WEBVTT 00:00:01.640 --> 00:00:03.620 Hey there, welcome to our lab environment. 00:00:03.840 --> 00:00:07.010 In this demo, I'm using the Kali Linux version 2020, 00:00:07.030 --> 00:00:10.950 and I like to use Kali Linux because it already comes with Maltego preinstalled. 00:00:11.540 --> 00:00:13.080 But as I mentioned before, 00:00:13.210 --> 00:00:16.250 Maltego can be executed in pretty much all operational systems. 00:00:17.040 --> 00:00:19.950 So if you need to install on your computer, it's very simple. 00:00:20.440 --> 00:00:25.450 Just go to the maltego.com website, and then navigate to the Products, 00:00:26.110 --> 00:00:30.470 and then under the category Community, you click on Downloads. 00:00:30.470 --> 00:00:35.770 In here, you can select which operational system you have and download the file. 00:00:35.770 --> 00:00:38.080 And as the installation is pretty straightforward, 00:00:38.080 --> 00:00:41.480 I'll not be covering it here. But once you install Maltego, 00:00:41.540 --> 00:00:44.100 you can go to your launch menu, and open Maltego. 00:00:45.940 --> 00:00:46.480 Perfect. 00:00:46.710 --> 00:00:48.370 If it's the first time you're using this tool, 00:00:48.530 --> 00:00:51.640 you will see this screen here. In here we can select 00:00:51.640 --> 00:00:53.810 which version of Maltego we want to run. 00:00:54.640 --> 00:00:58.780 In our case, it is the Maltego Community Edition, or Maltego CE. 00:01:00.040 --> 00:01:02.750 Once I select this option, I'll get a license agreement. 00:01:03.440 --> 00:01:06.050 I'll have to click on Accept and press Enter. 00:01:07.510 --> 00:01:09.960 Then, you need to enter the login information for the 00:01:09.960 --> 00:01:12.480 tool. If you don't have a Maltego account, 00:01:12.720 --> 00:01:16.330 you can clicking on this link to create one. As I already 00:01:16.330 --> 00:01:18.250 have one account, I'll use it here. 00:01:21.100 --> 00:01:24.400 Perfect! It works. Now, Maltego will start to install some 00:01:24.400 --> 00:01:27.920 of its features. In here, it just asks you to confirm 00:01:27.930 --> 00:01:29.150 everything that will be installed. 00:01:29.740 --> 00:01:36.290 All we have to do is click on Next, and then Next again. And in here, we 00:01:36.290 --> 00:01:38.990 select if we want to run Maltego on stealthy mode, 00:01:39.320 --> 00:01:43.480 which means Maltego will not query any IPs directly. But in our case, 00:01:43.540 --> 00:01:45.300 as we're not doing anything illegal here, 00:01:45.330 --> 00:01:47.350 I'll use Maltego in the normal version. 00:01:48.440 --> 00:01:52.140 So then I click Next. And after that, 00:01:52.230 --> 00:01:56.490 Maltego asks us what to do next. As we know what we're doing here, I 00:01:56.490 --> 00:01:59.800 will just select the last option, Go away, and then click on Finish. 00:01:59.800 --> 00:02:05.510 Perfect. In this home screen, we have on the left the Maltego 00:02:05.510 --> 00:02:08.289 announcements, and on the right side, 00:02:08.300 --> 00:02:12.530 we have a list of all the transforms that we can install in Maltego. And 00:02:12.530 --> 00:02:15.350 remember, transforms are kind of like plug‑ins that expand the 00:02:15.350 --> 00:02:18.650 functionalities of Maltego, but we'll discuss that later. 00:02:19.040 --> 00:02:20.640 So, let's start by the beginning. 00:02:21.040 --> 00:02:25.910 Let's create the new blank project by clicking on this button here. 00:02:25.910 --> 00:02:30.840 Awesome, this is the Maltego work screen. On the left side, 00:02:30.850 --> 00:02:34.630 we have a list of entities that we can create in Maltego. And 00:02:34.630 --> 00:02:38.380 basically, entities are the nodes on the graph. For example, 00:02:38.390 --> 00:02:42.240 a domain is an entity, a person is also an entity, 00:02:42.350 --> 00:02:44.350 and even a website is an entity. 