WEBVTT 00:07.430 --> 00:07.820 All right. 00:07.820 --> 00:08.600 Good afternoon. 00:08.630 --> 00:10.850 Today we're going to mess around with Maltego a little bit. 00:10.880 --> 00:14.600 We're just going to do a high level entry overview of the tool. 00:14.630 --> 00:17.270 You can see here that I've got my Kali box up and going. 00:17.300 --> 00:19.370 I'm going to start off by opening a terminal. 00:19.460 --> 00:20.600 Blow that up for you. 00:20.900 --> 00:24.500 Maltego comes pre-installed inside your Kali box. 00:24.500 --> 00:28.730 So all you have to type in is Maltego and the command line interface, and it'll start the tool right 00:28.730 --> 00:29.330 up. 00:29.360 --> 00:34.250 Now when you first start Maltego for the very first time, you're going to have to register the product, 00:34.280 --> 00:39.290 which means you have to go through and answer some questions and go through the process of basically 00:39.290 --> 00:41.150 going through and just installing it. 00:41.180 --> 00:41.690 Right. 00:41.690 --> 00:43.100 You want the community edition. 00:43.100 --> 00:44.540 That's the free version. 00:44.960 --> 00:49.880 And eventually after you're done verifying your information and going through the entire rigmarole, 00:49.880 --> 00:51.830 you will land on this page. 00:51.860 --> 00:57.080 Now you can see here on the left hand side, it's providing different news and credits. 00:57.080 --> 01:00.800 It provides a little bit of what's going on with Maltego in the world. 01:00.800 --> 01:06.320 And on the right hand side you'll see this Transform hub and then the Transform Hub Partners. 01:06.350 --> 01:09.770 Below you can see here that I've clicked the free one. 01:09.800 --> 01:16.340 If I do all, then it provides me all the transforms available for the access options. 01:16.340 --> 01:18.080 You can see different categories as well. 01:18.110 --> 01:20.510 Let's say that I wanted specifically cryptocurrency. 01:20.510 --> 01:22.160 I could click on that one. 01:22.160 --> 01:29.720 Now I'm going to clear this out because I'm a cheap person or frugal as I like to say, we're going 01:29.720 --> 01:31.220 to do the free versions only. 01:31.220 --> 01:34.250 So I'm going to go free API tools. 01:34.250 --> 01:41.090 And this basically provides me a list of the 15 tools available or transforms available that are free 01:41.090 --> 01:41.840 to use. 01:41.840 --> 01:46.100 So you can kind of scroll over it and you can say, okay, well, this one does this. 01:46.100 --> 01:51.620 For instance, Ethernet ether scan, uh, is a block explorer and Linux platform. 01:51.620 --> 01:55.190 And if I want more details, I just click on that details button and it provides me a little bit more 01:55.190 --> 01:56.840 information about what's going on with it. 01:56.840 --> 01:59.450 To install it, I literally just click the install button. 01:59.480 --> 02:03.410 Now, as a first time user, I would just kind of install all of them. 02:03.410 --> 02:06.200 We're not going to install all of them together for the sake of time. 02:06.200 --> 02:11.200 But if I was you, if I was a student trying to get into it, I would just click all of them. 02:11.200 --> 02:16.450 And so I'm going to do URL scan right There-i'll I'm going to press yes. 02:16.540 --> 02:17.830 And it's going to go through it. 02:17.860 --> 02:20.590 Now you may be asked in the red right here. 02:20.620 --> 02:25.630 Hey um, an API key and it's just your email address that you utilized. 02:25.630 --> 02:28.060 And if you just press that, it'll be it'll go right through. 02:28.090 --> 02:30.010 So I'm going to press next and it's going to go through. 02:30.040 --> 02:31.150 It's going to install. 02:31.180 --> 02:36.520 And you can see that one application server 33 transforms nine entities and seven transform sets for 02:36.520 --> 02:37.810 the specific tool. 02:37.870 --> 02:42.010 So again if I wanted the who is one I could install that. 02:42.040 --> 02:44.650 Press yes and just hit next. 02:44.680 --> 02:46.480 Let me go finish real real simple. 02:46.480 --> 02:48.610 And you can sign to see the ones that you've already installed. 02:48.610 --> 02:52.870 Because I did the search transform already, but I basically installed three. 02:52.900 --> 02:57.220 Now I could go through and install all of these if I wanted to, but that's not what you came here for. 02:57.280 --> 02:57.760 All right. 