WEBVTT 00:00:01.740 --> 00:00:04.100 Hey there, welcome to the Technical Information Gathering 00:00:04.100 --> 00:00:07.770 with Maltego CE. In this course, we'll talk about one of my 00:00:07.770 --> 00:00:09.670 favorite tools, the Maltego, 00:00:09.680 --> 00:00:12.600 which is really useful to automate information gathering. 00:00:13.740 --> 00:00:16.070 So if you've worked on writing an engagement before 00:00:16.079 --> 00:00:17.680 or even in penetration testing, 00:00:17.810 --> 00:00:20.750 you know that the first and most important step is to gather as 00:00:20.750 --> 00:00:23.250 much information as possible about our target. 00:00:23.840 --> 00:00:25.950 This is really important because usually the 00:00:25.950 --> 00:00:27.830 vulnerabilities are not in the main websites. 00:00:28.030 --> 00:00:29.420 They are usually in the small, 00:00:29.420 --> 00:00:33.240 hidden subdomains that people forget to patch. Usually, in a 00:00:33.240 --> 00:00:37.100 red team engagement, we need to gather subdomains, DNS data, IP 00:00:37.100 --> 00:00:40.090 addresses, technology information, people information, 00:00:40.260 --> 00:00:42.550 email addresses for phishing, and much more. 00:00:43.190 --> 00:00:43.670 In theory, 00:00:43.680 --> 00:00:45.600 we can find this information manually by executing 00:00:45.600 --> 00:00:47.550 some queries and doing some searches. 00:00:48.040 --> 00:00:48.580 However, 00:00:48.610 --> 00:00:52.650 what if I told you that I can get all this information with the only two clicks? 00:00:53.890 --> 00:00:56.650 For example, what if I tell you that if you give me a domain, 00:00:57.040 --> 00:01:00.970 I can find out this information in only two clicks? And even better, 00:01:00.970 --> 00:01:03.400 what if I tell you that if with two more clicks, 00:01:03.430 --> 00:01:06.100 I can draw down even more on this information to 00:01:06.100 --> 00:01:07.700 find more details about our target. 00:01:08.440 --> 00:01:13.640 That sounds pretty interesting, right? The automation capabilities and the user 00:01:13.650 --> 00:01:17.970 interface is what I love about Maltego. As you've seen in our demos, without 00:01:17.970 --> 00:01:21.420 needing to type a single comment, I can get all the information that I mentioned 00:01:21.420 --> 00:01:23.350 the previous slide in just a few seconds. 00:01:24.280 --> 00:01:27.400 Maltego is an open‑source intelligence gathering tool that 00:01:27.410 --> 00:01:29.850 also provides graphical link analysis. 00:01:30.600 --> 00:01:32.940 This tool is really known by red team specialists, 00:01:32.990 --> 00:01:35.650 as well as incident investigators and forensic teams. 00:01:36.740 --> 00:01:37.170 Also, 00:01:37.180 --> 00:01:40.270 a lot of law enforcement agencies use Maltego since it 00:01:40.270 --> 00:01:41.910 makes investigations way easier. 00:01:42.940 --> 00:01:46.440 The tool is developed by Paterva, which is a South African company, 00:01:46.540 --> 00:01:49.550 and it constantly releases updates and interesting new features. 00:01:50.540 --> 00:01:51.120 Also, 00:01:51.170 --> 00:01:54.520 there's a large community around this to, meaning that several third‑party 00:01:54.520 --> 00:01:57.850 companies release plugins that expands Maltego's capabilities. 00:01:58.440 --> 00:02:02.250 Those plugins are called transforms, and we'll talk more about them later. 00:02:04.240 --> 00:02:06.600 What I love about Maltego is that it can download the 00:02:06.600 --> 00:02:08.250 Community Edition version for free. 00:02:08.940 --> 00:02:11.520 This means that you can do tons of investigations and 00:02:11.520 --> 00:02:13.800 information gathering without spending any money. 