19. Information Gathering and Scanning
19.4 Maltego Introduction
Maltego is a graphical link-analysis tool. You drop an entity (a domain, person, email, IP) on a graph and run transforms – small queries that return related entities. The result is a picture of how things connect: domain → DNS names → IPs → netblocks → organisation. Investigators and threat-intelligence teams love it because relationships are much easier to see as a graph than as a list.
| Maltego term | Meaning |
|---|---|
| Entity | One object: Domain, DNS Name, IP Address, Email, Person, etc. |
| Transform | A query that takes one entity and returns related ones |
| Graph | The canvas where entities and links appear |
| Transform Hub | Where transform packs (free and commercial) are enabled |
On Kali, Maltego asks you to sign in and choose an edition (the free Community Edition has limits on results). Most transforms query internet services, so on a real target they are OSINT and must be in scope. The UI and edition details may vary – follow the current screens.
Why this matters for security
Blue teams use exactly the same graph idea to map their own attack surface: which subdomains point where, which old servers are still in DNS, which staff emails are public. Doing this for your own organisation before an attacker does is a normal defensive task.
Ravindra Bagale's Tip
Maltego ughadlya-ughadlya students sagle transforms ekdam "Run All" kartat – graph shekdo entities ni bharto aani kahich samjat nahi. Ek entity, ek transform, mag vichar kara "he kay sangtay?". Aani lakshat theva, transforms internet var jatat – lab madhe hand-made graph ne suruvat kara.
Lab
Open Maltego and create a new blank graph (no transforms against real domains). Manually add a Domain entity lab.local, DNS Name entities for each host from your 19.2 AXFR file, and an IP Address entity 192.168.56.20; link them. Add a note on the dev and vpn nodes: "should this be in public DNS?". Export the graph as an image for your notes.