WEBVTT

00:00:01.800 --> 00:00:02.120
Awesome.

00:00:02.120 --> 00:00:03.320
I hope you enjoyed the demos.

00:00:03.330 --> 00:00:07.050
But before we go, I want to show you some other features of Maltego.

00:00:07.840 --> 00:00:09.100
As I mentioned in the previous videos,

00:00:09.330 --> 00:00:12.650
the Maltego CE is a free version of the Maltego tool.

00:00:13.240 --> 00:00:14.730
It is a really good starting point,

00:00:14.840 --> 00:00:17.440
but it does have some limited numbers of transforms,

00:00:17.450 --> 00:00:20.300
and also limited amount of results per transform.

00:00:21.240 --> 00:00:25.160
Also, in theory, you cannot use Maltego CE for any commercial use,

00:00:25.160 --> 00:00:27.150
so keep that in mind.

00:00:27.150 --> 00:00:32.180
If you're planning to use the Montego in a daily basis for commercial purposes,

00:00:32.320 --> 00:00:36.140
it is recommended that you use the Maltego Classic or XL versions.

00:00:36.140 --> 00:00:38.870
And this version contains other OSINT transforms,

00:00:38.870 --> 00:00:42.500
as well as access to commercial hub and some order more interesting transforms.

00:00:43.640 --> 00:00:46.290
Or if you work in a company that is specializing in

00:00:46.290 --> 00:00:50.130
investigations or if you work in a law enforcement agency,

00:00:50.440 --> 00:00:53.980
then it is recommended that you have the Maltego Enterprise edition.

00:00:53.980 --> 00:00:57.390
And this allows you to have an on‑premise deployment so

00:00:57.390 --> 00:00:59.120
you can run your own transforms locally.

00:00:59.120 --> 00:01:02.000
And this also allows you to integrate with your own data

00:01:02.050 --> 00:01:04.170
and other systems that you might have.

00:01:04.170 --> 00:01:08.420
This version has no limits or rates, so you can use it as much as you want.

00:01:10.920 --> 00:01:13.820
In this course we cover only field transforms.

00:01:13.820 --> 00:01:16.850
However, Montego has tons of other interesting ones.

00:01:17.540 --> 00:01:18.120
For example,

00:01:18.230 --> 00:01:21.410
there are a few transforms that will help in Blockchain investigations.

00:01:22.040 --> 00:01:22.660
For example,

00:01:22.670 --> 00:01:25.930
you can give a Bitcoin wallet address and find out which

00:01:25.940 --> 00:01:27.750
other wallets had transactions with it.

00:01:28.490 --> 00:01:29.380
That's pretty cool, right?

00:01:29.710 --> 00:01:32.710
For example, if you paid money to criminals due to ransomware,

00:01:32.920 --> 00:01:34.300
you can track where the money went.

00:01:35.540 --> 00:01:35.990
Also,

00:01:36.090 --> 00:01:39.230
there are a few hash investigation transforms in which you can give a

00:01:39.230 --> 00:01:41.950
file hash and search for objects related to it.

00:01:42.740 --> 00:01:45.350
For example, let's say you just receive a suspicious file.

00:01:45.700 --> 00:01:49.250
You can get the MD5 hash and use Maltego to figure out if

00:01:49.250 --> 00:01:52.190
this hash is on any antivirus blacklists.

00:01:52.190 --> 00:01:55.860
And more than that, you can do threat intelligence searches.

00:01:56.190 --> 00:01:56.770
For example,

00:01:56.780 --> 00:02:00.190
you can give an IP address and use Maltego to find out if the

00:02:00.190 --> 00:02:03.080
IP is related to any malicious activity.

00:02:03.080 --> 00:02:07.700
And another interesting but creepy one is the phone number lookup

00:02:08.139 --> 00:02:11.180
in which you can give a person name and Maltego will try to find

00:02:11.180 --> 00:02:13.140
the phone number related to that person.

