<h1>Advanced Footprinting with Maltego (Part IV)</h1>

So far I have showing you how to get information about individuals, persons of interest. But Maltego can also be used to get information about companies/enterprises.

Your goal might be to get information about the company’s online presence and organization, about the network infrastructure or even about the attack surface. Maltego can be useful for any of these scenarios.

Footprinting a company using Maltego machines

If you have been reading my posts, you’ve probably guessed by now that I’m not a big fan of using Maltego’s machines. But it’s always a good idea to explain and demonstrate why.

In Maltego CE there are five machines designed to automatically get information about companies and they all start with a domain names as an input but they all use different transforms so the output will be completely different.

Remember what I did with Recon-ng? I was able to put together a lot of information on United Airlines only from open source origins. Let’s use that same company in Maltego to see what we discover.

This is the output of the Company Stalker machine:

And this is the output of the Footprint L1 machine:

Just for your reference, here is a sum of all the results:

• Company Stalker: 14 entities + 13 links
• Footprint L1: 66 entities + 74 links
• Footprint L2: 121 entities + 135 links
• Footprint L3: 147 entities + 164 links
• Footprint XXL: 205 entities + 217 links

However, as we have previously seen most of these entities are of no interest to us because their relationship with the target is not relevant.

Footprinting a company using Maltego entities

Starting with an entity is not a guarantee for success. If you just run all transforms without any criteria, you’ll end up with a huge number of information to analyze which will result in a huge waste of time.

Running all transforms

Let’s took a look at an example; starting with the company The New York Times and then running all transforms in the nytimes.com domain.

The result is a collection of 338 entities and 395 links:

But this graph has something we haven’t seen so far: results in the shape of squares? Let’s take a closer look.

By default, Maltego will create collections to clean up the graph by grouping 'similar' entities, making it easier to view portions of the graph and find the key relationships you are looking for.

The minimum number of entities needed to create a collection can be adjusted in the Collections tab.

Thus, our collections were formed because there were more than 25 similar entities in the results.

In my humble opinion, this is too messy because we have too many results at once. Therefore, my favorite approach is always to start with an entity in an empty graph and then run just some of the transforms, selecting the relevant information as I move along.

Running selected transforms

So, when running this kind of tasks I always take the time to filter and process the information immediately as it is delivered to me.

Let’s try and see what kind of results we can get by following this slow method.

• Create a new graph
• Search for “company” on the entities search box
• Drag the Company entity to the empty graph
• Rename it
• Run all the transforms

Before we go any further, let’s take a moment to analyze what we’ve got so far.

• We have three entities for united-airlines-flights; one company, one image and one domain
• We have exactly the same for United Airlines Deals; one company, one image and one domain
• We have two entities for United Airlines; one company and one image (empty)
• We have two entities for mileageplusupdates; one domain and one image (check the properties)
• And we have one domain; united.com

Merging similar Maltego entities

Maltego allows for these closely related entities to be merged into a single one, simplifying the graph and creating more complete entities.

Let’s start with united-airlines-flights.com.

• Select the three entities by clicking each one of them while holding the Shift key
• Right click
• Press the merge button

Now you have to choose the primary entity. Choose wisely keeping in mind that the outcome will be a new entity with the combined properties of the individual parts.

In this case, I’m going to choose as primary entity the domain because that is the one, I will eventually want to explore further. While the regular Maltego.domain entity has these properties:

The resulting entity has these properties:

• Repeat a similar procedure for United Airlines Deals.
• Merge the two entities with the United logo as they are both related to the mileageplusupdates
• Merge the two United Airlines entities
• Just for fun, hijack the logo from the mileageplusupdates entity and apply it to the company by replacing the image URL

This is the current situation; one company and four domains.

After a while, this is what I’ve got:

I have 204 entities and 276 links in a clean graph. Notice I’ve reduced the minimum size of the collections so now I have the Name Servers all nicely grouped together.

From here there are still many possibilities;

• I have three more full domains to explore
• I can drill down on the united.com website

But I don’t want to mess up this nice graph. Therefore, I copy the relevant entity to another graph and proceed from there:

And then I get something like this:

Conclusion: Even with all the limitations, Maltego’s Community Edition can be a very powerful tool for OSINT as long as you know how to take full advantage of all the available features.

In the next post I’ll show you how to footprint malware or suspicious sites.