Hack Like a Pro: How to Use Maltego to Do Network Reconnaissance « Null Byte :: WonderHowTo

Welcome back, my greenhorn hackers!Before we attempt to exploit any target, it is wise to do properreconnaissance. Without doing reconnaissance, you will likely be wasting your time and energy as well as risking your freedom. In previous guides, I have demonstrated multiple ways to perform reconnaissance including passive recon withNetcraft, active recon withNmaporhping3, recon by exploitingDNSorSNMP, andmany others.In this tutorial, we will be using an active tool calledMaltego, developed byPaterva, that can do many of these tasks with one simple scan. There is a community edition built into ourKali Linuxthat allows us 12 scans without purchasing Maltego. It is capable of a significant amount of information gathering about a prospective target in a single sweep of the domain.Using Maltego in Kali to Recon a Target NetworkMaltego is capable of gathering information about either a network or an individual; here we will focus on the former and leave individual information gathering for another time. We will be looking at gathering info on all the subdomains, the IP address range, the WHOIS info, all of the email addresses, and the relationship between the target domain and others.Step 1: Open Maltego & RegisterLet's start by firing up Kali and then opening Maltego. Maltego can be found in numerous places in Kali, but the easiest way to get to it is to go to Applications -> Kali Linux -> Top 10 Security Tools. Then, among the Top 10, you will find Maltego at number 5, as shown in the screenshot below.When you open Maltego, you will need to wait a brief moment for it to startup. After it finishes loading, you will be greeted by a screen asking you to register Maltego.Go ahead and register and save and remember your password as you will need it again the next time you login into Maltego.Step 2: Choose a Machine & ParametersAfter successfully registering and logging into Maltego, we will have to decide what type of "machine" we want to run against our target. In Maltego's parlance, a machine is simply what type of footprinting we want to do against our target. Here, we are focusing on the network footprinting, so our choices are:Company Stalker(this gathers email information)Footprint L1(basic information gathering)Footprint L2(moderate amount of information gathering)Footprint L3(intense and the most complete information gathering)Let's choose an L3 footprint that will gather as much information as we can; this is also the most time-consuming option, so be aware of that.Step 3: Choose a TargetNow, that we have chosen a type of machine for our footprinting, we will need to choose a target. Let's choose our friends atSANS, one of the leading IT security training and consulting firms in the world.Now, click "Finish" and let Maltego do its work.Step 4: ResultsMaltego will now begin to gather info on our target domain, sans.org, and display it on screen. In the screenshot below, we can see that Maltego has already collected the email addresses from the site, while it collects the nameservers and mail servers.Finally, we can click on "Bubble View" when Maltego is done and see all of the relationships between our target and its subdomains and linked sites.Maltego is an excellent tool to do network recon on our potential target, enabling us to do numerous types of recon in a single scan with a single tool. Maltego is also capable of doing individual recon, but we will leave that for my next Maltego article, my greenhorn hackers.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedVideo:How to Use Maltego to Research & Mine Data Like an AnalystHack Like a Pro:How to Hack Web Apps, Part 2 (Website Spidering with WebScarab)News:How to Study for the White Hat Hacker Associate Certification (CWA)How To:Use Maltego to Target Company Email Addresses That May Be Vulnerable from Third-Party BreachesHow To:Use Maltego to Monitor Twitter for Disinformation CampaignsHow To:Use Maltego to Fingerprint an Entire Network Using Only a Domain NameHow To:The Five Phases of HackingHack Like a Pro:How to Perform Stealthy Reconnaissance on a Protected NetworkHack Like a Pro:Reconnaissance with Recon-Ng, Part 1 (Getting Started)How To:Advanced Penetration Testing - Part 1 (Introduction)Hack Like a Pro:How to Spy on Anyone, Part 2 (Finding & Downloading Confidential Documents)Hack Like a Pro:Using the Nmap Scripting Engine (NSE) for ReconnaissanceHack Like a Pro:The Hacker MethodologyHack Like a Pro:How to Conduct Active Reconnaissance and DOS Attacks with NmapHack Like a Pro:How to Conduct OS Fingerprinting with Xprobe2Hack Like a Pro:How to Conduct Passive Reconnaissance of a Potential TargetHack Like a Pro:Getting Started with BackTrack, Your New Hacking SystemRecon:How to Research a Person or Organization Using the Operative FrameworkHow To:Scrape Target Email Addresses with TheHarvesterHack Like a Pro:How to Extract Metadata from Websites Using FOCA for WindowsHow to Hack Databases:Hunting for Microsoft's SQL ServerNews:AR-Enabled Moon Model Shoots Past Crowdfunding GoalHack Like a Pro:How to Exploit SNMP for ReconnaissanceHow To:Become a Computer Forensics Pro with This $29 TrainingHack Like a Pro:How to Conduct Passive OS Fingerprinting with p0fHow To:You Can Easily Hack Instagram for a Crazy Amount of Likes (But You Totally Shouldn't)Hack Like a Pro:How to Crack Private & Public SNMP Passwords Using OnesixtyoneHow To:Force Switch to T-Mobile or Sprint on Project FiHow To:Hack Lets You Fully Activate a Bootleg Copy of Windows 8 Pro for FreeHow To:The Official Google+ Insider's Guide IndexHacking Reconnaissance:Finding Vulnerabilities in Your Target Using NmapCamera Plus Pro:The iPhone Camera App That Does it All