Hey there, welcome to the Technical Information Gathering
with Maltego CE. In this course, we'll talk about one of my
favorite tools, the Maltego,
which is really useful to automate information gathering.
So if you've worked on writing an engagement before
or even in penetration testing,
you know that the first and most important step is to gather as
much information as possible about our target.
This is really important because usually the
vulnerabilities are not in the main websites.
They are usually in the small,
hidden subdomains that people forget to patch. Usually, in a
red team engagement, we need to gather subdomains, DNS data, IP
addresses, technology information, people information,
email addresses for phishing, and much more.
In theory,
we can find this information manually by executing
some queries and doing some searches.
However,
what if I told you that I can get all this information with the only two clicks?
For example, what if I tell you that if you give me a domain,
I can find out this information in only two clicks? And even better,
what if I tell you that if with two more clicks,
I can draw down even more on this information to
find more details about our target.
That sounds pretty interesting, right? The automation capabilities and the user
interface is what I love about Maltego. As you've seen in our demos, without
needing to type a single comment, I can get all the information that I mentioned
the previous slide in just a few seconds.
Maltego is an open‑source intelligence gathering tool that
also provides graphical link analysis.
This tool is really known by red team specialists,
as well as incident investigators and forensic teams.
Also,
a lot of law enforcement agencies use Maltego since it
makes investigations way easier.
The tool is developed by Paterva, which is a South African company,
and it constantly releases updates and interesting new features.
Also,
there's a large community around this to, meaning that several third‑party
companies release plugins that expands Maltego's capabilities.
Those plugins are called transforms, and we'll talk more about them later.
What I love about Maltego is that it can download the
Community Edition version for free.
This means that you can do tons of investigations and
information gathering without spending any money.
However,
the free version has some limits in terms of the
number of results that it can get.
So, if you're using this tool for large engagements,
you should get the paid version of the tool.
As I mentioned before,
Maltego is one of the most used tools for OSINT investigations,
which stands for open‑source intelligence gathering.
With Maltego,
we can get tons of publicly available information in one single place.
And the best part is, we don't have to type a single comment.
For this reason,
Maltego is used by large companies, as well as government agencies.
And the secret behind Maltego is there are transforms.
Basically, those are plugins us that, given one piece of information,
it is able to find tons of other related information.
So, let me give an example so you can understand this better.
Imagine you have one domain that you want to get more information about.
So then, we create one node in Maltego with the domain
name that I want to investigate.
In our case,
let's say we want to investigate the domain,
Globomantics.com. So then, I can right‑click on this node
and run a transform called get subdomains,
and this will run several searches on the background and retrieve
all the subdomains for that specific domain.
Once the results are retrieved,
each subdomain will be another node object, and this means they can
right‑click on one of those and get more information about it.
For example,
I can right‑click on the ftp.Globomantics.com and run a transformer
called get IP addresses. In this way, Maltego will go and get the IP
addresses for that specific subdomain.
And then again, each IP that was found will be a node in
the graph, and this means that we can right‑click on the
IP and run another transform.
For example,
I can run a transform to get all the open ports for that specific IP.
And from here, I could right‑click on the port and run even more transforms.
But you got the idea, right?
What we have to remember is that once you have one piece of
information, which is a node in the graph,
we can run a transform and get even more information about it.
And this is valid, not only for technical information, but
also for people information. For example,
for the Globomantics.com domain, I can run a transform and find the
key people in the company. And then, from the people, I can run
another transform and get their email addresses.
And from the email addresses, I get tons of other stuff. That's pretty cool,
right?
As you see in this course,
there are a lot of transforms that will help you to gather any kind
information from DNS addresses to phone numbers.
Actually, up until now,
Maltego has more than 100 transforms, and they always release new ones.
If you're familiar with the red team kill chain, we can map Maltego
through a Recon phase of this process. With Maltego,
we can gather tons of technical and non‑technical information about our target.
Also, if you map this course to the MITRE PRE‑ATT&CK framework,
you note that in here we cover two main areas,
Technical Information Gathering and People Information Gathering.
Inside of Technical Information Gathering, we'll cover two techniques.
The first one is conducted passive scanning,
in which we use Maltego to get information about our target
without actually probing any servers in our target.
Also, we'll cover determining domain and IP addresses,
which is the technique T1250. From the People Information
Gathering area, we'll cover how to identify people of
interest, which is the technique T1269.
And those are just some of the areas that Maltego can uncover.
With this tool, we can perform active scans,
gather email addresses, gather phone numbers, and much more.
So before going to our demo,
let's take a minute to understand what I'll be doing here.
First,
let's say we're in a red team engagement, and we need to gather
information about the Globomantics.com domain. From this domain,
we use the Maltego transforms to get a list off all the
subdomains. And from the subdomains,
we use another transform to get a list of all the IPs on each subdomain. And
also, in terms of People Information Gathering, we use the Maltego transform
to get a list of the key technical people.
And from this list of people, we will gather the email
addresses. And just to have some fun,
we can use another Maltego transform to find if any of those email
addresses were seeing previous data breaches.
That's interesting, right? From the list of subdomains, we can try to find
vulnerable services that we can try to exploit. Or if you find any email
address that was leaked in previous data breaches, we can try to use the
leaked password to get into the account. For this lab, the only thing you
need is the attacker machine.
As Maltego runs on pretty much any operational system,
you can use a Windows machine, a Linux machine, or even a MacOS machine.
So, enough of talking.
Let's go to our lab environment and gather some information about our targets.