Welcome to part one of this module
in this video.
We're going to be taking a look at the open source intelligence program called multi Argo which comes
pre installed in Cali Linux
Montego is a very fun program to use.
Which is why I've chosen it as the first program I'll be covering in this section.
It is graphical and therefore very easy for visual oriented people to get used to.
The program is very powerful and will allow for detective work of all kinds against various entities
organizations persons.
It can be used for foot printing for reconnaissance for fingerprinting and for a number of other open
source intelligence possibilities.
So we're gonna go ahead and load multi go.
This can be done a number of ways.
You can either go up to applications information gathering multi go or you can just load it from the
main sidebar if it's there the first time you load the community addition you'll be asked to register.
This is a standard procedure you just click the link and input your data once you're registered you
will have the right to use the Community Edition which is somewhat limited if you like the tool.
There is a commercial version available that has a great deal more options and power available to it.
I should say that the goal of this tutorial is not to make you a master detective but rather to give
you the basic skills and overview that you can play with the software.
And from there develop your sleuthing skills through practice
so this first screen that we find ourselves on is the transforms hub.
I'll explain what this is shortly but to begin with we're going to want to start playing with the tool
so we you get so that we can get a feel for what these various transforms are.
So we're going to open a new graph by going up to this little icon in the upper left and clicking on
it.
Now we have an open empty graph.
We notice that on this side panel there are numerous entities listed these are targets essentially that
we can investigate.
For example let's say we wanted to investigate a specific Internet domain.
We click on domain and we drag it onto the graph.
Now we can edit this by double clicking and we can change this to anything we want.
I'm going to go ahead and use Space X dot com as a demonstration
and now we have the domain that we wish to investigate if we right click we have the option to run what's
called transforms transforms are essentially scripts that scour the Internet for open source intelligence
data we could gather all of this data by hand but it would take a great deal of time as you can see
there are numerous options and if we expand these options we can see that there are yet more options
contained within them.
We're going to begin by running all transforms by clicking the run all button
as you can see at the bottom of the screen the transforms are running
and here we've pulled up a great deal of data more data than I actually really intended to for this
demonstration but that's OK
here we have the VPN Space X dot com we have other Web sites associated with Space X dot com We have
email addresses associated with Space X or at least the domain
C we have names of individuals phone numbers come up.
As well as related web entities.
If we zoom out
we can look at this by color as you can see.
The key is right down here and it explains what each of these colors is
now.
Each one of these items that we have discovered we can run individual transforms against for more information.
So for example
let's say we wanted to investigate this email address.
We will run all transforms against this email
transforms are running
and I should mention that you can scroll in and out using your mouse wheel.
It's also possible to look at this information in different ways which I will show you in a moment
so this email is associated with someone by the name of Brandon Spikes and there are two more emails
that are associated with it.
I should also mention that the number of results you get will be slightly limited in the community edition
of multi go each transform can produce twelve total results of a particular type with the with the licensed
edition.
You can get up to 10000.
And with this scroll bar you can control the number that you get.
It's not always fruitful to get an excessive number of results
sometimes it is advantageous to limit them
we can also change the way the data is presented by clicking these icons we're currently in block mode.
This is hierarchical mode
circular mode
organic mode.
Now I'm going to close this and we'll begin a new search
I mentioned that it's possible to add more transforms the more transforms you add the more potential
results you can get.
For example
if we added the have I been ponied transform this will cause Montego to check against the have I've
imposed lists for e-mails at through pastebin and potentially find compromised accounts.
This can be useful when conducting reconnaissance for your own corporation to identify which of which
accounts have been compromised.
Some of these transforms are free.
Some of them are not.
Some of them require an API key that is semi free.
For example showdown will require an API key.
This key is free and will get you some results.
But in order to use it to its fullest potential you will have to buy it have I've imposed on the other
hand is completely free to install a transform off the list.
Just click install
and that will open up a new graph
and we're going to check a domain again this time we're going to look up the domain of a game company.
Now this company is called ion realms but it runs several games and we're going to look up one of the
individual games to see if it links us back to the company.