00:02:14.540 --> 00:02:15.080 However, 00:02:15.140 --> 00:02:17.250 the free version has some limits in terms of the 00:02:17.250 --> 00:02:18.670 number of results that it can get. 00:02:18.980 --> 00:02:21.430 So, if you're using this tool for large engagements, 00:02:21.570 --> 00:02:23.280 you should get the paid version of the tool. 00:02:24.340 --> 00:02:25.300 As I mentioned before, 00:02:25.350 --> 00:02:29.310 Maltego is one of the most used tools for OSINT investigations, 00:02:29.740 --> 00:02:32.350 which stands for open‑source intelligence gathering. 00:02:33.080 --> 00:02:33.810 With Maltego, 00:02:33.820 --> 00:02:37.590 we can get tons of publicly available information in one single place. 00:02:38.380 --> 00:02:40.900 And the best part is, we don't have to type a single comment. 00:02:41.810 --> 00:02:42.530 For this reason, 00:02:42.650 --> 00:02:46.270 Maltego is used by large companies, as well as government agencies. 00:02:46.940 --> 00:02:49.750 And the secret behind Maltego is there are transforms. 00:02:50.390 --> 00:02:53.900 Basically, those are plugins us that, given one piece of information, 00:02:54.140 --> 00:02:56.850 it is able to find tons of other related information. 00:02:57.740 --> 00:03:00.150 So, let me give an example so you can understand this better. 00:03:01.710 --> 00:03:04.550 Imagine you have one domain that you want to get more information about. 00:03:05.240 --> 00:03:08.200 So then, we create one node in Maltego with the domain 00:03:08.200 --> 00:03:09.450 name that I want to investigate. 00:03:10.170 --> 00:03:10.830 In our case, 00:03:10.980 --> 00:03:13.260 let's say we want to investigate the domain, 00:03:13.260 --> 00:03:16.850 Globomantics.com. So then, I can right‑click on this node 00:03:16.860 --> 00:03:19.980 and run a transform called get subdomains, 00:03:20.740 --> 00:03:23.890 and this will run several searches on the background and retrieve 00:03:23.900 --> 00:03:26.050 all the subdomains for that specific domain. 00:03:27.140 --> 00:03:28.610 Once the results are retrieved, 00:03:28.830 --> 00:03:33.150 each subdomain will be another node object, and this means they can 00:03:33.150 --> 00:03:36.050 right‑click on one of those and get more information about it. 00:03:36.810 --> 00:03:37.430 For example, 00:03:37.440 --> 00:03:41.840 I can right‑click on the ftp.Globomantics.com and run a transformer 00:03:41.850 --> 00:03:47.410 called get IP addresses. In this way, Maltego will go and get the IP 00:03:47.410 --> 00:03:49.250 addresses for that specific subdomain. 00:03:50.640 --> 00:03:53.470 And then again, each IP that was found will be a node in 00:03:53.470 --> 00:03:56.360 the graph, and this means that we can right‑click on the 00:03:56.360 --> 00:03:58.250 IP and run another transform. 00:03:58.680 --> 00:03:59.290 For example, 00:03:59.300 --> 00:04:03.150 I can run a transform to get all the open ports for that specific IP. 00:04:04.040 --> 00:04:07.650 And from here, I could right‑click on the port and run even more transforms. 00:04:08.040 --> 00:04:09.410 But you got the idea, right? 00:04:10.540 --> 00:04:13.140 What we have to remember is that once you have one piece of 00:04:13.140 --> 00:04:15.160 information, which is a node in the graph, 00:04:15.260 --> 00:04:18.450 we can run a transform and get even more information about it. 00:04:19.640 --> 00:04:22.350 And this is valid, not only for technical information, but 00:04:22.350 --> 00:04:25.300 also for people information. For example, 00:04:25.340 --> 00:04:29.070 for the Globomantics.com domain, I can run a transform and find the 00:04:29.070 --> 00:04:32.890 key people in the company. And then, from the people, I can run 00:04:32.890 --> 00:04:35.350 another transform and get their email addresses. 00:04:36.140 --> 00:04:40.230 And from the email addresses, I get tons of other stuff. That's pretty cool, 00:04:40.230 --> 00:04:40.560 right? 