1 1 00:00:00,090 --> 00:00:01,020 In this lesson, 2 2 00:00:01,020 --> 00:00:03,179 we're going to cover a tool known as Maltego. 3 3 00:00:03,179 --> 00:00:05,269 Maltego is an open source tool 4 4 00:00:05,269 --> 00:00:07,800 that is widely used by cybersecurity analysts 5 5 00:00:07,800 --> 00:00:10,724 for data mining, reconnaissance, and enumeration. 6 6 00:00:10,724 --> 00:00:13,320 Maltego is used to gather, analyze, 7 7 00:00:13,320 --> 00:00:14,924 and visualize data from various sources 8 8 00:00:14,924 --> 00:00:18,748 including social media, DNS, and whois queries. 9 9 00:00:18,748 --> 00:00:20,520 The main goal of using Maltego 10 10 00:00:20,520 --> 00:00:22,590 is to give you an overview of the data 11 11 00:00:22,590 --> 00:00:24,000 from a specific domain 12 12 00:00:24,000 --> 00:00:25,137 in order to identify patterns 13 13 00:00:25,137 --> 00:00:27,524 or to identify potential threats. 14 14 00:00:27,524 --> 00:00:30,120 Now, one of the times I use Maltego the most 15 15 00:00:30,120 --> 00:00:31,710 is during a penetration test, 16 16 00:00:31,710 --> 00:00:34,692 specifically in the reconnaissance and enumeration phases. 17 17 00:00:34,692 --> 00:00:36,660 This is where we're going through the process 18 18 00:00:36,660 --> 00:00:38,850 of gathering information about a target network, 19 19 00:00:38,850 --> 00:00:41,880 such as the IP addresses, host names, and open ports, 20 20 00:00:41,880 --> 00:00:44,278 before attempting to exploit any vulnerabilities. 21 21 00:00:44,278 --> 00:00:45,521 By using Maltego, 22 22 00:00:45,521 --> 00:00:48,088 we can easily gather information from various sources 23 23 00:00:48,088 --> 00:00:51,360 and represent them in a graphical or visual manner. 24 24 00:00:51,360 --> 00:00:53,804 This gives us a really good representation of all the data 25 25 00:00:53,804 --> 00:00:56,070 and helps us to better identify patterns, 26 26 00:00:56,070 --> 00:00:57,568 connections and potential threats. 27 27 00:00:57,568 --> 00:01:00,788 Another use of Maltego is in identifying relationships 28 28 00:01:00,788 --> 00:01:02,908 between different entities in a network. 29 29 00:01:02,908 --> 00:01:06,000 For example, we can use Maltego to identify relationships 30 30 00:01:06,000 --> 00:01:09,431 between IP addresses, email addresses, and domain names, 31 31 00:01:09,431 --> 00:01:11,190 and then this can help to identify 32 32 00:01:11,190 --> 00:01:12,390 potential phishing attacks 33 33 00:01:12,390 --> 00:01:13,768 or other social engineering attempts 34 34 00:01:13,768 --> 00:01:15,270 as well as identify 35 35 00:01:15,270 --> 00:01:17,279 potential command and control servers for malware 36 36 00:01:17,279 --> 00:01:19,784 that has affected different things on our network. 37 37 00:01:19,784 --> 00:01:21,461 Now, Maltego can also be used 38 38 00:01:21,461 --> 00:01:23,580 to identify and track down the ownership 39 39 00:01:23,580 --> 00:01:25,480 and registrant of different domain names. 40 40 00:01:25,480 --> 00:01:28,364 It can extract information from things like whois records 41 41 00:01:28,364 --> 00:01:30,660 and domain name registration data, 42 42 00:01:30,660 --> 00:01:33,148 and then represent them all in a graphical format. 43 43 00:01:33,148 --> 00:01:35,310 This again helps us as analysts 44 44 00:01:35,310 --> 00:01:36,630 to identify if the domain name 45 45 00:01:36,630 --> 00:01:37,948 is being used for malicious purposes 46 46 00:01:37,948 --> 00:01:41,280 and what other things are tying into this particular domain, 47 47 00:01:41,280 --> 00:01:43,812 if we know that it's being used by a threat actor. 