Advanced Footprinting with Maltego (Part V)

To conclude this series of posts on Maltego, let´s see how we can use it to investigate several possible threats and their underlying infrastructure.

Using Maltego to investigate Indicators of Compromise (IoC)

One of the latest trends in the cybercrime arena is the use of DNSpionage. Imagine you fell victim to such an attack last year. Upon analysis, you have identified two strange domains:

• hr-wipro.com
• 0ffice36o.com

Investigating suspicious domains with Maltego

Let’s investigate the first one to see what’s going on:

Using PassiveTotal’s (PT) “Get Passive DNS” and VirusTotal’s (VT) “Domain Resolutions” transforms, Maltego identifies five IP addresses associated with the domain, two of them returned by both transforms.

Next, the “Detected URLs” transform (from VT) returns eight URLs either because they were detected by a vendor’s URL scanner or because they are listed in some InfoSec community blocklist.

Selecting each of these URLs will give access to a report where you can see why the URL is listed.

And this is the report:

Now you can check for the existence of subdomains (VT), their IP addresses and URLs.

Are there any malware samples associated with this domain? Was the domain tagged?

If we run the PT Get Malware and the Get Tags transforms, we will get some answers; 3 malware SHA-256 hashes, a DNSpionage tag and a Maltego phrase: Emerging Threats: Proofpoint.

If we run HybridAnalysis on the domain we will get an additional hash.

How are the domains classified? Are any reports available for the URLs?

The PT Get Classification transform will tell us the URLs are suspicious and the VT Check URL Report will give access to any available vendor reports.

At any time, you can also run the ThreatMiner transforms that will give you pretty much the same info with some extra details.

In the report you can see the legitimate domain the malware was trying to mimic.

Following a similar approach for 0ffice36o.com, I got these results after investigating a bit further on one of the hashes using ThreatMiner transforms:

• Malware to Filename
• Malware to Other Hashes
• Malware to Hosts

Investigating malware samples with Maltego

A few months ago, a new wave of attacks plagued the Internet with an updated version of trojan previously named BondUpdater.

It was a spearfishing campaign spreading a malicious Word document containing a macro that would attempt to install the trojan.

Using Maltego to research the SHA256 hash of the file, this is what I got:

• ThreatMiner provide links to full reports on the malware, links to related hashes, to several vendors who have detected the malware and reports on the malware variants.
• VirusTotal corroborated this information and added their own links to other reports.

Quite recently, the same threat actor was involved in a similar attack. Using only VirusTotal I created this simple graph just to show something else; sometimes different vendors give completely different names to the same malware. It would be very confusing if we had just a partial view of the big picture. But Maltego compiles everything for us so we know that in the end all these names refer exactly to the same thing:

Exporting Maltego results

Remember what we did in recon-ng to gather network infrastructure information? Well, we can do something similar in Maltego:

But how are we going to use this information?

We will have to export it to a useable format, like CSV.

In order to do that, all we have to do is go to the Import | Export tab and select Export Graph as Table

Now all we have to do is select the desired format.

Final conclusions:

• Maltego is a wonderful tool, but the CE edition is very limited.
• Get as many APIs as you can, otherwise the results will be very poor.
• Pay attention to the limitations enforced on the free APIs
• Keep in mind that you will get a lot more results using other tools, like Recon-ng

Next post: Advanced Reconnaissance with theHarvester

Advanced Footprinting with Maltego (Part IV)

So far I have showing you how to get information about individuals, persons of interest. But Maltego can also be used to get information about companies/enterprises.

Your goal might be to get information about the company’s online presence and organization, about the network infrastructure or even about the attack surface. Maltego can be useful for any of these scenarios.

Footprinting a company using Maltego machines

If you have been reading my posts, you’ve probably guessed by now that I’m not a big fan of using Maltego’s machines. But it’s always a good idea to explain and demonstrate why.

In Maltego CE there are five machines designed to automatically get information about companies and they all start with a domain names as an input but they all use different transforms so the output will be completely different.

Remember what I did with Recon-ng? I was able to put together a lot of information on United Airlines only from open source origins. Let’s use that same company in Maltego to see what we discover.

This is the output of the Company Stalker machine:

And this is the output of the Footprint L1 machine:

Just for your reference, here is a sum of all the results:

• Company Stalker: 14 entities + 13 links
• Footprint L1: 66 entities + 74 links
• Footprint L2: 121 entities + 135 links
• Footprint L3: 147 entities + 164 links
• Footprint XXL: 205 entities + 217 links

However, as we have previously seen most of these entities are of no interest to us because their relationship with the target is not relevant.

