In this video we're going to take a look at Maltego.
Maltego is another crawling tool and it's pre-installed into our version of CSI Linux.
Maltego is generally regarded as one of the best tools out there for open source intelligence and reconnaissance,
so let's take a look at it.
So in my CSI Linux instance here, and we can see this little circle here with the three circles.
I'm going to open that up here.
And there's a couple different versions of Maltego.
Now the one we're going to use is the free version, the C.
Um, there's also paid versions and there's, uh, case study and a few other tools.
But again, we're going to be using the free C version for this.
And if you're doing heavier scans you'll probably want to pay for a license.
However the the community edition works pretty well for most scans.
And also you can end up paying for some of the modules, which we'll take a look at momentarily.
Now for Maltego, you will need to sign up for an account.
I already signed up and signed in to save a little bit of time.
I'm going to accept the agreement here and it looks like it signed me out.
Somebody signed in real quick.
Okay, let's see if that works.
Incorrect capture.
Okay, now let's try that again.
Capture was incorrect.
Okay, so never a big fan of captchas, but they are what they are.
So we're signed into Maltego.
I'm going to click next and finish.
I'm going to leave that default.
Now, once you finally log in to your version maltego you, it'll ask you do you want to?
Uh, start a new version.
Do you want to.
Do you want to go through tutorial?
Do click the bottom option where it says, I've done this before.
Leave me alone because we're going to go through this now.
Maltego uses what's called transforms.
And if we scroll down here, we can see all these different modules here that we could use DNS twist.
We could see the standard transform.
Some of these are going to be installed.
Some won't.
If you mouse over here you can see uninstall or install.
And they had some really cool stuff in here, like alien vault, case file entities, uh, census cipher,
CrowdStrike, Intel and some of these are paid, some are subscription and some are free also.
And some are going to require API keys for you to put in there.
So we're going to leave it pretty much default for now.
Uh, if you want to install more stuff later, you're more than free to.
And there's a lot of cool stuff in here, like Google Maps geolocation.
I'm going to click install so you can see how it installs.
It's pretty simple.
Once you click on it you can see information about it.
So that's the details I'm going to click install.
Do you want to install this I'm going to say yes.
And if it needs additional information it'll ask you you know what's a API key.
What's this or that.
But in general it's pretty easy.
So let's go ahead and create a train.
Uh, set up a scan here.
So on the upper corner here we can see this create new graph I'm going to click on that.
Okay.
And by default we can see a lot of different things in here.
And Maltego did some big updates since the last time I really used it.
Uh, one of which they put a lot of cryptocurrency stuff in here so we could search by Bitcoin cash
address, uh, Bitcoin cash block, block height, cash transaction, Bitcoin address, cryptocurrency
dog coin, Ethereum like coins.
If we scroll down to here we could do conversation by emails phone dates incidents.
We can look by organizations, Netblock, CVS, DNS names, domains.
So a lot of really cool stuff in here.
And you just need to kind of scroll through here and find what you want to do.
And we see build within here and email address.
So let's take the email address to use.
I'm just going to click it and drag it here.
And there's our transform.
So if I click on here I'm going to just change this to some generic name John Doe at gmail.com I'm going
to click okay.
And if I right click this you can see Extract properties find Entity properties person from email address
related email addresses machines and depending how many modules you have installed here, this list
is going to expand.
So I'm just going to click on all transforms.
And it's going to ask you some of the required inputs.
I'm just going to click remember I'm going to leave everything default and click okay.
And we can see down in here it's actually outputting information here.
Okay.
And as we see from this email address is beginning to find different things.
There's a Gmail account here.
There's another Gmail account here that looks like it's linked to, and we could see different.
John Doe relates back to there we see John Gotti.
And you could do relationship details on here.
See if there's any looks like that that person has a John Doe Gmail and so on and so forth.
So we could either zoom in or use the mouse wheel, zoom out.
If there's additional things.
We want to look at things like this one here we could right click on this.
And we could do all transforms again and again.
Depending on which modules we have here, we could potentially find social media accounts.
We could find uh Bitcoin addresses.
Start tracking that Bitcoin word's going.
We could find uh files related to websites.
We put a website in there.
Or if that email ties to a website, we could potentially find that.
Also, if you tie in the social media account, uh, modules, we can start finding social media accounts
tied to this email.
But again, this is just a very basic, uh, look at, at, uh, how how, uh, maltego works.
So it's a really cool program.
And again, once it finds something of interest, you just need to right click on it.
And then you could do all transforms or you can start picking which transforms you want to run Dateline
DNS, email address within the properties, etc..
And once you have all the information that you want, you always can export this stuff out too.
So if I click up here on this, on the image here, I can do export and I can export as a configuration
entities.
Uh, a graph table exported the image export as XML, I can generate a PDF report, etc..
So really handy program.
Again it's it just makes things a lot easier using something like Maltego to define all these different
relations.
And you can see the arrows how it points in different relations.
And, uh, I would recommend taking a look at modules that you want to start using in Maltego.
Again, you probably going to have to pull some API keys, which they'll walk you through.
Where to get the API keys.
Certain API keys are free, like Shodan.
Certain ones you will have to pay for, and some of them you will have to jump through some hoops to
get it.
Like the Flickr API.
It asks you some questions and why you want the API key and you have to explain yourself to them.
But all in all, really useful tool.
You could also use some of the modules that are paid like PayPal.
Um, fantastic program for uh name enumeration people enumeration.
So again, depending on what your use case are, you might be able to get with the free version.
You might get away with using the API keys or new API keys, or if you get really serious and this is
this really works out for you.
You may want to start considering purchasing some of the additional entities, uh, or modules that
make going to make your life a lot easier.
Again, this is Maltego Community Edition.
This is built into CSI Linux right down here on the bottom.
Thank you for watching.
I'll see you in the next video.