48 48 00:01:43,812 --> 00:01:46,168 Another great feature inside of Maltego 49 49 00:01:46,168 --> 00:01:48,690 is its ability to collect and analyze data 50 50 00:01:48,690 --> 00:01:50,324 from different social media accounts, 51 51 00:01:50,324 --> 00:01:52,680 like Twitter and Facebook and LinkedIn, 52 52 00:01:52,680 --> 00:01:55,510 and then represent that all in a graphical format. 53 53 00:01:55,510 --> 00:01:57,480 This allows us as cybersecurity analysts 54 54 00:01:57,480 --> 00:01:59,608 to again identify patterns and connections, 55 55 00:01:59,608 --> 00:02:01,860 such as identifying all the different leaders 56 56 00:02:01,860 --> 00:02:03,270 inside of an organization 57 57 00:02:03,270 --> 00:02:05,577 and how they graphically align with one another. 58 58 00:02:05,577 --> 00:02:07,709 This then allows us to identify which people 59 59 00:02:07,709 --> 00:02:10,364 talk with which other people inside of an organization, 60 60 00:02:10,364 --> 00:02:12,568 and we might be able to use that as a penetration tester, 61 61 00:02:12,568 --> 00:02:14,229 as an attack vector to get in 62 62 00:02:14,229 --> 00:02:16,304 or to pivot from one system to another 63 63 00:02:16,304 --> 00:02:19,468 as we're attacking various people across the organization. 64 64 00:02:19,468 --> 00:02:20,880 Now, when it comes to Maltego, 65 65 00:02:20,880 --> 00:02:23,220 Maltego is a very flexible tool 66 66 00:02:23,220 --> 00:02:24,900 and allows us to integrate in 67 67 00:02:24,900 --> 00:02:26,772 a lot of different custom transformation 68 68 00:02:26,772 --> 00:02:28,648 and proprietary data feeds 69 69 00:02:28,648 --> 00:02:31,020 to be able to suit the needs of our organization. 70 70 00:02:31,020 --> 00:02:33,732 For example, your organization might develop a transform 71 71 00:02:33,732 --> 00:02:36,720 to attract information from your ticketing system 72 72 00:02:36,720 --> 00:02:38,340 or your asset management tool, 73 73 00:02:38,340 --> 00:02:41,047 and then visually display that inside of Maltego as well. 74 74 00:02:41,047 --> 00:02:42,600 So as you can see, 75 75 00:02:42,600 --> 00:02:44,976 Maltego is quite a powerful and versatile tool 76 76 00:02:44,976 --> 00:02:47,510 that can be used by us as cybersecurity analysts 77 77 00:02:47,510 --> 00:02:49,072 to do lots of different things. 78 78 00:02:49,072 --> 00:02:51,500 We can gather and analyze data from various sources 79 79 00:02:51,500 --> 00:02:54,270 like social media, DNS, and whois, 80 80 00:02:54,270 --> 00:02:57,450 and then represent it in a graphically connected format. 81 81 00:02:57,450 --> 00:02:58,710 This can help us as analysts 82 82 00:02:58,710 --> 00:03:01,380 to identify patterns and connections and potential threats 83 83 00:03:01,380 --> 00:03:03,516 by seeing the linkages in a visual manner. 84 84 00:03:03,516 --> 00:03:06,030 Also, we have the ability to integrate 85 85 00:03:06,030 --> 00:03:08,220 custom transforms to make it more flexible 86 86 00:03:08,220 --> 00:03:09,908 and to suit our needs as an organization 87 87 00:03:09,908 --> 00:03:12,090 by collecting different types of data sources 88 88 00:03:12,090 --> 00:03:13,908 and bringing them into Maltego as well. 89 89 00:03:13,908 --> 00:03:15,470 Because of all of this, 90 90 00:03:15,470 --> 00:03:17,616 Maltego is a great tool to use during enumeration 91 91 00:03:17,616 --> 00:03:19,944 'cause it takes all this data from different sources 92 92 00:03:19,944 --> 00:03:21,990 and presents it in a visual manner. 93 93 00:03:21,990 --> 00:03:23,880 So we can see how all those connections and patterns 94 94 00:03:23,880 --> 00:03:25,713 are working in the real world.