TechKnowSurge
TechKnowSurge Catalog Videos Social Media Scraping
VideoSecurityFree

Social Media Scraping

Social media scraping is a reconnaissance technique used to gather intelligence on target organizations by harvesting publicly available data from platforms like LinkedIn, Facebook, Reddit, and job boards. Exposed employee details, job postings, and unintentional disclosures can all be leveraged to identify high-value targets and support social engineering attacks.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Social media scraping is an open-source intelligence technique in which publicly available data is systematically harvested from online platforms to gather actionable information about a target organization. Because companies and their employees routinely share details about roles, responsibilities, projects, and technology stacks across platforms like LinkedIn, Facebook, Instagram, Reddit, and TikTok, a significant amount of sensitive organizational intelligence is accessible without any technical intrusion. Job postings alone can reveal internal tooling, infrastructure details, and team structure that would otherwise be difficult to obtain. Unintentional disclosures, such as employees sharing internal processes or confidential details in public posts, represent an additional and often overlooked exposure vector. From an attacker's perspective, the primary goal of social media scraping during reconnaissance is to identify high-value targets within an organization, including executives, administrators, and technical personnel who can be impersonated or manipulated through social engineering. By correlating data across multiple platforms and sources, an attacker can construct a convincing pretext, for example, posing as an IT professional to deceive an administrative employee into granting access or revealing credentials. Understanding how this intelligence is collected is essential for security professionals tasked with reducing an organization's external attack surface and educating staff on safe information-sharing practices.

What you'll learn

What's covered

Social Media Scraping

Key terms

Reconnaissance
The first phase of an attack in which an adversary gathers information about a target — such as open ports, employee names, and technology stacks — before launching an attack. Reconnaissance can be passive (using public sources) or active (directly probing the target).
Social Engineering
A manipulation technique that exploits human psychology to trick individuals into revealing confidential information.
Threat Actor
An individual or group responsible for a security incident or attack.
Open-Source Intelligence
OSINT
Open-Source Intelligence is the collection and analysis of publicly available information from sources such as websites, social media, and public records to support cybersecurity investigations, threat intelligence, and penetration testing reconnaissance.
Spear Phishing
A targeted phishing attack directed at a specific individual or organization using personalized information.
Attack Surface
The total set of points in a system where an unauthorized user can attempt to enter or extract data.

Topics

Social Media Scraping Osint Reconnaissance Social Engineering Threat Intelligence Cybersecurity

Transcript

Another way we can get some really valuable information is social media scraping: looking at all sorts of social media sites and scraping them for data. Nowadays we're more connected than ever, and we're constantly posting information about our companies and about ourselves, and that is a security hole. Of course, we want to make sure people understand what our services are and what we're delivering, but there is also a way that we can target a company and start researching into that company and get some real valuable information.

What we're looking for

One of the things that we could be looking for are different contacts within the organization. Maybe it's employees within the organization. Maybe it's somebody in management or administration that would be a high value. Maybe it's some sort of technical person that we could impersonate to do some sort of social engineering, so that way we can impersonate a technical person to try to trick somebody in administration.

So we can start identifying targets within the company, and we can look at job postings and LinkedIn and that type of places to look at job roles and responsibilities. If we get lucky, then we can find some sort of unintentional disclosure. There are many times when there are secrets that are leaked from a company through social media.

Where we look

So what are we going to be looking at? There are a lot of different sites and a lot of different tools that we can be looking at:

  • blog posts
  • job boards
  • LinkedIn
  • Facebook
  • Instagram
  • Reddit pages
  • TikTok
  • marketing slides

And there's a ton more. Any kind of social media sites where we can find out information about the company.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →