Instructor: In this lesson, 2 2
we're going to cover a tool known as Maltego. 3 3
Maltego is an open source tool 4 4
that is widely used by cybersecurity analysts 5 5
for data mining, reconnaissance, and enumeration. 6 6
Maltego is used to gather, analyze, 7 7
and visualize data from various sources 8 8
including social media, DNS, and whois queries. 9 9
The main goal of using Maltego 10 10
is to give you an overview of the data 11 11
from a specific domain 12 12
in order to identify patterns 13 13
or to identify potential threats. 14 14
Now, one of the times I use Maltego the most 15 15
is during a penetration test, 16 16
specifically in the reconnaissance and enumeration phases. 17 17
This is where we're going through the process 18 18
of gathering information about a target network, 19 19
such as the IP addresses, host names, and open ports, 20 20
before attempting to exploit any vulnerabilities. 21 21
By using Maltego, 22 22
we can easily gather information from various sources 23 23
and represent them in a graphical or visual manner. 24 24
This gives us a really good representation of all the data 25 25
and helps us to better identify patterns, 26 26
connections and potential threats. 27 27
Another use of Maltego is in identifying relationships 28 28
between different entities in a network. 29 29
For example, we can use Maltego to identify relationships 30 30
between IP addresses, email addresses, and domain names, 31 31
and then this can help to identify 32 32
potential phishing attacks 33 33
or other social engineering attempts 34 34
as well as identify 35 35
potential command and control servers for malware 36 36
that has affected different things on our network. 37 37
Now, Maltego can also be used 38 38
to identify and track down the ownership 39 39
and registrant of different domain names. 40 40
It can extract information from things like whois records 41 41
and domain name registration data, 42 42
and then represent them all in a graphical format. 43 43
This again helps us as analysts 44 44
to identify if the domain name 45 45
is being used for malicious purposes 46 46
and what other things are tying into this particular domain, 47 47
if we know that it's being used by a threat actor. 48 48
Another great feature inside of Maltego 49 49
is its ability to collect and analyze data 50 50
from different social media accounts, 51 51
like Twitter and Facebook and LinkedIn, 52 52
and then represent that all in a graphical format. 53 53
This allows us as cybersecurity analysts 54 54
to again identify patterns and connections, 55 55
such as identifying all the different leaders 56 56
inside of an organization 57 57
and how they graphically align with one another. 58 58
This then allows us to identify which people 59 59
talk with which other people inside of an organization, 60 60
and we might be able to use that as a penetration tester, 61 61
as an attack vector to get in 62 62
or to pivot from one system to another 63 63
as we're attacking various people across the organization. 64 64
Now, when it comes to Maltego, 65 65
Maltego is a very flexible tool 66 66
and allows us to integrate in 67 67
a lot of different custom transformation 68 68
and proprietary data feeds 69 69
to be able to suit the needs of our organization. 70 70
For example, your organization might develop a transform 71 71
to attract information from your ticketing system 72 72
or your asset management tool, 73 73
and then visually display that inside of Maltego as well. 74 74
So as you can see, 75 75
Maltego is quite a powerful and versatile tool 76 76
that can be used by us as cybersecurity analysts 77 77
to do lots of different things. 78 78
We can gather and analyze data from various sources 79 79
like social media, DNS, and whois, 80 80
and then represent it in a graphically connected format. 81 81
This can help us as analysts 82 82
to identify patterns and connections and potential threats 83 83
by seeing the linkages in a visual manner. 84 84
Also, we have the ability to integrate 85 85
custom transforms to make it more flexible 86 86
and to suit our needs as an organization 87 87
by collecting different types of data sources 88 88
and bringing them into Maltego as well. 89 89
Because of all of this, 90 90
Maltego is a great tool to use during enumeration 91 91
'cause it takes all this data from different sources 92 92
and presents it in a visual manner. 93 93
So we can see how all those connections and patterns 94 94
are working in the real world.