In other words if we didn't already know the parent company well let's see what it pulls up.
We'll run all transforms.
This will include the newly installed have I been Poland.
It appears that no breaches have been detected
here we have the net block associated with the domain in question we can double click it and see the
IP range we can click properties for more information.
Unfortunately in this particular example there isn't very much
we can see related domains.
Some of them may not in fact be connected and you could delete erroneous results
and here we have privacy.
No IP dot com so it's good to know that this company is protecting itself
let's have a closer look at their website.
We will run all transforms against it.
And we'll just go with the default settings.
Now we can see information about what their Web site includes.
There's the no IP protection that I mentioned and CloudFlare as well as the always popular kiss metrics
BHP is included as well as Facebook for Web sites.
We have an IP address and now we're starting to see related information.
Here is the company that I mentioned the parent company that owns the game that's ion realms dot com
firearms rooms Inc.
Owns the arcade game.
It also owns told the Star morn and let's see if any others came up doesn't look like it
however from here now that we know the parent company we can run transforms against it and see what
comes up.
Quite a bit seems
we can see a great many email addresses associated with these individual games.
We can see the iron rooms dot com domain
we can see administration addresses
and now let's say that we wanted to check all of the emails associated with our search simultaneously
against have been posted to see if any of these accounts that are used by this company have been compromised
so it would be very tedious to select each one individually so we're going to click the select by type
or rather add similar now we've selected all of the emails at once and we don't need to run all the
transforms for the question we're asking we just want to know if any of these accounts have showed up
on have I been posted.
So we're going to run that individual set of transforms by clicking the run all for that particular
option
except the disclaimer
and it looks like the tool has not found anything yet
it appears that none of these accounts have been breached.
Now let's say that we wanted to investigate a particular individual somewhere to close this existing
graph and start a new graph
and this time I'm going to drag the person icon and we're going to create the president Donald Trump
click OK and this is the problem with researching a celebrity is that you usually get a lot of results
and not all of them are applicable spy running all transforms.
It may prompt me to log into Twitter.
It didn't because my logging was still good.
You would probably be prompt prompted if this was your first time running these transforms because as
we know the president is very fond of Twitter
so
we'll try this one.
Tweets that this person wrote
and here we have all of the latest tweets.
There would be a great many more.
But remember that multi go community edition is limited in how much information you can pull up at one
time.
So as you can see there's a great deal of information that can be pulled up using multi go and the real
trick is just to play around with it.
Try try looking into companies domain names people whatever you like that you could normally look up
on the Internet and you could assemble all of this information by hand.
You could piece together each individual email address you could find out how it associates with others
but all of this information is available through multi go
it could even look at Twitter and search by hashtag
for example.
Well hashtag multi go or run the transform
and this will pull up all the most recent tweets using that hashtag and remember with the license version
you can get up to 10000 results of these at a time
so it may be good to limit them
another fun little feature of multi go is that you can actually look at the tweet sentiment which is
to say let's click on a particular tweet.
And we can determine.
Excuse me what sentiment.
It has been assigned this particular one comes up as negative.
Let's try another one.
Here we go sentiment negative.
So once again it would be rather tedious to check each individual tweet for its sentiment.
So we'll click on one of the tweets and then select by type and now will run sentiment transform
and see which treat tweets are positive negative or neutral.
And this might seem silly but consider imagine that you used another open source intelligence program
or perhaps you are just familiar with the makeup of a particular organization.
Let's say a company and you knew who the employees of this company where you had a list.
So you decided to run transforms against people you would drag a person onto your graph you would enter
their name.
You could do multiple people at once if you pleased and you could pull up your tweets and then looking
at their tweets you can check the sentiment of their tweets.
You can see what they're saying how much of what they are saying about their own company is negative.
How much is positive.
You can really get a great deal of information about who a person is based on this.
And it's also useful for finding points of compromise.
Employees who are dissatisfied.
For example whose security practices may not be ideal.
This is something that you can infer sometimes based on tweets.
It also allows for the use of targeted social engineering.
The more you know about a person the easier it is to devise a social engineering attack that is appropriate
for them.
