4 releases of Maltego & Social Links: how they work and where to use them. Part 1

Social Links launches a series of articles about Maltego from one of our new users. In this case, the user discovered how to make fast intelligence and investigation using Maltego Pro and Enterprise plans, including Maltego One, Maltego CE (Community Edition), and Maltego Casefile. It was their first experience with Maltego, and after a few months, they shared this article with us. We found it impressive and just made minimal changes before sharing it with you: it should be useful for many OSINT specialists.

How did it start?

Surfing Facebook one evening, I wondered how much information do we share about ourselves on social media? The answer is a lot. But how can we keep track of that? Who else, except Google or Microsoft, has the resources and technology to process that much information? Creators of Maltego say – everyone. This article will analyze this tool's features, principles, and examples of the software in use.

We will specifically analyze the commercial version of Maltego. The free version is good, but looking at the features we can get only for a hefty price from third-party companies like Social Links is much more enjoyable. I'll be straight: this will probably be a series of articles about Maltego. As I get access to various additional perks of Maltego's commercial releases, I'll try to write about what each new option offers and if it's necessary at all.

According to the official Patreva website, "Maltego is an interactive data mining tool that renders directed graphs for link analysis. The tool is used in online investigations for finding relationships between pieces of information from various sources located on the Internet."

In other words, Maltego can gather data with set parameters on the internet, in open and not-so open sources. All of the collected data gets rendered in a graph with links between parts of the data.

Maltego has 3 core elements for this purpose: Entities, Transforms, and Links.

• Entities. Information that has been given some kind of logical meaning, for example, a specific person, company, computer, website, etc.
• Transforms. This is a method or a process. This is how Maltego pulls out and interprets the data discovered. For example, how it downloads data from a person's social media profile to the resulting graph.
• Links. This is a connection. They are built between Entities and reflect the logical connections between the elements.

Now, let's get straight to how we can use it and finally learn how our classmates are doing via social media. The creators of Maltego, Patreva, offer us the following releases to choose from.

MALTEGO CASEFILE

In this version, you cannot run Transforms (Social Links add-on is not available also). This release is used by people who run OSINT manually. They just need an ecosystem where they can keep their Sherlock Holmes notes. In this context, Maltego replaces a whiteboard with threads and photographs. The release does not limit the graph’s size that you can build. It allows commercial use. But it has only one upload function to the paid version of Maltego. Everything is free until you need to upload a necessary report.

MALTEGO CE (Community Edition)

This public version of Maltego is intended for educational purposes only. For Maltego CE, you can download free from Maltego Hub Social Links CE (no trial key needed). Social Links CE includes approximately 5% functionality of Social Links Pro version.

It is part of Kali Linux and gives users access to the so-called Free Transformation Hub – a list of companies that offer trials of their Transforms for Maltego. However, this release does not allow commercial use and only works with international social media.

The maximum output size for one Transform is limited to 12 entities. In other words, in an attempt to search or download any information, you will only get the first 12 results. The maximum graph size is 10,000 entities. There is no technical support here, but export is available in any form, including OSINT reports in PDF with graphs applied. All this comes with registration — you will need to create an account.

MALTEGO ONE

The basic commercial version of Maltego. It provides the possibility to visualize up to 1,000,000 pieces of information and their relationships, uploads size from one Transform is 64,000 results.

Want to search social media? Enjoy Social Links add-on. Want a download from the Shodan search engine on the site's ports and vulnerabilities? As you please! Want domain data and a history of IP address changes from the DomainTools service? Take it. The main thing is – to pay up and enjoy!

Maltego's Transforms Hub

Finally, a few words about Maltego's Transforms Hub. Here lies the main catch. Maltego itself is a pretty good tool. But what's called Standard OSINT Transforms is just a small set of basic mechanisms: uploading information from Bing, searching for a phone number using a US Telecom operator database, etc.

Not much. And here comes, like Batman, the Commercial Transform Hub to the rescue. It consists of companies that offer different Entities and Transforms for money and access to their functions to expand Maltego's capabilities. The word Free under some of them only means that they will let you download the package for free or a trial period.

To use Transforms from any company, you will need either an account on its website, an API key, or a license key. All this is only after clicking on the link to the website of these companies and only for money (with rare exceptions).

Here you can find one of the best Maltego add-ons for Open source and Social media intelligence Social Links Pro. In other words, the combination of Maltego & Social Links becomes a powerful instrument for intelligence purposes and occasionally for evidential purposes.

With Social Links, you can mine data from 50+ social networks, databases and use 700+ search methods empowered with face recognition and search by geo-coordinates. You will get a unique search in 30+ DarkNet forums and marketplaces without authorization by Phrase, PGP Key, alias; also, you can get analytics by Products and Locations (shipping from/to).

This is where I’m wrapping up the first part of the analysis. In the second part, we’ll see what Maltego can do and how it looks. I will review the interface and the basic functions of the software. Stay tuned for new posts.