Video: How to Use Maltego to Research & Mine Data Like an Analyst « Null Byte :: WonderHowTo

So much information exists online that it's easy to get lost in data while researching. Understanding the bigger picture can take a lot of time and energy, but narrowing the question to one that's easy to answer is the first step of any investigation. That's why analysts use open-source intelligence (OSINT) tools likeMaltego— to help refine raw data into a complete understanding of a situation.In this tutorial, we'll explore how to conduct an investigation using Maltego, which allows a researcher, pentester, or white hat hacker to mine huge amounts of data to visually discover patterns and answer critical questions.Null Byte has been holding a series of workshops for computer science college students in Pasadena, California, called "Cyber Weapons Lab." This lab focuses on exploring cyberweapons and the tools used in cyber conflicts around the world. One recent session focused on how OSINT professionals use tools like Maltego for reconnaissance and how these skills can be used for hacking or in industries like business intelligence.Don't Miss:How to Use Maltego to Do Network ReconnaissanceWhile recon is the first stage of any attack, it's important to note that these same skills are used by analysts in the public and private sector, like business intelligence, to help investors and businesses make important decisions. Many businesses pay a lot of money for the same kind of research skills hackers employ while assessing a target, so learning to be a good researcher can be a powerful fallback skill in life.Why Search Like an OSINT AnalystOur talk in the video below focuses on ways the average person can use tools like Maltego to conduct an investigation to get an advantage in job interviews, secure investors for a business project, or assess a competitor or potential partner before making a decision. Of course, these skills are also the same core research skills you will need to identify and profile a target in a pentesting engagement.These are powerful skills that will apply to many situations, so learning to turn data into understanding will expand your ability to learn anything with speed that will surprise everyone around you. You can check out our talk in the video below,and subscribe to the Null Byte YouTube channel for more.Good research revolves around the ability to ask an answerable question, refine your search to find the right data to answer it, and process the raw information into actionable intelligence.Intelligence is data that has been processed with context and understanding to produce meaning and is the difference between the refined product (like a report) of an OSINT investigation and the raw data points that support that understanding.Without context, data is not useful, so simply finding a lot of data does not make you a good researcher.Through using the intelligence collection cycle, we can plan ahead and avoid getting lost in the powerful tools that can return tons of data. If we don't have a firm idea of what we're searching for, we're likely to get swept away from the original point of our search.The point of intelligence is to plan your collection, find the right information, process and clean the information to begin building a picture, analyze the results, and turn that understanding into a report others can learn from.To demonstrate this process, let's conduct an investigation using Maltego CE, the free edition of Maltego.Step 1: Download Maltego CEMaltego is a program for mining data from all over the internet and displaying the relationships in an easy-to-understand graph that makes patterns very obvious. It features the ability to expand on a single piece of known information to a huge network of related data in a few simple clicks.Don't Miss:How to Find Vulnerabilities for Any Website Using NiktoMaltego is great at taking something like a screen name or email address and discovering everything there is to learn about related accounts or appearances on the internet in seconds. To get started, you candownload it from Paterva, the company responsible for Maltego.Because of how much data people share about themselves and others, Maltego and tools like it can be used to track people, groups, companies, or other organizations rather invasively. These tools pull huge amounts of data from APIs, apply "transform" algorithms to analyze and mine the data, and present the findings in a simple and easy-to-understand graphical view.Don't Miss:Reconnaissance with Recon-Ng, Part 1 (Getting Started)This kind of power and flexibility allows us to make some very specific questions answerable in a matter of clicks. After downloading Maltego, go through the guided installation and registration process to get a CE license key, and you'll be ready to begin your first investigation.Start Maltego and input your license key, and then, from the main screen pressCtrl + T(orCommand + Ton macOS) to open a new, empty tab. On the left side, you'll see the "entities" panel with a list of all the different kinds of data you can add to start with.Step 2: Conduct an InvestigationFor our test example, we decided to see if we could identify employees of The Guardian, a news outlet, who had their accounts compromised in data breaches. While this is a tricky question for Google to answer, we can stop relying on secondary source data like new media and get our own data with Maltego.Don't Miss:How to Use SpiderFoot for OSINT GatheringFirst, we'll need a sample of email addresses of Guardian employees. Since they're journalists, they'll probably be using PGP so sources can email them anonymously, but we'll try to find more employee emails to add