maltego: Open-source intelligence and forensics platform

Maltego is a graphical link-analysis and data-mining tool developed by Paterva (now Maltego Technologies). Unlike the other command-line tools in this chapter, Maltego is a full desktop GUI application built around the concept of “Transforms” — modular pieces of code that take an input entity (a domain, person, email address, phone number, IP, or organization) and return related entities, which are then plotted as nodes on an interactive visual graph. This graph-based approach makes Maltego exceptionally effective for visualizing complex relationships between people, infrastructure, and organizations that would be difficult to interpret from raw command-line text output.

Installation

Maltego is pre-installed on Kali Linux (Community Edition). It requires a free Maltego account (or paid license for commercial editions) to activate.

# Kali/Debian (pre-installed, or reinstall)
sudo apt update && sudo apt install maltego -y

# Manual download (Community/Classic/XL editions)
# Download the .deb installer from https://www.maltego.com/downloads/
sudo dpkg -i Maltego.v4.x.x.deb
sudo apt-get install -f   # resolve any missing dependencies

Launch Maltego:

maltego

On first launch, Maltego prompts for account registration/login and Transform Hub configuration.

Syntax

Maltego is a GUI application and does not use traditional CLI flags for its core workflow; the “syntax” of Maltego is expressed through its graph-building interface:

1. Drag an entity type (Domain, Person, Email Address, IP Address, etc.) onto the graph canvas.
2. Set the entity’s value (e.g., example.com).
3. Right-click the entity and select a Transform (or Transform Set) to run against it.
4. Review returned entities added to the graph, and repeat the process recursively.

A CLI companion, maltego-cli, exists for launching pre-built graphs or automating certain headless operations in enterprise deployments, but the primary interaction model is the GUI.

Command-Line Options

Flag/Component	Description
maltego	Launches the Maltego desktop GUI application
maltego --reset	Resets local configuration back to defaults
-J -jdkhome PATH	Specify a custom Java Development Kit path (Maltego runs on Java/NetBeans platform)
Transform Hub	GUI panel for installing/enabling Transform packs (e.g., “Have I Been Pwned”, “Shodan”, “SocialLinks”)
Machines	Pre-built automated Transform sequences (e.g., “Footprint L1/L2/L3”) runnable with a single click
Entity Palette	GUI panel listing all available entity types to drag onto the graph
Transform Manager	GUI screen for configuring API keys required by specific Transforms

Basic Usage

1. Launch Maltego and log in:

maltego

2. Create a new graph, drag a Domain entity onto the canvas, and set its value to example.com.
3. Right-click the entity → All Transforms → To DNS Name – NS (name server).
4. Maltego populates the graph with connected NS record entities discovered for the domain.

Practical Examples

Example 1 — Domain footprint using a built-in Machine

• Drag a Domain entity (example.com) onto the graph.
• Run the “Footprint L1” Machine.
• Result: the graph auto-populates with MX records, NS records, associated IP addresses, and any linked email addresses — all in one automated pass, displayed as a connected node graph.

Example 2 — Email address to social media accounts

• Drag an Email Address entity (john.smith@example.com) onto the graph.
• Run the “To Person” and “To Social Network Profiles” Transforms (via SocialLinks or similar Transform pack).
• Result: linked LinkedIn, Twitter, and other social profiles associated with that email surface as new nodes.

Example 3 — Domain to subdomains via DNS Transforms

• Drag a Domain entity (example.com) onto the graph.
• Right-click → “To DNS Name – MX”, “To DNS Name – NS”, and “To DNS Name (subdomains)”.
• Result: subdomains, mail servers, and name servers appear as separate connected nodes, all traceable back to the root domain.

Example 4 — IP address to netblock and co-hosted domains

• Drag an IP Address entity (93.184.216.34) onto the graph.
• Run “To Netblock” followed by “To Domain (DNS)” on the resulting netblock.
• Result: reveals other domains hosted on the same IP range — useful for discovering related infrastructure.