Footprinting a company using Maltego entities

Starting with an entity is not a guarantee for success. If you just run all transforms without any criteria, you’ll end up with a huge number of information to analyze which will result in a huge waste of time.

Running all transforms

Let’s took a look at an example; starting with the company The New York Times and then running all transforms in the nytimes.com domain.

The result is a collection of 338 entities and 395 links:

But this graph has something we haven’t seen so far: results in the shape of squares? Let’s take a closer look.

By default, Maltego will create collections to clean up the graph by grouping 'similar' entities, making it easier to view portions of the graph and find the key relationships you are looking for.

The minimum number of entities needed to create a collection can be adjusted in the Collections tab.

Thus, our collections were formed because there were more than 25 similar entities in the results.

In my humble opinion, this is too messy because we have too many results at once. Therefore, my favorite approach is always to start with an entity in an empty graph and then run just some of the transforms, selecting the relevant information as I move along.

Running selected transforms

So, when running this kind of tasks I always take the time to filter and process the information immediately as it is delivered to me.

Let’s try and see what kind of results we can get by following this slow method.

• Create a new graph
• Search for “company” on the entities search box
• Drag the Company entity to the empty graph
• Rename it
• Run all the transforms

Before we go any further, let’s take a moment to analyze what we’ve got so far.

• We have three entities for united-airlines-flights; one company, one image and one domain
• We have exactly the same for United Airlines Deals; one company, one image and one domain
• We have two entities for United Airlines; one company and one image (empty)
• We have two entities for mileageplusupdates; one domain and one image (check the properties)
• And we have one domain; united.com

Merging similar Maltego entities

Maltego allows for these closely related entities to be merged into a single one, simplifying the graph and creating more complete entities.

Let’s start with united-airlines-flights.com.

• Select the three entities by clicking each one of them while holding the Shift key
• Right click
• Press the merge button

Now you have to choose the primary entity. Choose wisely keeping in mind that the outcome will be a new entity with the combined properties of the individual parts.

In this case, I’m going to choose as primary entity the domain because that is the one, I will eventually want to explore further. While the regular Maltego.domain entity has these properties:

The resulting entity has these properties:

• Repeat a similar procedure for United Airlines Deals.
• Merge the two entities with the United logo as they are both related to the mileageplusupdates
• Merge the two United Airlines entities
• Just for fun, hijack the logo from the mileageplusupdates entity and apply it to the company by replacing the image URL

This is the current situation; one company and four domains.

After a while, this is what I’ve got:

I have 204 entities and 276 links in a clean graph. Notice I’ve reduced the minimum size of the collections so now I have the Name Servers all nicely grouped together.

From here there are still many possibilities;

• I have three more full domains to explore
• I can drill down on the united.com website

But I don’t want to mess up this nice graph. Therefore, I copy the relevant entity to another graph and proceed from there:

And then I get something like this:

Conclusion: Even with all the limitations, Maltego’s Community Edition can be a very powerful tool for OSINT as long as you know how to take full advantage of all the available features.

In the next post I’ll show you how to footprint malware or suspicious sites.

Advanced Footprinting with Maltego (Part III)

In the previous post, we saw how to use Maltego’s machines and entities to gather information using as a starting point the name or alias associated with that individual.

But there are many other possibilities and one of the most effective is to start with a valid e-mail address.

Footprinting a person using an e-mail address

Let’s try to find info on a journalist.

• Create a new graph
• Search for “email” on the entities search box
• Drag the Email Address entity to the empty graph
• Rename it
• Run the transforms according to your needs or goals

Another example: a politician

Another possible approach is to focus on the security breaches associated with a specific address

Footprinting a website to find people

Imagine you want to get information on someone but you have nothing to star with and your only clue is a supposed relationship with a certain website. Can Maltego help you? Let’s find out, shall we?

Getting personal information from websites

• Create a new graph
• Search for “domain” on the entities search box
• Drag the Domain entity to the empty graph
• Rename it
• Run the transforms according to your needs or goals

I used a test domain (sitiodepruebas.org) and I wanted to find out who the owner/webmaster was. The first step was to get additional info on the domain itself and that revealed the addresses of four websites.

These websites are related to a Twitter profile. Digging into that profile I’ve found a Linkedin profile and a relationship to another set of websites (sombreroblanco) and some of their social profiles.

Opening these profiles on the Internet gave me the final answer:

Both websites sitiodepruebas and sombreroblanco are run by someone named Diego Muñoz, a Chilean cybersecurity professional.

