-: In this video, I'd like to show you
how to target a person.
So, we're gonna start with literally just a name,
just a person's name, and then we'll see
how we can gather information about that person,
and then build up an attack strategy as well.
And as we do that, I'm gonna show you some more features
of Maltego and how to configure a few more settings.
So, I'm gonna start a new graph
by clicking on the plus sign right here.
I'm gonna look for personal,
and I'm gonna look for a person.
And right here, we have a person entity.
Now, as I said in this example, I'm gonna assume
that I have a target, and I know their name.
I know their first name, and their second name.
And again, that target is me,
and my first name is Zaid,
and my second name is Sabith.
So, I'm gonna go here on the property list.
I'm gonna set the first name.
Just double-click it.
I'm gonna set it to Zaid,
and then I'm gonna set the surname to Sabith.
And I'm just gonna set this to capital.
Doesn't really matter but just looks better.
Now, let's see what information
can we gather about this entity.
Again, as we usual, all we have to do
is just right-click it, and see what we can get.
So, I'm already in the Paterva category,
and I'm gonna go to all transformers,
and you can see we can get associated emails.
We can transfer this to a radio person.
We can try to get a phone number.
We can try to get a Twitter account.
You can try all of these.
For now, I'm gonna try to get a website
or websites for this person.
Now, this is gonna ask you if you want
to look for a specific domain name.
I'm gonna assume that I know nothing.
So, I'm just gonna put a space in here in both entries.
So, that just means look up for any websites
that are associated with this person.
Now, you can see that we managed
to get a number of websites right here,
and all of these websites
are associated with Zaid Sabith.
Now, that doesn't really mean that these websites
are actually associated with your target,
'cause there could be another person named Zaid Sabith.
So, you'll have to go on each one of these,
and see which ones actually are related to that person.
For example, if we click on the Facebook here,
I'm gonna double-click it to see what information is there,
and I'm gonna go on the properties,
and you'll see that we have the Facebook URLs
that are associated with that person with that name.
Now, I'm gonna copy all of these,
and I'm just gonna put them in a text file,
so we can read them better.
And you can see we have three profiles.
Now, in a real life situation, you should be going
into each of these profiles, and see which ones
actually are related to your person.
I'm not gonna do that because the three of them
are actually not related to me at all.
So, this is really not useful, and you'll just move in.
In this case, you'll just come back,
move into the next entity, and see what's useful.
And I highly recommend you delete the ones
that are not useful, because they'll just make it harder
to look through things.
So, you can just click it, press delete,
and that'll delete it for you.
Now, the LinkedIn profile right here again,
you can double-click it,
and see which profile it links you to,
but again, it's not my own profile,
and you can see that once you actually go through the URL.
So, for now I'm just gonna delete that.
And you can see the rest of the stuff in here
is actually all related to me.
So, it's all related to your target,
and you can try and double-click each one of them,
go to the properties, look for the URL,
and open it in your browser.
When you do that, you'll get the information
that's related to that person,
and hopefully it'll help you to form some sort
of an attack strategy or help you get even more information.
For now, because I've already looked on all of them,
I'm gonna focus on one of them which is the udemy link,
so the information related to me on udemy.
I'm gonna double-click this like we did before,
and I'm gonna go on properties,
and you can see that we have a URL or description here.
I'm gonna copy that.
I'm gonna put it in my text file right here,
and I'm just gonna copy the URL,
and open it in my browser right here.
So, you can see that this URL is related
to our target person, and you can see
that it's leading us to a course that's taught by myself.
Now, this is not really useful.
We can see that the target person
is teaching online courses.
Whatever, not very useful.
But if we go back and look at the other URLs.
So this had two URLs if I scroll back to the left,
we can see we have the first URL right here,
and this URL is my profile URL.
So, I'm gonna copy it again, and paste it in the browser.
And you can see this is showing us the profile
for the target person.
You can see that it's the same name.
You can see their picture, so you know this is your target.
You can see a description about what they do,
but you probably already know that,
but you can see some useful stuff.
For example, you can see that they used to work
with a company called iSecurity.
So again, you can go to what we did previously.
Research iSecurity, add their website as a target,
and then gather all the information that we were able to do,
and then use that to build up a strategy against Zaid.
Now, we're not gonna do that
because I've already done something like that.
So, we're gonna try to see
what other information we can get.
What's really useful in here, we can see that the person
is sharing a few links.
So, they're sharing their YouTube channel.
They're sharing their LinkedIn profile.
They're sharing their Facebook,
and they're sharing their own blog.
All of these, you can go ahead and browse all
of these things to gather more information
about that person.
Now, you need to keep in mind that I'm setting my target
to myself, which is an aware person
about computer and information technology,
and even the target I targeted
in my previous video, iSecurity.
It's an information technology company,
and even with that, we were able
to gather so much information.
So, when you're targeting normal companies or normal people,
it'll be so much easier to get effective information.
So right now, if you actually go look at the YouTube,
look at the LinkedIn, and look at the Facebook,
you really won't get much.
Like, even if you click on the Facebook,
you'll see the Facebook won't lead you to anything.
You need to log in, and even after logging in,
you won't get too much useful information.
What's useful in my case is if we go on the blog,
and we're gonna go to the about,
and what's useful in this,
is we have the email address of the target person,
and we have their Twitter account,
so this information were not included on udemy,
and now we have two really useful pieces of information.
So, in the next video,
we'll see how we can use this information
to gather even more info about our target,
and hopefully be able to build up an attack strategy.