Example 5 — Organization to employee names (using a paid Transform pack)

• Drag an Organization entity (Example Corp) onto the graph.
• Run a LinkedIn-integrated Transform (via a licensed Transform pack such as SocialLinks).
• Result: employee names and job titles populate as Person entities linked to the Organization node.

Example 6 — Phone number to carrier/location info

• Drag a Phone Number entity onto the graph.
• Run “To Phone Number Details” via an installed Transform pack (e.g., integrating with a service like PhoneInfoga’s data or a commercial lookup API).
• Result: carrier, country, and line-type details attach to the phone number node.

Example 7 — Combining multiple entity types into one investigation graph

• Start with a Domain, expand to Email Addresses, expand those to Social Profiles, and expand an associated Person entity to Phone Numbers — building a single unified graph that visually links the organization’s digital footprint end-to-end.

Common Use Cases

• Visual mapping of an organization’s full digital footprint (domains, subdomains, IPs, emails, social profiles) for red team and OSINT engagements.
• Investigative journalism and fraud investigation — tracing connections between shell companies, individuals, and financial entities.
• Threat intelligence — linking malicious infrastructure (C2 domains, IPs) to related indicators of compromise across a campaign.
• Social engineering target profiling — building a complete picture of a specific employee’s public digital presence before a phishing simulation.
• Law enforcement and corporate investigations requiring clear, presentable visual evidence of entity relationships.

Automation with Bash

While Maltego is primarily GUI-driven, its graphs and Transform results can be exported and post-processed with bash:

Export a Maltego graph to CSV/GraphML from within the GUI (File → Export), then process it:

#!/bin/bash
# maltego_export_parse.sh
# Extract all "Email Address" entity values from an exported Maltego CSV
EXPORT_FILE="maltego_export.csv"
grep -i "EmailAddress" "$EXPORT_FILE" | cut -d',' -f2 | sort -u

Batch-launch Maltego with a pre-saved graph file for a repeatable starting point:

#!/bin/bash
# open_maltego_graph.sh
GRAPH_FILE="$1"
maltego --open "$GRAPH_FILE"

Note: Full headless/CLI automation of Transform execution typically requires Maltego’s commercial API/TDS (Transform Distribution Server) integration rather than the desktop Community Edition.

Tips and Best Practices

• Install and configure Transform Hub packs relevant to your engagement type before starting (e.g., “Shodan”, “Have I Been Pwned”, “VirusTotal”) — the free Community Edition ships with only a limited default Transform set.
• Use built-in “Machines” (automated multi-transform sequences like Footprint L1/L2/L3) to save time rather than manually running individual Transforms one at a time.
• Save graphs frequently (.mtgx files) — large investigations with hundreds of nodes can become unwieldy, and Maltego does not auto-save by default.
• Organize large graphs using entity grouping/bookmarking features to keep investigations readable as they grow.
• Respect Transform data-source rate limits — many free Transforms (e.g., via crt.sh, Shodan free tier) throttle heavy or rapid usage.

Troubleshooting

Problem	Cause	Fix
“Could not log in” on startup	Maltego account credentials invalid or network/firewall blocking Maltego’s auth servers	Verify credentials at maltego.com; check outbound HTTPS connectivity
Transform returns “0 results”	Required API key not configured for that Transform’s data source	Open Transform Manager and add the relevant API key
Graph becomes slow/unresponsive with many nodes	Extremely large graph exceeding available system memory	Increase Java heap size in Maltego’s config, or split the investigation into multiple smaller graphs
Community Edition Transform limits reached	Free CE tier restricts number of results per Transform run (typically 12)	Upgrade to Maltego Classic/XL/Pro licensing for unrestricted result counts
Application fails to launch	Java runtime issues or corrupted install	Reinstall via sudo apt install --reinstall maltego, ensure a compatible JDK is present

References

• Official Maltego website: https://www.maltego.com/
• Maltego Transform Hub: https://www.maltego.com/transform-hub/
• Kali Linux tool page: https://www.kali.org/tools/maltego/
• Maltego documentation portal: https://docs.maltego.com/