00:02:13.140 --> 00:02:15.830
Again it's not 100% sure that it will find a number,

00:02:15.950 --> 00:02:17.280
but it works in a lot of cases.

00:02:19.150 --> 00:02:23.050
Also, there's some transforms that'll allow you to enrich personal data,

00:02:23.840 --> 00:02:24.650
and what this means,

00:02:24.650 --> 00:02:28.150
that you can give a person name and use the Maltego transforms

00:02:28.150 --> 00:02:29.980
to find out their social media accounts,

00:02:30.180 --> 00:02:32.910
email addresses, and even photos related to the name.

00:02:34.440 --> 00:02:38.110
Also, you can use Maltego transforms to perform Shodan searches.

00:02:38.490 --> 00:02:39.030
For example,

00:02:39.040 --> 00:02:41.600
you can give an IP address and retrieve all the

00:02:41.600 --> 00:02:43.550
information that Shodan can provide to you.

00:02:44.540 --> 00:02:45.530
That's pretty cool, right?

00:02:45.890 --> 00:02:48.580
I do recommend you checking the Maltego transform library.

00:02:48.580 --> 00:02:50.750
There are more than 100 transforms in there.

00:02:53.440 --> 00:02:56.420
Also, if you want to know more about Montego and its versions,

00:02:56.580 --> 00:02:58.350
you can check its official documentation.

00:02:58.890 --> 00:03:01.950
In there, they have a really good description of each Maltego version,

00:03:02.170 --> 00:03:03.780
as well as the Maltego transforms.

00:03:04.840 --> 00:03:09.420
Also just as a reminder, if you're using Maltego in a paid red team engagement,

00:03:09.620 --> 00:03:11.650
you should get the paid version of Maltego.

00:03:12.440 --> 00:03:16.050
The Maltego Community Edition is only for non‑commercial purposes.

00:03:17.710 --> 00:03:20.410
Also, if you've got interest in the technical information gathering topic,

00:03:20.410 --> 00:03:23.330
check out this order course here at Pluralsight called

00:03:23.560 --> 00:03:26.000
Technical Information Gathering with theHarvester.

00:03:26.640 --> 00:03:29.440
And this is a really good course on how to get more detailed

00:03:29.440 --> 00:03:31.850
information about the people that work in a company.

00:03:33.300 --> 00:03:36.660
And in case you're wondering how to prevent you and your company from

00:03:36.660 --> 00:03:38.910
being target in such information‑gathering attacks,

00:03:39.260 --> 00:03:40.450
there are few recommendations.

00:03:41.340 --> 00:03:43.720
First, you can try to audit your own company,

00:03:44.020 --> 00:03:46.670
meaning use Maltego against your own company and

00:03:46.670 --> 00:03:47.950
see what it can find from there.

00:03:48.540 --> 00:03:53.220
Also, a fun thing to do is using Maltego to find more information about yourself.

00:03:53.220 --> 00:03:58.090
You might be surprised by the amount of information anyone can get about you.

00:03:58.090 --> 00:04:00.630
Another recommendation is to ensure that personal

00:04:00.630 --> 00:04:02.650
information is not available to the public.

00:04:03.340 --> 00:04:07.150
For example, make sure your email address is not available in any website.

00:04:08.430 --> 00:04:11.590
And if we're talking about a whole company it is important that all the

00:04:11.590 --> 00:04:13.970
employees go through security awareness trainings.

00:04:14.710 --> 00:04:17.850
So then they know what kind information they should be sharing or not.

00:04:20.600 --> 00:04:21.290
So that's it.

00:04:21.459 --> 00:04:23.250
That's the end our Maltego CE course.

00:04:23.780 --> 00:04:24.910
I hope you enjoyed the demos,

00:04:24.960 --> 00:04:28.570
and that now you have one or more tools in your cybersecurity toolbox.

00:04:28.570 --> 00:04:31.600
So thank you for watching and I'll see you in the next course.