<h1>Advanced Fooprinting with Maltego (Part II)</h1>

Footprinting is crucial for successful researchers, hackers or pentesters. Maltego is a wonderful tool for finding data from open sources across the Internet and displaying the relationships between this information in a graphical format.

Because of how much data people share about themselves and others, Maltego and tools like it can be used to track people, groups, companies, or other organizations rather invasively. These tools pull large amounts of data from APIs, apply "transform" algorithms to analyze and mine that data, and present the results in a very friendly graphical view. This kind of power and flexibility allows the user to make very specific questions answerable in a matter of clicks.

In this tutorial, we will see how to use Maltego to perform reconnaissance on a specific person. This might be used to help find or track that person, find what email addresses they use, find where they work or institutions they are associated with or even something as simple as a phone number.

Maltego is great at taking something like a screen name or email address and discovering everything there is to learn about related accounts or appearances on the Internet in seconds.

Fooprinting a person using a Maltego Machine

Let’s start by conducting a simple reconnaissance in an automated fashion by letting Maltego run a number of pre-selected transforms associated with one of the “machines” described in the previous post.

You can start the appropriate machines in two ways; either from the Machines tab or by pressing the Run Machine button in the top menu.

In both cases you will be prompted to enter the full name of the subject to be investigated. I will use as the first example a very famous personality:

When you press the Finish button, Maltego will immediately create a new graph and run the transforms include in the selected machine. When several results are found, you can select the interesting ones and discard the rest before the machine finishes processing the transforms.

And this is the end result:

If you select one of the e-mail addresses you can identify the transform responsible for getting the result so you know where the information came from.

But are these really related to the person we are trying to investigate?

Let’s try to find social media profiles associated with these e-mail addresses. Select the three e-mail addresses and right click to display the available transforms.

Running all transforms might be interesting but it will usually generate a lot of undesired information. I always select individual transforms according to the info I’m trying to obtain. Thus, I search for “social” in the menu

And now I run only this transform. After that, I searched for documents referring the target. This is the result (I already removed the rubbish):

As you can see, apparently none of these e-mail addresses is owned or used by Cristiano himself. And running other transforms will provide just a bit more information related to this person.

Let’s try now with a completely different persona; a well-known musician with a big social media footprint.

Again, the results are not very exciting…

Let’s make one more try; a movie star!

No comments…

Final attempt: a journalist very interested in cyber security.

Finally, some really interesting results. But maybe we should try a different approach.

Fooprinting a person using Maltego Entities

When you select to use the “Person – Email Address” machine, the starting point is a maltego.Person entity.

Now we are going to repeat the same queries, for the same persons, using as a starting point the maltego.Alias entity.

Starting with the Alias entity

Start by creating a new empty graph clicking on the button

By default, you should have the Entity Palette on the left side of the screen. If you don’t, go to the Windows tab and select it.

Now search for the “alias” entity

Drag it to the empty graph and rename it accordingly

You can try to run all available transforms but it will be confusing even with the 12 entities limitation enforced by Paterva on the Community Edition. Select just the relevant transforms for the list on the lower left side.

[Github] – Search by Alias returns several profiles with Cristiano’s name and one interesting only because it is following someone listed as “Principal Engineer at @Nike-Inc”

Twitter Affiliation returns several fan pages but it is easy to select only the real one by looking at the number of followers.

The Wikipedia page contains some relevant topics

And there are lots of documents referring his name.

For Eminem, this is the most relevant information:

All the social links on the left appear to be fake but I left them there exactly to highlight the need to be cautious with the gathered information.

Robert De Niro, apart from movies related information, has a very small digital footprint.

Brian Krebs has a significant online presence although many results are also irrelevant and not at all related to him. Curiously, Maltego was not able to find Brian’s Wikipedia page and his main website (https://krebsonsecurity.com/) was only found via the Twitter account associated with it.

In the next post we will explore other possibilities to get information on someone.