Getting personal information from companies

One other possible situation might occur when the only thing you know about someone is where that person works. In that scenario, Maltego can be very useful in getting additional info using the company as a starting point.

As you can see, Maltego will find the domain associated with the company and then it will find a number of e-mail addresses, persons and phone numbers.

Conclusion:

As you can see, Maltego is an excellent tool to conduct open source data mining across the Internet in spite of the obvious limitation of the Community Edition. Still, it can automate the process of gathering crucial reconnaissance on a potential target and save ourselves many hours of tedious work and potential missed links. But remember that a lot of the info won’t be relevant so double check everything.

In the next post I will show you how to get network related information.

Advanced Fooprinting with Maltego (Part II)

Footprinting is crucial for successful researchers, hackers or pentesters. Maltego is a wonderful tool for finding data from open sources across the Internet and displaying the relationships between this information in a graphical format.

Because of how much data people share about themselves and others, Maltego and tools like it can be used to track people, groups, companies, or other organizations rather invasively. These tools pull large amounts of data from APIs, apply "transform" algorithms to analyze and mine that data, and present the results in a very friendly graphical view. This kind of power and flexibility allows the user to make very specific questions answerable in a matter of clicks.

In this tutorial, we will see how to use Maltego to perform reconnaissance on a specific person. This might be used to help find or track that person, find what email addresses they use, find where they work or institutions they are associated with or even something as simple as a phone number.

Maltego is great at taking something like a screen name or email address and discovering everything there is to learn about related accounts or appearances on the Internet in seconds.

Fooprinting a person using a Maltego Machine

Let’s start by conducting a simple reconnaissance in an automated fashion by letting Maltego run a number of pre-selected transforms associated with one of the “machines” described in the previous post.

You can start the appropriate machines in two ways; either from the Machines tab or by pressing the Run Machine button in the top menu.

In both cases you will be prompted to enter the full name of the subject to be investigated. I will use as the first example a very famous personality:

When you press the Finish button, Maltego will immediately create a new graph and run the transforms include in the selected machine. When several results are found, you can select the interesting ones and discard the rest before the machine finishes processing the transforms.

And this is the end result:

If you select one of the e-mail addresses you can identify the transform responsible for getting the result so you know where the information came from.

But are these really related to the person we are trying to investigate?

Let’s try to find social media profiles associated with these e-mail addresses. Select the three e-mail addresses and right click to display the available transforms.

Running all transforms might be interesting but it will usually generate a lot of undesired information. I always select individual transforms according to the info I’m trying to obtain. Thus, I search for “social” in the menu

And now I run only this transform. After that, I searched for documents referring the target. This is the result (I already removed the rubbish):

As you can see, apparently none of these e-mail addresses is owned or used by Cristiano himself. And running other transforms will provide just a bit more information related to this person.

Let’s try now with a completely different persona; a well-known musician with a big social media footprint.

Again, the results are not very exciting…

Let’s make one more try; a movie star!

No comments…

Final attempt: a journalist very interested in cyber security.

Finally, some really interesting results. But maybe we should try a different approach.

Fooprinting a person using Maltego Entities

When you select to use the “Person – Email Address” machine, the starting point is a maltego.Person entity.

Now we are going to repeat the same queries, for the same persons, using as a starting point the maltego.Alias entity.

Starting with the Alias entity

Start by creating a new empty graph clicking on the button

By default, you should have the Entity Palette on the left side of the screen. If you don’t, go to the Windows tab and select it.

Now search for the “alias” entity

Drag it to the empty graph and rename it accordingly

You can try to run all available transforms but it will be confusing even with the 12 entities limitation enforced by Paterva on the Community Edition. Select just the relevant transforms for the list on the lower left side.

[Github] – Search by Alias returns several profiles with Cristiano’s name and one interesting only because it is following someone listed as “Principal Engineer at @Nike-Inc”

Twitter Affiliation returns several fan pages but it is easy to select only the real one by looking at the number of followers.

The Wikipedia page contains some relevant topics

And there are lots of documents referring his name.

For Eminem, this is the most relevant information:

All the social links on the left appear to be fake but I left them there exactly to highlight the need to be cautious with the gathered information.

Robert De Niro, apart from movies related information, has a very small digital footprint.

Brian Krebs has a significant online presence although many results are also irrelevant and not at all related to him. Curiously, Maltego was not able to find Brian’s Wikipedia page and his main website (https://krebsonsecurity.com/) was only found via the Twitter account associated with it.

In the next post we will explore other possibilities to get information on someone.