How can I get someone's email that I know without simply

Hack their mainframe

Option 1: Social engineering, which is not something you should be asking /g/ about

Option 2: if you know they have any websites, check if they're registered under their email address via whois.

Option 3: if you know any account names of theirs, google them to find matches on other sites and look for an email address listing on them. If you find alternate usernames on those sites, search them too.

Option 4: send them a site they'll need to sign up for that you either own or can view most recently created accounts on. Site needs to require an email address and will either make it public, or will be known to you with your level of access. Obviously they'll need some reason to visit the site, like an interesting news story or some shit they're interested in.

>>61277705
>>61277818
This or sniff their connection, I assume you're a bit experienced in pentesting if you have these so-called bad intensions.
Otherwise fucking google it and install Kali live