A Beginner’s Guide to OSINT Investigation with Maltego
Maltego Disclaimer: The company clarifies that their software may not be used for unlawful actions: “You are not limited in how you can use the software but you can’t use it for unlawful actions (including collecting email addresses for sending spam). Same goes for the data or graphs you generate using it.” They also add: “You cannot blame us in any way if something goes wrong with this software. If you use this software and you get into trouble in any way then it’s your problem.”
What is Maltego and why use it for OSINT?
Maltego is a data mining tool that mines a variety of open-source data resources and uses that data to create graphs for analyzing connections. The graphs allow you to easily make connections between information such as name, email organizational structure, domains, documents, etc. Maltego uses Java so it can run on Windows, Mac, and Linux and is available in many OSINT Linux distros like Buscador or Kali. Basically, it will parse a large amount of information and search various open-source websites for you and then toss out a pretty looking graph that will help you put the pieces together. Maltego can be used as a resource at any point during the investigation however if your target is a domain it makes sense to start mapping the network with Maltego from the start.
Which Maltego version should I download?
There are several versions of Maltego available:
• Maltego XL- Premium version for large data
• Maltego Classic- Pay version which includes all APIs (transforms)
• Maltego CE- Free Version with limited APIs (transforms)
• Casefile- For examining links in offline data
The main difference between Maltego Classic, Maltego XL and Maltego CE are the number of entities that can be returned from a single transform and the maximum number of entities that can be on a single graph.
For our purposes here I will be using Maltego CE which is a free version with limited Transforms. Maltego comes pre-installed in the Buscador Linux distribution which is typically a favorite of Open-Source Intelligence investigators.
Installing Maltego
Buscador: If you have Maltego via Buscador it will initially present as the Casefile version. You will need to go to the Maltego site and create an account. Once your account is created you will receive a key which will turn your Casefile into CE.
Kali: Maltego comes pre-installed on Kali. You will need to go to the Maltego site and create an account. Once your account is created you will receive a key that will allow you to use the Community Edition.
Fresh Install: If you are doing a fresh install on Win, Mac, or Linux here is a step-by-step guide provided by Paterva.
What is all this API/Transform nonsense?
An API is an Application Programming Interface and in very simple terms it is what connects other software like Shodan and Threatminer with Maltego. Maltego calls these connections “Transforms” and if you are running Maltego CE you will find that some transforms are free while others are pay. The downside of running the free version of Maltego is that not all of the transforms come pre-installed, therefore, to use them you will need to sign up on each website to get the API code to activate the corresponding transform. Depending on your needs, you can focus on specific transforms made for OSINT, Threat Intel, Organization mapping, etc. which will limit the amount of legwork you need to do for activation.
How to perform simple network recon
Starting with a domain name we can begin to map out the structure of an organization including other sites they own. It is surprising how much information can be found by using nothing more than a domain name.
Click the new graph button in the upper left corner and a blank new graph pane will open.
From the Entity Palette on the left, scroll until you find Domain and then drag it into your blank graph pane.
Double click on the domain icon and change the name to the domain you want to investigate, I chose hbo.com.
Right-click on the domain icon, this opens the Run Transforms box. Here you could be very specific about what you want to search for by scrolling through the palette and selecting but we are going to go crazy and just choose Run All Transforms by selecting the little fast forward arrows beside it.
As soon as Run Transform is selected, Maltego begins its work by graphing out the structure of the network. Note: on the left side of the graph pane there are several options for viewing the graph in different layouts.
You can see in the image below that all sorts of information pops up including DNS servers, related sites, related emails, email servers…
You can use these connections to make even more detailed connections like names associated with emails and phone numbers.
Let’s take a closer look at one of the people that showed up connected to hbo.com “Thomas Peterson.” Right-click on Thomas’s icon and run All Transforms.
When the transforms finish running, we will have an added graph of all of Thomas Peterson’s associated emails.
Sometimes this can lead to some strange findings. I have stumbled upon a lot of funny/hidden emails while doing similar searches.
How to run an email address in Maltego
I was curious about Thomas’s Rick Grimes Tormail address so I decided to take a closer look.
Create a new graph the same way we did in the previous step. This time, select Email Address in the Entity Palette and drag it over to the empty graph.
Double-click on the email address icon and change the text to the email address you want to search. In this case, I used “realrickgrimes@tormail.org”
Right-click on the email address icon and run All Transforms by selecting the fast forward arrows.
After the transforms run, a graph will pop up displaying all the connections to the address. You can see here that realrickgrimes@tormail.org connects to a person “Rick Grimes” who then connects to several other emails. I was intrigued by Rick’s connection with carl.grimes1995@gmail.com so I decided to run another all transforms on that email.
Carl.grimes1995@gmail.com led me to several more interesting people like Carl Grimes and Steve Brule. I feel a bit like I am getting sucked into a black hole of Walking Dead references so I run a Transform on Steve Brule.
Steve Brule leads me to steve@checkitout.com and steve@brule.com as well as the site checkitout.com.
I tried visiting the site but it wasn’t active so I did a quick WhoIs search. The WhoIs search came back registered to CSC Global which runs a digital brand services and domain management company.
The previous registrant was the Hearst Corporation
At this point, instead of continuing down the Steve Brule rabbit hole, I am going to assume the Hearst organization and now CSC is holding the domain either to protect it from misuse or to resell it at some point.
As you can see, there are a million fun things you can do with just a simple domain and email search within Maltego! Test drive Maltego yourself by searching your own email address or web address and see what connections you can make. Take it one step further and try searching for your phone number to see how it can be linked to you.
Check out my tutorial for Lampyre if you are looking for another Windows-based solution for email address recon and graphing.