Hacker tool talk: maltego
16 likes15,356 views
This document discusses Maltego, a tool for open source intelligence (OSINT) that maps relationships between various objects and gathers information from public sources. It covers features, installation procedures, limitations, legitimate uses, and comparisons with other data-gathering methods. The presentation also includes a demo and resources for further learning about the tool.
Hacker tool talk: maltego
- 1. Hacker tool talk: Maltego“Security through knowledge”Chris Hammond-Thrasherchris.hammond-thrasher <at> ca.fujitsu.comFujitsu Edmonton Security LabFebruary 20111Fujitsu Edmonton Security Lab
- 2. AgendaWhy are we here?About MaltegoInstalling MaltegoMaltego demoWhat’s next?2Fujitsu Edmonton Security Lab
- 3. Why are we here?3Fujitsu Edmonton Security Lab
- 4. Ethics and motives“Every single scam in human history has worked for one key reason; the victim did not recognize it as a scam.”- R. Paul Wilson4Fujitsu Edmonton Security Lab
- 5. OSINT“Open source intelligence (OSINT) is a form of intelligence collection management that involves finding, selecting, and acquiring information from publicly available sources and analyzing it to produce actionable intelligence.”- Wikipedia5Fujitsu Edmonton Security Lab
- 6. About Maltego6Fujitsu Edmonton Security Lab
- 7. FeaturesMaps relationships between numerous physical or digital objectsDiscovers information from numerous online sourcesExtensible: Maltego can model relationships between almost anything – add your own “entities”, write your own “transforms” and integrate to other systems with the APIFree Community Version (as in beer and speech) and a powerful commercial version for ~US$700 for the first year7Fujitsu Edmonton Security Lab
- 8. LimitationsDoes not search social media sites due to policy restrictions on those sitesDoes not search commercial data sourcesFujitsu Edmonton Security Lab8
- 9. Maltego vs. othersYou can manually gather similar data with search engines, DNS, whois, and social media searchesi123people iPhone app (free)Commercial alternatives to MaltegoCEMaltego (commercial)Visual Analytics VisualLinksI2 Group Analyst’s NotebookOthers9Fujitsu Edmonton Security Lab
- 10. Legit uses of MaltegoTracking SPAM posts on websites and mailing listsVerifying IT assetsCompetitive intelligence from public sourcesGathering supporting information for individual background checksOther creative uses are possible – it is a flexible tool10Fujitsu Edmonton Security Lab
- 11. h4X0r$Passive reconnaissance in advance of a system attackPassive reconnaissance in advance of a social engineering attack11Fujitsu Edmonton Security Lab
- 12. Installing Maltego12Fujitsu Edmonton Security Lab
- 13. ChoicesCurrent release of Maltego Community Edition is 3.0Easiest: Get latest Backtrack (BT4R2) live CD or VMhttp://www.backtrack-linux.org/downloads/Windows installer with or without Javahttp://www.paterva.com/Linux rpm and deb binary packages availablehttp://www.paterva.com/MacOS coming soon13Fujitsu Edmonton Security Lab
- 14. Getting startedInstall via the usual means for your platformStart MaltegoCEdouble-click the icon in Windows maltego-ce from the Linux command lineFujitsu Edmonton Security Lab14
- 15. Register and loginFujitsu Edmonton Security Lab15
- 16. Update your transformsFujitsu Edmonton Security Lab16
- 17. Install the cool Shodan add-onsStep 1: API keyGet a free Shodan API key (free registration required)http://www.shodanhq.com/api_docFujitsu Edmonton Security Lab17
- 18. Install the cool Shodan add-onsStep 2: entitiesDownload the entities at: http://maltego.shodanhq.com/downloads/shodan_entities.mtzIn Maltego, select "Manage Entities" in the "Manage" tab.Select "Import..."Locate the "shodan_entities.mtz" file you just downloaded and click "Next".Make sure all entities are checked, and click "Next".Enter "Shodan" as a category for the new entities. Click "Finish".Fujitsu Edmonton Security Lab18
- 19. Install the cool Shodan add-onsStep 3: transformsSelect "Discover Transforms" in the "Manage" tab.In the "Name" field, enter "Shodan"As a URL, use: https://cetas.paterva.com/TDS/runner/showseed/shodanClick "Add"Make sure the "Shodan" seed is selected, then click "Next"Again make sure you see "Shodan" selected, then click "Next"You now see a list of transforms that the "Shodan" seed has. Just click "Next"Click "Finish"Fujitsu Edmonton Security Lab19
- 20. Maltego demo20Fujitsu Edmonton Security Lab
- 21. Maltego demoStarting it upTour through menus and windowsInvestigating a system targetInvestigating a human target21Fujitsu Edmonton Security Lab
- 22. What’s next22Fujitsu Edmonton Security Lab
- 23. Learn moreRead the Maltego wikihttp://ctas.paterva.com/view/What_is_MaltegoRead the Social-Engineer.org websitehttp://social-engineer.org/Read my old “How do hackers do it?” presentationhttp://www.picisoc.org/tiki-download_file.php?fileId=51&ei=TMI4TcOHBI2WsgOzrZHfAw&usg=AFQjCNH8Y_JPsbADDoOPvlNvPO7udJlmpQ23Fujitsu Edmonton Security Lab
- 24. Act locallyAt homeUse MaltegoCE to manage what information you are exposing about yourself onlineYou can request that Google remove content about youhttp://www.google.com/support/bin/answer.py?answer=164734&hl=enMonitor your children’s adherence to the family acceptable usage policy24Fujitsu Edmonton Security Lab
- 25. Act locallyAt workUse Maltego to audit public information about corporate systemsTrack down troublesome website or mailing list users (or bots) using publically available information25Fujitsu Edmonton Security Lab
- 26. Thank you!Want more presentations like this?Is there a particular tool or hack that you would like to see demoed?Chris Hammond-ThrasherFujitsu Edmonton Security LabEmail: chris.hammond-thrasher <at> ca.fujitsu.comTwitter: thrashor26Fujitsu Edmonton Security Lab
- 27. Fujitsu Edmonton Security Lab27
Editor's Notes
- #6: In the intelligence community (IC), the term "open" refers to overt, publicly available sources (as opposed to covert or classified sources); it is not related to open-source software or public intelligence.