Social Links launches a series of review articles about Maltego from one of our new users. If you have interesting sample cases how Social Links (social media Maltego add-on) helps you in your intelligence and investigations and would like share with other specialists, please contact us at email@example.com.
In this case, the user discovered how to make fast intelligence and investigation using the Maltego Classic and XL versions with the Social Links social media add-on. It was their first experience with Maltego, and after a few months, they shared this article with us. We found it very impressive and just made minimal changes before sharing it with you: it should be useful for many OSINT specialists.
Ladies and gentlemen, here we go....
Surfing Facebook one evening I wondered – how much information do we share about ourselves on social media? The answer is – a lot. But how can we keep track of that? Who else, except Google or Microsoft, has the resources and technology to process that much information? Creators of Maltego say – everyone. In this article, I will analyze this tool’s features, principles and examples of the software in use.
We will specifically analyze the commercial version of Maltego – the free version is good, but looking at the features that we can get only for a hefty price from third-party companies like Social Links is much more interesting.
I’ll be straight: this will probably be a series of articles about Maltego. As I get access to various additional perks of Maltego’s commercial releases I’ll try to write about what each new option offers and if it’s necessary at all.
According to the official Patreva website, ‘Maltego is an interactive data mining tool that renders directed graphs for link analysis. The tool is used in online investigations for finding relationships between pieces of information from various sources located on the Internet.’
In other, more simple words, Maltego can gather data with set parameters on the internet, in open and not-so open sources. All of the gathered data gets rendered in a graph with links between parts of the data.
Maltego has 3 core elements for this purpose: Entities, Transforms, and Links.
- Entities An object. Something or someone. Information that has been given some kind of logical meaning. For example, a specific person, company, computer, website, etc.
- Transforms This is a method or a process. This is how Maltego pulls out and interprets the data discovered. For example, how it downloads data from a person’s social media profile to the resulting graph.
- Links This is a connection. They are built between Entities and reflect the logical connections between the elements.
Here a sample
Now, let’s get straight to how we can all use it and finally learn how our classmates are really doing via social media.
The creators of Maltego, Patreva, offer us the following releases to choose from.
MALTEGO CASE FILE
In this version, you have no ability to run Transforms (Social Links add-on is not available also).
This release is used by people who run OSINT manually. They just need an ecosystem where they can keep their Sherlock Holmes notes.
In this context, Maltego replaces a whiteboard with threads and photographs. The release does not limit the size of the graph that you can build, it allows commercial use. But it has only one upload function – to the paid version of Maltego.
Yes. Everything is free until you need to upload a basic report.
Next up is Maltego CE (Community Edition).
MALTEGO CE (Community Edition)
This is the public version of Maltego, intended for educational use only. For Maltego CE you can download free from Maltego Hub Social Links CE (no trial key need). Social Links CE include approximately 5% functionality of Social Links Pro version.
It is part of Kali Linux and gives users access to the so-called Free Transformation Hub – a list of companies that offer trials of their Transforms for Maltego. However, this release does not allow commercial use and only works with international social media, you’ll find nothing on regional networks.
The maximum output size for one Transform is limited to 12 Entities. In other words, an attempt to search or download any information, you will only get the first 12 results. Maximum graph size is 10,000 Entities. Technical support is absent as a class, but export is available in any form, including in the OSINT reports in PDF with the graph applied. All this comes with registration (you will need to create an account for work).
Basic release of Maltego. This version offers the same basic Transforms package as in the CE release and access to the Commercial Transform Hub, and provide possibility to visualize a maximum of 10,000 pieces of information and their relationships instead 12 results like in Maltego CE version. Maltego Classic will fit investigations of normal complexity.
For additional fee, via the Transform Hub, you can connect data from a variety of public sources (OSINT), over 30 partners, as well as your own data.
Want to search social media? Enjoy Social Links add-on. Want a download from the Shodan search engine on the site’s ports and vulnerabilities? As you please! Want domain data and a history of IP address changes from the DomainTools service? Take it. The main thing is – pay up and enjoy!
MALTEGO XL (Extra Large)
For those who care about size. If you know what I mean.
Well, seriously, in this release, we get all the same functions as in Maltego Classic, but the size of the graph has grown from 10,000 Entities to 1,000,000! Upload size from one Transform is now not 10,000, but 64,000 results. I don’t know who might need this much information, but if it exists, then, following the laws of the market, there must be demand.
See the table below comparing all versions to clarify how exactly they differ.
Finally, a few words about the Maltego's Transforms Hub. Here lies the main catch. Maltego itself is a pretty good tool. But what’s called Standard OSINT Transforms is actually just a small set of basic mechanisms: uploading information from Bing, searching for a phone number using a US telecom operator database, etc.
Not much. And here comes, like Batman, the Commercial Transform Hub to the rescue.
It consists of companies that offer additional Entities and Transforms for money, as well as access to their functions to expand Maltego’s capabilities. The word Free under some of them only means that they will let you download the package for free, or there is a trial period. To use Transforms from any company, you will need either an account on its website, an API key, or a license key. All this – only after clicking on the link to the website of these companies and only for money (with rare exceptions).
Here you can find one of the best Maltego add-on for Open source and Social media intelligence – Social Links Pro. In other words, the combination of Maltego & Social Links becomes a very strong instrument for intelligence purposes and occasionally for evidential purposes. With Social Links, you can mine data from 50+ social networks, databases and use 700+ search methods empowered with Face Recognition and search by Geo-coordinates. You will get unique search in 30+ DarkNet forums and marketplaces without authorization by Phrase, PGP Key, Alias, also, you can get analytics by Products and Locations (shipping from/to).
This is where I end the first part of the analysis. In the second part – let's see what Maltego can do and how it looks. I will review the interface and the basic functions of the software. Stay tuned for new posts.
Part two coming soon!