00:02:45.610 --> 00:02:49.920 In my case, I will add the domain entity to my graph. For that, I'll simply 00:02:49.920 --> 00:02:55.250 drag and drop the domain entity to my workspace. Perfect. In here, I'll 00:02:55.250 --> 00:02:59.630 double‑click on the domain name so I can edit it. Now, let's say I'm trying to 00:02:59.630 --> 00:03:02.450 gather information about the nasa.gov domain. 00:03:03.140 --> 00:03:05.750 So I would just type it and press Enter. 00:03:06.240 --> 00:03:06.870 There you go. 00:03:07.000 --> 00:03:11.320 Now I have one node in my graph. From here, I can run several transforms to 00:03:11.320 --> 00:03:15.350 get more information about this domain. For that, I will right‑click on the 00:03:15.350 --> 00:03:19.300 domain name to get the list of all the transforms available for this kind of 00:03:19.300 --> 00:03:22.290 domain entity. And to run a transform, 00:03:22.380 --> 00:03:24.750 I simply need to click on the name of the transform. 00:03:25.640 --> 00:03:30.150 For example, let me click on this To DNS Name ‑ name server. 00:03:31.240 --> 00:03:34.680 What this transform will do is to find out all the name servers related 00:03:34.690 --> 00:03:38.260 to that domain. Done. As you can see, in few seconds, 00:03:38.260 --> 00:03:40.950 we found the name of the name servers related to NASA. 00:03:41.540 --> 00:03:45.200 Also, if you take a look here on the Transform Output in the bottom, 00:03:45.290 --> 00:03:47.250 you will see the results of our transforms. 00:03:47.850 --> 00:03:50.650 It says that it was completed and returned few entities. 00:03:51.940 --> 00:03:52.460 Also, 00:03:52.470 --> 00:03:55.270 we can delete entities from the graph by selecting 00:03:55.270 --> 00:03:57.050 them and then pressing Delete. 00:03:57.940 --> 00:04:02.360 And then we just need to confirm that we want to Delete. Okay, 00:04:02.390 --> 00:04:03.560 enough of introductions. 00:04:03.870 --> 00:04:05.850 Now let's start our red team scenario. 00:04:06.590 --> 00:04:09.120 So, what we're trying to do is to collect technical 00:04:09.120 --> 00:04:11.350 information from the nasa.org domain. 00:04:12.140 --> 00:04:14.920 So, the first thing that I usually do is trying to find 00:04:14.930 --> 00:04:16.649 all the subdomains from our target. 00:04:17.540 --> 00:04:22.590 And for that I'll run this transform called To DNS Name from Robtex. And 00:04:22.590 --> 00:04:26.050 basically, this will check the Robtex database and return all the 00:04:26.050 --> 00:04:29.550 subdomains for NASA. And this may take a couple minutes, 00:04:29.610 --> 00:04:31.750 but to save your time, I'll speed up this video. 00:04:35.240 --> 00:04:36.370 Perfect. Done. 00:04:36.520 --> 00:04:40.570 As we can see, we have here 12 subdomains. And remember, 00:04:40.660 --> 00:04:43.030 the Maltego Community Edition is limited to a 00:04:43.030 --> 00:04:45.350 maximum of 12 results per transform. 00:04:45.840 --> 00:04:49.750 And this means that most likely there are tons of other subdomains for NASA. 00:04:50.140 --> 00:04:52.650 But take a look, we found some interesting ones here. 00:04:53.440 --> 00:04:58.850 Look at this one, admin.nasa. That's a promising one. But usually, I 00:04:58.850 --> 00:05:02.460 like to go for the least common subdomains, and that's because people 00:05:02.460 --> 00:05:04.520 usually patch the most important targets, 00:05:04.660 --> 00:05:06.650 but they forget to patch the small ones. 00:05:07.820 --> 00:05:09.240 So, for example, in this case, 00:05:09.330 --> 00:05:13.350 I would be interested in this one called 3d‑printing.nasa.gov. 00:05:14.540 --> 00:05:18.390 So, let me find the IP addresses for this domain. For that, 00:05:18.390 --> 00:05:21.560 I will right‑click on the DNS record and then select this 00:05:21.560 --> 00:05:23.950 transform called To IP Address. 