Uploaded byChris Hammond-Thrasher
Hacker tool talk: maltego
This document discusses Maltego, a tool for open source intelligence (OSINT) that maps relationships between various objects and gathers information from public sources. It covers features, installation procedures, limitations, legitimate uses, and comparisons with other data-gathering methods. The presentation also includes a demo and resources for further learning about the tool.
In this document
Powered by AI
Overview of the presentation and agenda for discussing Maltego's functionalities.
Discussion on ethical hacking principles and the definition of Open Source Intelligence (OSINT).
Description of Maltego's features, limitations, and comparisons with other tools in the market.
Introduction to passive reconnaissance methods prior to a potential system or social engineering attack.
Steps for installing Maltego and configuring it with add-ons like Shodan.
A live demonstration of Maltego's functionalities, including menu navigation and target investigation.
Future actions to take, resources for further learning, and practical applications of Maltego at home and work.
Closing remarks and invitation for further engagement from the audience.
More Related Content
Similar to Hacker tool talk: maltego
![[CB19] Deep Exploit: Fully Automatic Penetration Test Tool Using Reinforcemen...](https://cdn.slidesharecdn.com/ss_thumbnails/cb19-deep-exploit-fully-automatic-penetration-test-tool-using-reinforcement-learning-by-isao-takaesu-191217063856-thumbnail.jpg?width=640&height=640&fit=bounds)
Hacker tool talk: maltego
- 1. Hacker tool talk:Maltego“Security through knowledge”Chris Hammond-Thrasherchris.hammond-thrasher <at> ca.fujitsu.comFujitsu Edmonton Security LabFebruary 20111Fujitsu Edmonton Security Lab
- 2. AgendaWhy are wehere?About MaltegoInstalling MaltegoMaltego demoWhat’s next?2Fujitsu Edmonton Security Lab
- 3. Why are wehere?3Fujitsu Edmonton Security Lab
- 4. Ethics and motives“Everysingle scam in human history has worked for one key reason; the victim did not recognize it as a scam.”- R. Paul Wilson4Fujitsu Edmonton Security Lab
- 5. OSINT“Open source intelligence(OSINT) is a form of intelligence collection management that involves finding, selecting, and acquiring information from publicly available sources and analyzing it to produce actionable intelligence.”- Wikipedia5Fujitsu Edmonton Security Lab
- 6. About Maltego6Fujitsu EdmontonSecurity Lab
- 7. FeaturesMaps relationships betweennumerous physical or digital objectsDiscovers information from numerous online sourcesExtensible: Maltego can model relationships between almost anything – add your own “entities”, write your own “transforms” and integrate to other systems with the APIFree Community Version (as in beer and speech) and a powerful commercial version for ~US$700 for the first year7Fujitsu Edmonton Security Lab
- 8. LimitationsDoes not searchsocial media sites due to policy restrictions on those sitesDoes not search commercial data sourcesFujitsu Edmonton Security Lab8
- 9. Maltego vs. othersYoucan manually gather similar data with search engines, DNS, whois, and social media searchesi123people iPhone app (free)Commercial alternatives to MaltegoCEMaltego (commercial)Visual Analytics VisualLinksI2 Group Analyst’s NotebookOthers9Fujitsu Edmonton Security Lab
- 10. Legit uses ofMaltegoTracking SPAM posts on websites and mailing listsVerifying IT assetsCompetitive intelligence from public sourcesGathering supporting information for individual background checksOther creative uses are possible – it is a flexible tool10Fujitsu Edmonton Security Lab
- 11. h4X0r$Passive reconnaissance inadvance of a system attackPassive reconnaissance in advance of a social engineering attack11Fujitsu Edmonton Security Lab
- 12. Installing Maltego12Fujitsu EdmontonSecurity Lab
- 13. ChoicesCurrent release ofMaltego Community Edition is 3.0Easiest: Get latest Backtrack (BT4R2) live CD or VMhttp://www.backtrack-linux.org/downloads/Windows installer with or without Javahttp://www.paterva.com/Linux rpm and deb binary packages availablehttp://www.paterva.com/MacOS coming soon13Fujitsu Edmonton Security Lab
- 14. Getting startedInstall viathe usual means for your platformStart MaltegoCEdouble-click the icon in Windows maltego-ce from the Linux command lineFujitsu Edmonton Security Lab14
- 15. Register and loginFujitsuEdmonton Security Lab15
- 16. Update your transformsFujitsuEdmonton Security Lab16
- 17. Install the coolShodan add-onsStep 1: API keyGet a free Shodan API key (free registration required)http://www.shodanhq.com/api_docFujitsu Edmonton Security Lab17
- 18. Install the coolShodan add-onsStep 2: entitiesDownload the entities at: http://maltego.shodanhq.com/downloads/shodan_entities.mtzIn Maltego, select "Manage Entities" in the "Manage" tab.Select "Import..."Locate the "shodan_entities.mtz" file you just downloaded and click "Next".Make sure all entities are checked, and click "Next".Enter "Shodan" as a category for the new entities. Click "Finish".Fujitsu Edmonton Security Lab18
- 19. Install the coolShodan add-onsStep 3: transformsSelect "Discover Transforms" in the "Manage" tab.In the "Name" field, enter "Shodan"As a URL, use: https://cetas.paterva.com/TDS/runner/showseed/shodanClick "Add"Make sure the "Shodan" seed is selected, then click "Next"Again make sure you see "Shodan" selected, then click "Next"You now see a list of transforms that the "Shodan" seed has. Just click "Next"Click "Finish"Fujitsu Edmonton Security Lab19
- 20. Maltego demo20Fujitsu EdmontonSecurity Lab
- 21. Maltego demoStarting itupTour through menus and windowsInvestigating a system targetInvestigating a human target21Fujitsu Edmonton Security Lab
- 22. What’s next22Fujitsu EdmontonSecurity Lab
- 23. Learn moreRead theMaltego wikihttp://ctas.paterva.com/view/What_is_MaltegoRead the Social-Engineer.org websitehttp://social-engineer.org/Read my old “How do hackers do it?” presentationhttp://www.picisoc.org/tiki-download_file.php?fileId=51&ei=TMI4TcOHBI2WsgOzrZHfAw&usg=AFQjCNH8Y_JPsbADDoOPvlNvPO7udJlmpQ23Fujitsu Edmonton Security Lab
- 24. Act locallyAt homeUseMaltegoCE to manage what information you are exposing about yourself onlineYou can request that Google remove content about youhttp://www.google.com/support/bin/answer.py?answer=164734&hl=enMonitor your children’s adherence to the family acceptable usage policy24Fujitsu Edmonton Security Lab
- 25. Act locallyAt workUseMaltego to audit public information about corporate systemsTrack down troublesome website or mailing list users (or bots) using publically available information25Fujitsu Edmonton Security Lab
- 26. Thank you!Want morepresentations like this?Is there a particular tool or hack that you would like to see demoed?Chris Hammond-ThrasherFujitsu Edmonton Security LabEmail: chris.hammond-thrasher <at> ca.fujitsu.comTwitter: thrashor26Fujitsu Edmonton Security Lab
- 27.
Editor's Notes
- #6 In the intelligence community (IC), the term "open" refers to overt, publicly available sources (as opposed to covert or classified sources); it is not related to open-source software or public intelligence.