An oft-overlooked but valuable method of gathering information about a target is through job sites and job postings. Notice that they can take a lot of forms, but something they tend to have in common is a "statement of desired skills". This is the important detail that we are looking for. If you visit a job posting site and find a company that you are targeting, you simply need to investigate the various postings to see what they are asking for. It is not uncommon to find information such as infrastructure data, operating system information, and other useful data.
A quick perusal through job sites such as Monster.com, Dice.com or even Craigslist.com can prove valuable. This information is essentially free, because there is little investment in time or effort to obtain it in many cases.

When analyzing job postings, keep an eye out for information such as
  • Job requirements and experience
  • Employer profile
  • Employee profile
  • Hardware information
  • Software information

It is common to find labels such as Cisco, Microsoft, Juniper, Checkpoint and others that may or may not include model or version numbers.

Some of theses services will require you to register with them to get the information.