02:57.760 --> 03:01.630 So I'm going to press this new button right at the top left hand side. 03:02.230 --> 03:08.410 And on the left hand side you'll start to see different, uh, search points. 03:08.440 --> 03:08.830 Right. 03:08.860 --> 03:15.240 So I can expand these out, I can create them, but you can kind of see that I have different aspects 03:15.240 --> 03:16.380 on the left hand side. 03:16.380 --> 03:20.010 So let's go to specific I don't know. 03:20.040 --> 03:21.630 Let's go to person personnel. 03:21.660 --> 03:23.430 Let's do alias document. 03:23.460 --> 03:25.140 Let's do an email address. 03:25.290 --> 03:26.550 Now let's do a person. 03:26.580 --> 03:27.330 Let's do a person. 03:27.330 --> 03:32.250 So we're just going to grab that and drag it off to the right hand side onto our little graph right 03:32.250 --> 03:32.970 here. 03:33.060 --> 03:37.290 If I double click on it, it's going to ask me for the name of the target that I want to utilize. 03:37.290 --> 03:40.140 Now who do I want to go against? 03:40.140 --> 03:43.530 Well, let's go against uh, I don't know. 03:43.560 --> 03:46.170 Let's go against the president. 03:46.200 --> 03:48.030 No, let's do Elon Musk. 03:48.390 --> 03:50.700 Elon Musk is always a fan favorite. 03:50.730 --> 03:52.350 We'll do Elon Musk okay. 03:52.380 --> 03:52.830 All right. 03:52.860 --> 03:54.780 To get this up and going. 03:55.440 --> 03:56.850 We're going to right click. 03:56.910 --> 04:00.180 And I can do all kinds of different aspects with this. 04:00.180 --> 04:05.850 Or I can double click and I can go through and point out different notes. 04:05.850 --> 04:09.630 I can do surnames, I can do first names, so on and so forth. 04:09.630 --> 04:13.680 I can do a different attachments, I can provide notes if I wanted to. 04:13.680 --> 04:16.290 And you can see the different properties pretty easy. 04:16.290 --> 04:17.790 I'm just going to press okay. 04:17.970 --> 04:18.750 It's nice. 04:18.750 --> 04:24.930 If I was doing maltego for a company then I could actually provide a little, uh, little note in there, 04:24.960 --> 04:26.940 a little picture if I really wanted to. 04:27.390 --> 04:27.990 Right. 04:27.990 --> 04:30.390 So if I click on this button. 04:32.940 --> 04:34.380 It just provides that detailed view. 04:34.380 --> 04:35.490 It's a flag. 04:35.970 --> 04:38.190 And there we go. 04:40.140 --> 04:40.410 All right. 04:40.440 --> 04:42.000 So I'm going to right click on it. 04:42.000 --> 04:45.990 And I can see all the transforms right here. 04:47.040 --> 04:48.090 This little button button. 04:48.090 --> 04:49.710 And I can see all the transforms. 04:49.710 --> 04:56.400 So I'm going to do for instance if I want to do standard transforms I can press the little double arrow 04:56.400 --> 04:57.570 button and it will look for everything. 04:57.570 --> 05:02.070 I'm just going to click the double arrow for standard transforms right there. 05:02.400 --> 05:04.920 And it's going to ask me what domain that I would like to use. 05:04.920 --> 05:08.610 Now obviously I'm going to use Tesla.com. 05:08.940 --> 05:13.740 I don't have any phone numbers or email addresses, but I'm going to press run and it's going to go 05:13.740 --> 05:20.670 through and start connecting Elon Musk with as much information that it can possibly gather. 05:20.670 --> 05:26.580 And we can see that it's already populating with different email addresses associated with it that it's 05:26.580 --> 05:26.850 found. 05:26.850 --> 05:29.370 Now, not all of these are going to be 100% accurate. 05:29.400 --> 05:34.440 For instance, I highly doubt that Elon Musk has Elon Musk at hotmail.com. 05:34.470 --> 05:35.520 I mean, maybe I'm wrong. 05:35.550 --> 05:38.340 Maybe, maybe he does, but I doubt it. 05:38.370 --> 05:38.940 Right. 05:38.940 --> 05:41.580 So you can also see Elon at Tesla.com. 05:41.610 --> 05:45.960 Again probably a throwaway email address where you can see Elon at gmail.com. 05:45.960 --> 05:49.020 And you can see that it's running through the transforms as we go through. 05:49.050 --> 05:55.680 Now I can expand I can close in, I can go through this entire process if I wanted to, but it just 05:55.680 --> 05:59.250 provides that graphical interface to kind of go through and identify it. 05:59.280 --> 06:02.040 Now it's identified all those email addresses. 