Maltego

Overview

Maltego is a graphical OSINT and link analysis tool that visualizes relationships between entities. Transforms query data sources (Shodan, VirusTotal, WhoisXML, social media) and plot results as a graph, revealing connections that would be invisible in raw data dumps.

Getting Started

Launch

maltego

# Register a free account at maltego.com for Community Edition
# CE supports limited transforms per session

Core Concepts

• Entity: A data point (person, domain, IP, email, company, phone)
• Transform: A query that takes an entity and returns related entities
• Graph: The canvas where entities and their relationships are visualized
• Machine: An automated sequence of transforms

Basic Workflow

1. Create a new graph (File → New)
2. Drag an entity from the palette (e.g., Domain)
3. Double-click to set the value (e.g., target.com)
4. Right-click the entity → Run Transform → select transform
5. Results appear as connected nodes on the canvas

Entity Types

Domain          Website / DNS name
Website         URL endpoint
IPAddress       IPv4/IPv6 address
EmailAddress    Email
Person          Individual
Company         Organization
PhoneNumber     Phone
TwitterProfile  Twitter/X user
FacebookObject  Facebook profile
Location        Geographic location
Netblock        IP range
AS              Autonomous System

Useful Transform Groups

DNS from Domain         → A records, MX, NS, subdomains
IP from Domain          → Resolve to IP addresses
Domain from IP          → Reverse DNS
Whois from Domain       → Registrant info, dates
Emails from Domain      → Email enumeration via search engines
Related domains via SSL → Shared certificate → related domains
Sites from IP (Shodan)  → Websites hosted on an IP
Ports from IP (Shodan)  → Open ports (needs API key)
Files from Domain       → Documents indexed by Google
Persons from Email      → Social profiles linked to email

Transform Hub (Data Sources)

Configure under Transform Hub:

• Shodan — port scanning, banners
• VirusTotal — malware, URL reputation
• WhoisXML — WHOIS, DNS history
• HaveIBeenPwned — breach checks
• Social Links — social media OSINT
• PassiveTotal / RiskIQ — passive DNS, PDNS
• Recorded Future — threat intelligence

Machines (Automation)

Run under Machines menu:
- Company Stalker           Company → emails, people, sites
- L1 Machine (Domain)       Domain → IPs, emails, hosts
- Twitter Digger            Twitter handle → connections
- Find Wikipedia Edits      Person → Wikipedia edit history

Export & Reporting

File → Export Graph    → PDF, PNG, XML, XLSX
Tools → Export Entities → CSV of all entities in graph

Tips

• Community Edition limits 12 results per transform — Pro removes this
• Use Clustering (View menu) to group related entities and reduce visual noise
• Right-click on empty canvas → Copy Entire Graph to share investigation
• Bookmarks and entity Notes help document findings during investigation

Community Edition (free):
- 12 results per transform
- No commercial use
- Limited transforms

Pro / Enterprise:
- Unlimited results
- All transforms
- Team collaboration
- API integrations
- Commercial use

Vue d’ensemble

Maltego est un outil graphique d’OSINT et d’analyse de liens qui visualise les relations entre entités. Les transforms interrogent des sources de données (Shodan, VirusTotal, WhoisXML, réseaux sociaux) et affichent les résultats sous forme de graphe, révélant des connexions qui resteraient invisibles dans des données brutes.

Prise en main

# Lancer
maltego

# Créer un compte gratuit sur maltego.com pour la Community Edition
# La CE permet un nombre limité de transforms par session

Concepts de base

• Entity : une donnée (personne, domaine, IP, email, entreprise, téléphone)
• Transform : une requête qui prend une entité en entrée et retourne des entités liées
• Graph : la zone de travail où les entités et leurs relations sont visualisées
• Machine : une séquence automatisée de transforms

Workflow de base

1. Créer un nouveau graphe (File → New)
2. Glisser une entité depuis la palette (par ex. Domain)
3. Double-cliquer pour définir la valeur (par ex. target.com)
4. Clic droit sur l’entité → Run Transform → sélectionner le transform
5. Les résultats apparaissent sous forme de nœuds connectés sur le graphe

Types d’entités

Domain          Website / DNS name
Website         URL endpoint
IPAddress       IPv4/IPv6 address
EmailAddress    Email
Person          Individual
Company         Organization
PhoneNumber     Phone
TwitterProfile  Twitter/X user
FacebookObject  Facebook profile
Location        Geographic location
Netblock        IP range
AS              Autonomous System

Groupes de transforms utiles

DNS from Domain         → A records, MX, NS, subdomains
IP from Domain          → Resolve to IP addresses
Domain from IP          → Reverse DNS
Whois from Domain       → Registrant info, dates
Emails from Domain      → Email enumeration via search engines
Related domains via SSL → Shared certificate → related domains
Sites from IP (Shodan)  → Websites hosted on an IP
Ports from IP (Shodan)  → Open ports (needs API key)
Files from Domain       → Documents indexed by Google
Persons from Email      → Social profiles linked to email

Transform Hub (sources de données)

À configurer dans Transform Hub :

• Shodan : scan de ports, bannières
• VirusTotal : réputation de malwares et d’URLs
• WhoisXML : WHOIS, historique DNS
• HaveIBeenPwned : vérification de fuites
• Social Links : OSINT réseaux sociaux
• PassiveTotal / RiskIQ : DNS passif, PDNS
• Recorded Future : renseignement sur les menaces

Machines (automatisation)

À lancer depuis le menu Machines :
- Company Stalker           Company → emails, people, sites
- L1 Machine (Domain)       Domain → IPs, emails, hosts
- Twitter Digger            Twitter handle → connections
- Find Wikipedia Edits      Person → Wikipedia edit history

Export et rapports

File → Export Graph    → PDF, PNG, XML, XLSX
Tools → Export Entities → CSV of all entities in graph

Conseils

• La Community Edition limite à 12 résultats par transform : la version Pro lève cette limite
• Utiliser le Clustering (menu View) pour regrouper les entités liées et réduire le bruit visuel
• Clic droit sur une zone vide du graphe → Copy Entire Graph pour partager l’investigation
• Les Bookmarks et les Notes d’entité aident à documenter les découvertes pendant l’investigation

Community Edition (free):
- 12 results per transform
- No commercial use
- Limited transforms

Pro / Enterprise:
- Unlimited results
- All transforms
- Team collaboration
- API integrations
- Commercial use