And just from what we're looking at now we can infer that the president is in more of a bad mood at
this particular moment in time than a good one.
Most of his tweets are negative only one of them is neutral
we can also look at Twitter affiliations.
This would show who wrote tweets to the person.
I suspect that given the nature of the celebrity in question this would be a very long list and it would
not produce very useful results particularly as were given to a limit of twelve results for the community
addition.
However it may be interesting to see who this individual has written tweets to so let's do that
no real surprises here.
I'm afraid I can't tell from this picture it's rather small on my screen and I don't read Japanese but
I'm going to guess that that is the prime minister of Japan
and we could have a look at these individuals.
Actually let's have a look.
At this individual or on transforms against the person and see what comes up.
Japanese Well anyway you see how this can get very complicated very quickly.
Let's try Eric Trump.
We'll look at the person
sometimes we have to break it down multiple times
and I'm not too sure how much of this is really useful but it's interesting to see what comes up it
can be fun.
We have a look at their tweets
now.
Let's have a look at their attitude or their sentiment excuse me.
Well I'm afraid the uh graph layout is quickly becoming a mess.
We've got a bit too much information on our screen at the moment.
So
I could change the layout but I'm not sure that would really help in this case.
But as you can see a great deal of information can be pulled up very quickly
and associations can also be inferred and discovered.
For example we could learn about the Eric Trump Foundation.
This appears to be a twitter link
just listed as an affiliation so
let's see what comes up for location
New York City so I take it that it is based out of New York City.
OK
this particular aspect has been well demonstrated so I'm going to close these graphs and talk a bit
about the differences multi-year transforms and what they entail
so as we've seen demonstrated in this module there's a wealth of information that can be called up with
this tool multi go can be used to draw conclusions about people and organizations and to establish links
between them.
It's a powerful research device that can really allow you to do some deep detective work if you're willing
to put in the time to learn all of the nuances of the tool.
Now as I said at the start of this tutorial My goal was not to give you an absolute understanding of
every possible use of multi go but to give you enough tools to get your feet wet so that you can play
around with it and learn for yourself all the various different applications and possibilities that
multi ego has to offer.
You can also go back to this tool at various points throughout this class and take pieces of information
that you may acquire through your own experimentation with other open source intelligence tools and
run them through multi go to see what else you come up with sometimes Montego will generate a result
that another program like for example recon and G might not yield.
So by using these tools in concert you can gain a more clear picture of whatever your target may happen
to be and it can help you to identify weaknesses as well as trends or just gain information that is
necessary for larger projects you may be working on.
It should also be noted that there are a great many additional transform packages that can be installed
from alter ego.
Now I'm really not an expert on all of them and I think that there's probably no limit to the number
that can be created using the framework that is presented with multi go with most of the transform packages
being coded.
I believe in X AML and a few of them being coded in Python if you're interested in learning more about
creating your own transform packages.
There's a great deal of useful information available on the multi goat Web site in the modern era.
Information can be weaponized so multi go is also a useful defensive tool to look over an organization
and make sure that there are no points of compromise.
For example the I have I've been to transform that was run earlier in the video had it actually drawn
up a result we could have found compromised emails on pastebin along with their passwords and the individuals
who have been compromised might have absolutely no idea that they were compromised by that particular
breach.
And since security practices can be rather lax especially in some organizations if you have one person's
email and password if they use that same password and maybe email across multiple accounts then they
may be unwittingly creating a point of compromise that can be leveraged to break into higher level and
more secure areas of their life or their organization.
So good security practices are essential and multi go is a way of sniffing out these vulnerabilities
and correcting them before more nefarious individuals find these weaknesses and exploit them.
As was mentioned earlier in the video which you've seen used in this tutorial has been the multi go
Community Edition.
Now the community edition has the limits that I mentioned.
It is also not possible to export the graphs that you create to either make them into presentations
or for use with other tools.
But the licensed edition will allow these features to be utilized.
So if you like multi go and you use it a lot you should consider getting a license.
This concludes the basic introduction to the multi go tool.
I hope you enjoy it.
I hope you have a lot of fun playing around with it.
Thank you.