Hey there, welcome to our lab environment.
In this demo, I'm using the Kali Linux version 2020,
and I like to use Kali Linux because it already comes with Maltego preinstalled.
But as I mentioned before,
Maltego can be executed in pretty much all operational systems.
So if you need to install on your computer, it's very simple.
Just go to the maltego.com website, and then navigate to the Products,
and then under the category Community, you click on Downloads.
In here, you can select which operational system you have and download the file.
And as the installation is pretty straightforward,
I'll not be covering it here. But once you install Maltego,
you can go to your launch menu, and open Maltego.
Perfect.
If it's the first time you're using this tool,
you will see this screen here. In here we can select
which version of Maltego we want to run.
In our case, it is the Maltego Community Edition, or Maltego CE.
Once I select this option, I'll get a license agreement.
I'll have to click on Accept and press Enter.
Then, you need to enter the login information for the
tool. If you don't have a Maltego account,
you can clicking on this link to create one. As I already
have one account, I'll use it here.
Perfect! It works. Now, Maltego will start to install some
of its features. In here, it just asks you to confirm
everything that will be installed.
All we have to do is click on Next, and then Next again. And in here, we
select if we want to run Maltego on stealthy mode,
which means Maltego will not query any IPs directly. But in our case,
as we're not doing anything illegal here,
I'll use Maltego in the normal version.
So then I click Next. And after that,
Maltego asks us what to do next. As we know what we're doing here, I
will just select the last option, Go away, and then click on Finish.
Perfect. In this home screen, we have on the left the Maltego
announcements, and on the right side,
we have a list of all the transforms that we can install in Maltego. And
remember, transforms are kind of like plug‑ins that expand the
functionalities of Maltego, but we'll discuss that later.
So, let's start by the beginning.
Let's create the new blank project by clicking on this button here.
Awesome, this is the Maltego work screen. On the left side,
we have a list of entities that we can create in Maltego. And
basically, entities are the nodes on the graph. For example,
a domain is an entity, a person is also an entity,
and even a website is an entity.
In my case, I will add the domain entity to my graph. For that, I'll simply
drag and drop the domain entity to my workspace. Perfect. In here, I'll
double‑click on the domain name so I can edit it. Now, let's say I'm trying to
gather information about the nasa.gov domain.
So I would just type it and press Enter.
There you go.
Now I have one node in my graph. From here, I can run several transforms to
get more information about this domain. For that, I will right‑click on the
domain name to get the list of all the transforms available for this kind of
domain entity. And to run a transform,
I simply need to click on the name of the transform.
For example, let me click on this To DNS Name ‑ name server.
What this transform will do is to find out all the name servers related
to that domain. Done. As you can see, in few seconds,
we found the name of the name servers related to NASA.
Also, if you take a look here on the Transform Output in the bottom,
you will see the results of our transforms.
It says that it was completed and returned few entities.
Also,
we can delete entities from the graph by selecting
them and then pressing Delete.
And then we just need to confirm that we want to Delete. Okay,
enough of introductions.
Now let's start our red team scenario.
So, what we're trying to do is to collect technical
information from the nasa.org domain.
So, the first thing that I usually do is trying to find
all the subdomains from our target.
And for that I'll run this transform called To DNS Name from Robtex. And
basically, this will check the Robtex database and return all the
subdomains for NASA. And this may take a couple minutes,
but to save your time, I'll speed up this video.
Perfect. Done.
As we can see, we have here 12 subdomains. And remember,
the Maltego Community Edition is limited to a
maximum of 12 results per transform.
And this means that most likely there are tons of other subdomains for NASA.
But take a look, we found some interesting ones here.
Look at this one, admin.nasa. That's a promising one. But usually, I
like to go for the least common subdomains, and that's because people
usually patch the most important targets,
but they forget to patch the small ones.
So, for example, in this case,
I would be interested in this one called 3d‑printing.nasa.gov.
So, let me find the IP addresses for this domain. For that,
I will right‑click on the DNS record and then select this
transform called To IP Address.
Awesome.
Take a look, we got the IP address for this DNS record. And from here, I can
even run another transform on this IP. For example, I can find the location of
this IP by running this transform To Location.
And, as we can see, this IP address is located in the United States.
Cool.
That's a really good start.
But let's explore some more in‑depth information gathering.
For example,
let's take this DNS record here called aeronautics.nasa.gov. From
here, I will right‑click and run this transform called To Web site,
and this will do a small port scan on the DNS record to find which
websites are hosted in there.
Perfect.
Take a look.
We have this website here, aeronautics.nasa.gov.
Now, let's try to find out which technologies this website uses.
For that, I can right‑click on this website and run this
transform called To Server Technologies.
And what this transform will do is it's scanning the website
and trying to identify all the technologies that are used in
there. Perfect. Take a look.
Now we know all the technologies used in there.
For example,
we know that this website was made using Drupal, and from here I could
search for a Drupal vulnerabilities and try to exploit them.
And that's pretty cool, right? In less than 10 minutes,
we found tons of subdomains about our targets, and we also found tons of
IP addresses, and even the location of the servers during scope. In here
we even found the technology used in the websites that can be used for
exploitation later. And all this information we got without typing a
single line of code.
And that's why I told you that Maltego is one of the most used tools by
red teamers. All the information we got here is using public sources of
information, so it's not illegal doing this.
But again,
don't try to hack into NASA. For example, don't try to exploit a
vulnerability in there because then you'll be doing something
illegal, and you'll be arrested in no time! Okay,
once we have our information,
we can save this project by clicking on the Save button. And then we
just have to put a name on it and click on Save.
And with this, we can close this screen and later come
back to work in this project if we need!