00:05:25.910 --> 00:05:26.280 Awesome. 00:05:26.280 --> 00:05:30.850 Take a look, we got the IP address for this DNS record. And from here, I can 00:05:30.850 --> 00:05:35.330 even run another transform on this IP. For example, I can find the location of 00:05:35.330 --> 00:05:38.380 this IP by running this transform To Location. 00:05:40.510 --> 00:05:43.950 And, as we can see, this IP address is located in the United States. 00:05:45.740 --> 00:05:45.990 Cool. 00:05:45.990 --> 00:05:46.850 That's a really good start. 00:05:47.220 --> 00:05:49.950 But let's explore some more in‑depth information gathering. 00:05:50.600 --> 00:05:51.210 For example, 00:05:51.380 --> 00:05:57.120 let's take this DNS record here called aeronautics.nasa.gov. From 00:05:57.120 --> 00:06:00.950 here, I will right‑click and run this transform called To Web site, 00:06:01.530 --> 00:06:05.270 and this will do a small port scan on the DNS record to find which 00:06:05.270 --> 00:06:06.650 websites are hosted in there. 00:06:08.180 --> 00:06:08.540 Perfect. 00:06:08.540 --> 00:06:09.000 Take a look. 00:06:09.200 --> 00:06:12.750 We have this website here, aeronautics.nasa.gov. 00:06:13.640 --> 00:06:17.250 Now, let's try to find out which technologies this website uses. 00:06:17.940 --> 00:06:20.990 For that, I can right‑click on this website and run this 00:06:20.990 --> 00:06:23.450 transform called To Server Technologies. 00:06:24.440 --> 00:06:27.200 And what this transform will do is it's scanning the website 00:06:27.210 --> 00:06:29.560 and trying to identify all the technologies that are used in 00:06:29.560 --> 00:06:33.380 there. Perfect. Take a look. 00:06:33.830 --> 00:06:35.810 Now we know all the technologies used in there. 00:06:36.380 --> 00:06:36.980 For example, 00:06:36.990 --> 00:06:41.130 we know that this website was made using Drupal, and from here I could 00:06:41.130 --> 00:06:43.850 search for a Drupal vulnerabilities and try to exploit them. 00:06:44.740 --> 00:06:47.000 And that's pretty cool, right? In less than 10 minutes, 00:06:47.010 --> 00:06:50.810 we found tons of subdomains about our targets, and we also found tons of 00:06:50.820 --> 00:06:55.670 IP addresses, and even the location of the servers during scope. In here 00:06:55.680 --> 00:06:58.880 we even found the technology used in the websites that can be used for 00:06:58.880 --> 00:07:02.920 exploitation later. And all this information we got without typing a 00:07:02.920 --> 00:07:03.950 single line of code. 00:07:04.540 --> 00:07:07.500 And that's why I told you that Maltego is one of the most used tools by 00:07:07.500 --> 00:07:11.620 red teamers. All the information we got here is using public sources of 00:07:11.620 --> 00:07:14.050 information, so it's not illegal doing this. 00:07:14.940 --> 00:07:15.420 But again, 00:07:15.550 --> 00:07:18.810 don't try to hack into NASA. For example, don't try to exploit a 00:07:18.810 --> 00:07:21.550 vulnerability in there because then you'll be doing something 00:07:21.550 --> 00:07:25.230 illegal, and you'll be arrested in no time! Okay, 00:07:25.230 --> 00:07:26.670 once we have our information, 00:07:26.780 --> 00:07:30.270 we can save this project by clicking on the Save button. And then we 00:07:30.270 --> 00:07:32.750 just have to put a name on it and click on Save. 00:07:33.610 --> 00:07:36.250 And with this, we can close this screen and later come 00:07:36.250 --> 00:07:37.750 back to work in this project if we need!