06:02.040 --> 06:03.900 But what happens if I want something else. 06:03.930 --> 06:08.640 So again we can right click and we can do search transforms and do the same thing. 06:08.700 --> 06:14.580 And again it's going to ask for the domain I can just type in Tesla.com I can run it again. 06:14.610 --> 06:15.900 I can even remember these settings. 06:15.900 --> 06:17.520 I'm not going to but I could if I wanted to. 06:17.550 --> 06:22.170 And you can see that it's going to start running through different APIs, and it'll start populating 06:22.170 --> 06:24.450 those as it goes if there's any available. 06:24.480 --> 06:27.840 So it's kind of going through and it already stopped. 06:27.840 --> 06:29.910 So it's pretty much already done through that. 06:29.910 --> 06:34.410 Now I could do the who is XML? 06:34.440 --> 06:38.040 Remember that's the transform that we downloaded into the system. 06:38.070 --> 06:42.600 And I could press that one and it'll start going through as well and see if it populates with anything. 06:42.600 --> 06:46.470 And here we can see that it's provided all this juicy information. 06:46.470 --> 06:51.690 If I want to expand that out, I just literally scroll my mouse wheel a little bit and go through it, 06:51.690 --> 06:56.460 and it just kind of provides that graphical interface of everything that's associated that it's found 06:56.460 --> 07:01.080 with Elon Musk and Tesla, and that's really what it's going through, okay. 07:01.110 --> 07:02.640 And we can see all these different things. 07:02.640 --> 07:08.490 If I wanted some information on this I just double click on it and it's basically telling me Xc40 for 07:08.520 --> 07:12.480 2.211.com, and then I can provide the properties. 07:12.480 --> 07:14.910 And that's just the domain it's associated with. 07:14.940 --> 07:15.540 Okay. 07:15.570 --> 07:19.020 Now again you have to take this with a little bit of a little bit of salt. 07:19.050 --> 07:19.770 Right. 07:19.770 --> 07:21.240 You can't be 100% accurate on it. 07:21.270 --> 07:24.780 It is open source intelligence gathering which means it's not always accurate. 07:24.870 --> 07:26.220 But yeah. 07:26.250 --> 07:26.520 All right. 07:26.550 --> 07:28.050 So that's that's Maltego. 07:28.080 --> 07:29.490 You can play around with this thing. 07:29.490 --> 07:30.780 You could add more into it. 07:30.780 --> 07:34.200 Let's say that you know his phone number or there was a specific phone number you wanted to do. 07:34.230 --> 07:36.850 You just drop that in there and then put the phone number in there. 07:36.880 --> 07:38.950 Make sure that it is international. 07:38.980 --> 07:39.760 As you can see. 07:39.760 --> 07:42.100 So make sure you're adding that international phone number. 07:42.130 --> 07:42.580 Right. 07:42.580 --> 07:45.610 You could do an image if you wanted to populate an image. 07:45.940 --> 07:47.230 Um, let's go up a little bit. 07:47.230 --> 07:52.000 If you wanted a device, let's say you knew the desktop computer, you can do it from there. 07:52.000 --> 07:53.620 Maybe a mobile phone device. 07:53.620 --> 07:56.530 You could probably put a phone number in there and figure out what's going on there. 07:56.530 --> 07:58.360 It just provides a lot of different tools. 07:58.390 --> 08:04.150 Obviously, the more transforms that you have available, the better over here, right? 08:04.180 --> 08:09.100 So obviously if I do more ether scans and other items, then I will have more transforms. 08:09.100 --> 08:14.350 More transforms allows me to pick through more data, and that more data is going to lead me to more 08:14.380 --> 08:15.640 open source intelligence. 08:15.670 --> 08:16.030 Right? 08:16.060 --> 08:17.980 So again, that's maltego. 08:17.980 --> 08:22.600 It provides us a high level overview of open source intelligence gathering. 08:22.600 --> 08:25.090 I personally prefer something called Spider Foot. 08:25.930 --> 08:28.720 Uh, but, you know, Maltego is not a bad tool. 08:28.750 --> 08:30.760 I like the graphical interface that it provides. 08:30.760 --> 08:34.450 And again, you can get through right here, uh, and go through it if you really want. 08:34.480 --> 08:34.780 All right. 08:34.810 --> 08:37.210 So that's maltego in a nutshell. 08:37.240 --> 08:38.860 Very quick, very dirty. 08:38.860 --> 08:40.180 Uh, I hope that was helpful. 08:40.180 --> 08:41.230 We'll see you next time.