too.Starting by dropping a web domain of "theguardian.com" into Maltego, right-mouse clicking and selecting the PGP transform gets us started with a list of employee emails found in the PGP keyserver.Now, we can select these emails all at the same time, and apply another transform to all of them. We'll run "HaveIBeenPwned" to find out if they were involved in any data breaches or any Pastebin dumps.Don't Miss:Scrape Target Email Addresses with TheHarvesterWe're in luck, as not only do we already have one breach, but several Pastebin dumps. Since we can see that several employee emails are included in the Pastebin dump, we can go to the link to discover if there might be more.Also See:Abusing DNS for ReconnaissanceIn this case, we are in luck again, since we found additional 90+ employee emails to add. We can simply paste them into Maltego, and Maltego will interpret the type of data and add them automatically.With these email addresses added, we can now run a transform against the entire sample to see if any have been involved in breaches, and see any patterns in the employees who were.It's also useful to expand the information on the data breaches we find, to learn what exactly the user lost in the breach. Doing so, we can even create lists of employees who were involved in breaches in which their passwords were leaked.Just like that, we can select only users who have lost passwords in the breach, meaning we can probably locate the data dumps in question on the internet to see the kinds of password the particular person likes to use. If we're really lucky, they may use the same password for many accounts.Don't Miss:Using the Nmap Scripting Engine (NSE) for ReconnaissanceHow Can You Use Maltego?By knowing how to ask relevant and answerable questions, you can learn a tremendous amount of important and specific information about pretty much anything. The insight derived from open source investigations powers many of the business decisions made today, and you can benefit from the same kind of information by using these tools to better understand situations you need to make a decision about.We explored how you can start with a single web domain, and in a few clicks mine for more information and relationships inside the data you find to produce a better understanding of a situation. This core skill of recon can help us target and configure cyber weapons as hackers, or understand the institutions and people we want to work with to make negotiations go more smoothly. As with all powerful tools, Maltego is a double-edged sword.The power is in your hands, so use it wisely! Thanks for reading, you can leave any questions in the comments or on our Twitter, andsubscribe to our YouTube channelfor more videos!Follow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image and screenshots by Kody/Null ByteRelatedHow To:Use Maltego to Target Company Email Addresses That May Be Vulnerable from Third-Party BreachesHow To:Use Maltego to Fingerprint an Entire Network Using Only a Domain NameHow To:Use Maltego to Monitor Twitter for Disinformation CampaignsHack Like a Pro:How to Use Maltego to Do Network ReconnaissanceHow To:Add spreadsheet snippets in Microsoft Excel: Mac 2008Market Reality:Computer Vision Shown the MoneyHow To:Scrape Target Email Addresses with TheHarvesterNews:Reputable Analyst Predicts Apple's AR Ambitions Are Heading to CarsMarket Reality:Boeing HorizonX Takes Flight with AR InvestmentHow To:Use the Buscador OSINT VM for Conducting Online InvestigationsNews:Glowing Bacteria Can Help Locate Devastating Hidden Land MinesNews:Microsoft Opens Access to Sensor Data on the HoloLens with 'Research Mode' UpdateMarket Reality:Analysts Continue to Paint Rosy Picture for Augmented Reality IndustryRecon:How to Research a Person or Organization Using the Operative FrameworkNews:Facebook's Brain Control Interface Research Could Eventually Produce Thought-Controlled AR WearablesNews:Good Luck Getting the iPhone 8—Limited Quantities for SeptemberHow To:Find Identifying Information from a Phone Number Using OSINT ToolsNews:And the Company with the Million-Mile Lead for Machine Learning Is ...Market Reality:Business Interest High, Adoption Low for Augmented RealityNews:Why You're Probably Always Going to See Those Ugly Dome-Shaped LiDARs on Driverless Fleet CarsNews:Retailers Benefit from Augmented Reality in Operations & Online Sales Over In-Store Experiences, Research SaysMarket Reality:Outlook for Augmented & Mixed Reality Remains FavorableNews:The Government Is Stealing Your Data from Angry Birds, Candy Crush, Facebook, & Other Mobile AppsNews:DAQRI Expands to the Software Side of Enterprise AR with Worksense App SuiteDev Report:IBM & Unity Partner to Offer AI Tool That Could Make Augmented Reality Apps SmarterNews:Analyst Says Apple Can Take Driverless Lead from TeslaNews:Ford Pins Its Survival on Driverless with Its New CEO AppointmentNews:Google Introduces AI for Its Android Services That Learns from You Without Compromising PrivacyHow To:Keep Stroke Patients Active at Home w/ Wii FitHow To:A Hitchhiker's Guide to the Internet: A Brief History of How the Net Came to BeProjection Mapping Minecraft:Mining in the Real WorldHow To:An Exhaustive Guide to Mining and Resource Collection in MinecraftHow To:Mine Bitcoin and Make MoneyOmegaville research (aka:mgabrys' underground challenge submission)News:Capturing insights of introvertsNews:Russia threatens to strike NATO missile defense sitesNews:The Federal Government Is Spying on Every Single American, Say NSA WhistleblowersHow To:Shorten URLs from the Command Line with PythonNews:Finding Hidden Metadata in Images (Oh, the Possibilities)News:Minecraft World's Ultimate Survival Guide, Part 4