Welcome back to our Kali Linux virtual machine.
Now, let's continue our red team job.
Let's take a look at how we can find more information
about the people that work in our company.
So I'll open a new project. In your case,
you can create a new project,
or you can even continue the one that we created in a previous demo.
In here, I'll start by creating a domain entity and adding our target domain,
which is nasa.gov. Now, let's try to find interesting
email addresses for this domain.
So first I'll run this transform called To Email address [From whois info].
Basically,
this will connect to the whois information and get the
email addresses registered in there.
As you can see, we found two email addresses which are really interesting.
Especially this one, soc@nasa.org. But I'm not satisfied yet.
Let's try to find more email addresses.
So back to the transform list, I will select now the
transform called To Email addresses from PGP.
Awesome!
That's much better.
We found 12 email entities. And, again,
12 is the limit of the free version of Maltego, so probably there are several
other email addresses out there. I could have simply used those email
addresses for some phishing or spear phishing emails.
Also, just to make sure I got everything,
let me run this last transform called To Email address from search engines.
And I'll take a look.
There's an error here on the transform output. Here it says that this kind of
transform is only available on the paid versions of Maltego. But that's fine,
we already have plenty of information here.
Let's say that I've done some extra investigation and I found some other
email addresses that are not in here. For that, I can create a new email
addresses entity by dragging it and dropping it to my workspace. In here, I
will double‑click on this and enter the email address that I found, which is
john.smith@nasa.org. Awesome.
Now,
one thing I like to do in a red team engagement is to find
out if the people in the company had their password breached
in other places. For example,
let's say they use their email account to log in to adobe.com, and then
Adobe gets hacked and the data gets leaked on the Internet.
So then we can try to find on the dark web the passwords for that
account, and if the person reused their password,
we can get access to some of their accounts using the leaked passwords.
So let's say I want to know if John Smith had his account
previously compromised. As you can see on the list of
transforms, there's nothing here like that,
but we can install a plug‑in that will allow us to get that information.
So let's go back to the home page, and then scroll until we find
this plug‑in called Have I been Pwned. This plug‑in basically
connects to the Have I been Pwned database,
and let us know if this email was seen in any data breaches?
To install this plug‑in, all I have to do is hover my mouse
over it, and then click on the button Install.
And after confirming the installation,
Maltego will install several new transforms related to
it, and then, when this is completed, we can just click on Finish. Perfect.
Now, we can go back to our Nasa graph,
and here let's right‑click on the same email address. And now,
as you can see,
there's a transform here called Get all breaches of an email address.
Once I click on this,
it will research across several data breaches to see if
this email address was in any of those.
Awesome.
Now, take a look, this email address was in five different data
breaches, and this is getting really interesting.
If you want to get more information about a specific data breach,
I can just right‑click on it and select Enrich breached domain.
Perfect.
Take a look.
We have a description of the breach here.
Apparently,
there were more than 100 million records that were breached in this case,
and that's a lot.
And if we scroll down a little,
we can see what kind of data was breached. And take a
look, it seems that passwords were found on this breach,
and that's really interesting.
This means that if you find on the dark web the data related to this breach,
I can then find the password for this account, and if the
person reused this password in other places, it will be really
easy to get access to their account.
That's pretty cool, right?
But again,
don't do this against an account that you don't have
authorization. Entering someone's account is illegal,
so don't do that.
Don't be a criminal.
But the cool part is,
is that in less than 5 minutes we were able to find tons of information
about the people that work for this company, and even found that some of
those accounts were compromised in previous breaches.
And from here, you could send phishing emails to those people, or
even try to find their credentials in the dark web.