00:04:40.840 --> 00:04:41.910 As you see in this course, 00:04:42.090 --> 00:04:44.720 there are a lot of transforms that will help you to gather any kind 00:04:44.720 --> 00:04:47.650 information from DNS addresses to phone numbers. 00:04:48.540 --> 00:04:49.680 Actually, up until now, 00:04:49.740 --> 00:04:53.250 Maltego has more than 100 transforms, and they always release new ones. 00:04:55.690 --> 00:04:58.970 If you're familiar with the red team kill chain, we can map Maltego 00:04:58.970 --> 00:05:02.670 through a Recon phase of this process. With Maltego, 00:05:02.680 --> 00:05:06.550 we can gather tons of technical and non‑technical information about our target. 00:05:08.640 --> 00:05:12.060 Also, if you map this course to the MITRE PRE‑ATT&CK framework, 00:05:12.140 --> 00:05:14.850 you note that in here we cover two main areas, 00:05:15.240 --> 00:05:18.250 Technical Information Gathering and People Information Gathering. 00:05:19.700 --> 00:05:22.850 Inside of Technical Information Gathering, we'll cover two techniques. 00:05:23.440 --> 00:05:25.990 The first one is conducted passive scanning, 00:05:26.340 --> 00:05:29.290 in which we use Maltego to get information about our target 00:05:29.300 --> 00:05:31.960 without actually probing any servers in our target. 00:05:33.240 --> 00:05:36.440 Also, we'll cover determining domain and IP addresses, 00:05:36.700 --> 00:05:41.390 which is the technique T1250. From the People Information 00:05:41.390 --> 00:05:44.060 Gathering area, we'll cover how to identify people of 00:05:44.070 --> 00:05:47.150 interest, which is the technique T1269. 00:05:48.010 --> 00:05:50.950 And those are just some of the areas that Maltego can uncover. 00:05:51.340 --> 00:05:53.940 With this tool, we can perform active scans, 00:05:54.220 --> 00:05:57.750 gather email addresses, gather phone numbers, and much more. 00:06:00.040 --> 00:06:01.440 So before going to our demo, 00:06:01.520 --> 00:06:03.750 let's take a minute to understand what I'll be doing here. 00:06:04.440 --> 00:06:04.910 First, 00:06:05.000 --> 00:06:07.570 let's say we're in a red team engagement, and we need to gather 00:06:07.570 --> 00:06:12.080 information about the Globomantics.com domain. From this domain, 00:06:12.140 --> 00:06:15.350 we use the Maltego transforms to get a list off all the 00:06:15.350 --> 00:06:17.850 subdomains. And from the subdomains, 00:06:17.930 --> 00:06:23.500 we use another transform to get a list of all the IPs on each subdomain. And 00:06:23.500 --> 00:06:27.290 also, in terms of People Information Gathering, we use the Maltego transform 00:06:27.430 --> 00:06:29.750 to get a list of the key technical people. 00:06:30.440 --> 00:06:32.980 And from this list of people, we will gather the email 00:06:32.980 --> 00:06:35.740 addresses. And just to have some fun, 00:06:35.780 --> 00:06:39.210 we can use another Maltego transform to find if any of those email 00:06:39.210 --> 00:06:41.750 addresses were seeing previous data breaches. 00:06:42.440 --> 00:06:45.880 That's interesting, right? From the list of subdomains, we can try to find 00:06:45.880 --> 00:06:50.310 vulnerable services that we can try to exploit. Or if you find any email 00:06:50.320 --> 00:06:53.840 address that was leaked in previous data breaches, we can try to use the 00:06:53.840 --> 00:06:59.230 leaked password to get into the account. For this lab, the only thing you 00:06:59.230 --> 00:07:00.850 need is the attacker machine. 00:07:01.640 --> 00:07:04.240 As Maltego runs on pretty much any operational system, 00:07:04.350 --> 00:07:08.480 you can use a Windows machine, a Linux machine, or even a MacOS machine. 00:07:09.220 --> 00:07:10.540 So, enough of talking. 00:07:10.780 --> 00:07:14.200 Let's go to our lab environment and gather some information about our targets.