to one of these groups with zero connections on my profile.

Start sending connection requests

I like to start connecting with the top posters in the group first as they are the most likely to quickly hit accept on the request.  So scroll down the group posts and start connecting. You’ll also be able to click “See All” under members and start requesting connections.

Tip: Add connections from the geographic location you will most likely be working in as this will get you into your target networks faster.

Within a few hours you should start to see requests accepted. At that point to speed things up you can now go to one of your connections and see a list on the right of “People you may know” and quickly click “Connect” on everyone there.

In a day your account should be well on it’s way to making the connections you need for your OSINT investigations, though it will take some time because LinkedIn free only allows a certain amount of connection requests per week. By the end of the first day this fresh account went from 0 to 34 connections using these steps.

From here you can continue with the LION groups or better yet, the groups in your profession or those of your targets. Happy networking!