← retour aux outils back to tools

# Maltego

Plateforme OSINT et d'analyse de liens visuelle. Cartographie les relations entre personnes, entreprises, domaines, IPs et profils sociaux via des transforms provenant de 50+ fournisseurs de données. Visual link analysis and OSINT platform. Maps relationships between people, companies, domains, IPs, and social profiles via transforms from 50+ data providers.

↗ https://www.maltego.com

## Overview

Maltego is a graphical OSINT and link analysis tool that visualizes relationships between entities. Transforms query data sources (Shodan, VirusTotal, WhoisXML, social media) and plot results as a graph, revealing connections that would be invisible in raw data dumps.

## Getting Started

Launch

    maltego

    # Register a free account at maltego.com for Community Edition
    # CE supports limited transforms per session

## Core Concepts

- Entity: A data point (person, domain, IP, email, company, phone)
- Transform: A query that takes an entity and returns related entities
- Graph: The canvas where entities and their relationships are visualized
- Machine: An automated sequence of transforms

## Basic Workflow

1. Create a new graph (File → New)
2. Drag an entity from the palette (e.g., Domain)
3. Double-click to set the value (e.g., `target.com`)
4. Right-click the entity → Run Transform → select transform
5. Results appear as connected nodes on the canvas

## Entity Types

    Domain          Website / DNS name
    Website         URL endpoint
    IPAddress       IPv4/IPv6 address
    EmailAddress    Email
    Person          Individual
    Company         Organization
    PhoneNumber     Phone
    TwitterProfile  Twitter/X user
    FacebookObject  Facebook profile
    Location        Geographic location
    Netblock        IP range
    AS              Autonomous System

## Useful Transform Groups

    DNS from Domain         → A records, MX, NS, subdomains
    IP from Domain          → Resolve to IP addresses
    Domain from IP          → Reverse DNS
    Whois from Domain       → Registrant info, dates
    Emails from Domain      → Email enumeration via search engines
    Related domains via SSL → Shared certificate → related domains
    Sites from IP (Shodan)  → Websites hosted on an IP
    Ports from IP (Shodan)  → Open ports (needs API key)
    Files from Domain       → Documents indexed by Google
    Persons from Email      → Social profiles linked to email

## Transform Hub (Data Sources)

Configure under Transform Hub:

- Shodan — port scanning, banners
- VirusTotal — malware, URL reputation
- WhoisXML — WHOIS, DNS history
- HaveIBeenPwned — breach checks
- Social Links — social media OSINT
- PassiveTotal / RiskIQ — passive DNS, PDNS
- Recorded Future — threat intelligence

## Machines (Automation)

    Run under Machines menu:
    - Company Stalker           Company → emails, people, sites
    - L1 Machine (Domain)       Domain → IPs, emails, hosts
    - Twitter Digger            Twitter handle → connections
    - Find Wikipedia Edits      Person → Wikipedia edit history

## Export & Reporting

    File → Export Graph    → PDF, PNG, XML, XLSX
    Tools → Export Entities → CSV of all entities in graph

## Tips

- Community Edition limits 12 results per transform — Pro removes this
- Use Clustering (View menu) to group related entities and reduce visual noise
- Right-click on empty canvas → Copy Entire Graph to share investigation
- Bookmarks and entity Notes help document findings during investigation

Maltego CE vs Pro

    Community Edition (free):
    - 12 results per transform
    - No commercial use
    - Limited transforms

    Pro / Enterprise:
    - Unlimited results
    - All transforms
    - Team collaboration
    - API integrations
    - Commercial use

## Vue d’ensemble

Maltego est un outil graphique d’OSINT et d’analyse de liens qui visualise les relations entre entités. Les transforms interrogent des sources de données (Shodan, VirusTotal, WhoisXML, réseaux sociaux) et affichent les résultats sous forme de graphe, révélant des connexions qui resteraient invisibles dans des données brutes.

## Prise en main

    # Lancer
    maltego

    # Créer un compte gratuit sur maltego.com pour la Community Edition
    # La CE permet un nombre limité de transforms par session

## Concepts de base

- Entity : une donnée (personne, domaine, IP, email, entreprise, téléphone)
- Transform : une requête qui prend une entité en entrée et retourne des entités liées
- Graph : la zone de travail où les entités et leurs relations sont visualisées
- Machine : une séquence automatisée de transforms

## Workflow de base

1. Créer un nouveau graphe (File → New)
2. Glisser une entité depuis la palette (par ex. Domain)
3. Double-cliquer pour définir la valeur (par ex. `target.com`)
4. Clic droit sur l’entité → Run Transform → sélectionner le transform
5. Les résultats apparaissent sous forme de nœuds connectés sur le graphe

## Types d’entités

    Domain          Website / DNS name
    Website         URL endpoint
    IPAddress       IPv4/IPv6 address
    EmailAddress    Email
    Person          Individual
    Company         Organization
    PhoneNumber     Phone
    TwitterProfile  Twitter/X user
    FacebookObject  Facebook profile
    Location        Geographic location
    Netblock        IP range
    AS              Autonomous System

## Groupes de transforms utiles

    DNS from Domain         → A records, MX, NS, subdomains
    IP from Domain          → Resolve to IP addresses
    Domain from IP          → Reverse DNS
    Whois from Domain       → Registrant info, dates
    Emails from Domain      → Email enumeration via search engines
    Related domains via SSL → Shared certificate → related domains
    Sites from IP (Shodan)  → Websites hosted on an IP
    Ports from IP (Shodan)  → Open ports (needs API key)
    Files from Domain       → Documents indexed by Google
    Persons from Email      → Social profiles linked to email

## Transform Hub (sources de données)

À configurer dans Transform Hub :

- Shodan : scan de ports, bannières
- VirusTotal : réputation de malwares et d’URLs
- WhoisXML : WHOIS, historique DNS
- HaveIBeenPwned : vérification de fuites
- Social Links : OSINT réseaux sociaux
- PassiveTotal / RiskIQ : DNS passif, PDNS
- Recorded Future : renseignement sur les menaces

## Machines (automatisation)

    À lancer depuis le menu Machines :
    - Company Stalker           Company → emails, people, sites
    - L1 Machine (Domain)       Domain → IPs, emails, hosts
    - Twitter Digger            Twitter handle → connections
    - Find Wikipedia Edits      Person → Wikipedia edit history

## Export et rapports

    File → Export Graph    → PDF, PNG, XML, XLSX
    Tools → Export Entities → CSV of all entities in graph

## Conseils

- La Community Edition limite à 12 résultats par transform : la version Pro lève cette limite
- Utiliser le Clustering (menu View) pour regrouper les entités liées et réduire le bruit visuel
- Clic droit sur une zone vide du graphe → Copy Entire Graph pour partager l’investigation
- Les Bookmarks et les Notes d’entité aident à documenter les découvertes pendant l’investigation

Maltego CE vs Pro

    Community Edition (free):
    - 12 results per transform
    - No commercial use
    - Limited transforms

    Pro / Enterprise:
    - Unlimited results
    - All transforms
    - Team collaboration
    - API integrations
    - Commercial use