Maltego for Network Infrastructure Enumeration

New article on Using Maltego for Network Infrastructure Enumeration posted on EthicalHacker.net

Any organization that has an Internet presence needs to have some form of infrastructure to support their presence. During Infrastructure Enumeration you attempt to discover how much of it exists, what type of infrastructure is used, where it is located, what technology is used and how it is structured. This type of information is interesting for:

* Security assessments (as this is the first and most tedious phase of any external assessment).
* Getting an idea of the organization’s Internet and geographical presence.
* Gaining insight into the technology used by the organization.
* Making connections between seemingly unconnected organizations (as they might be sharing common infrastructure).
* Getting a list of brands or affiliations supported by the organization.

Read the article over on EthicalHacker.net
http://www.ethicalhacker.net/content/view/251/24/

Maltego Malware Domain List Transforms

Not much hype about the release but the Paterva crew has introduced some really useful transforms for Maltego that utilize Malware Domains List's database.

"We've created a transform application server for integration with the MalwareDomainList.com DB. If you want to see how it works you can download the Community Edition of Maltego (if you don't have it already) from http://www.paterva.com/maltego/.

Once you have it running you should go to Tools -> Manage transforms and click on Discover Transforms.
You can now add a new discovery server with name "MALTAS" and URL http://ctas.paterva.com/MALTAS.xml"

http://www.malwaredomainlist.com/forums/index.php?topic=1938.0

Screenshot!

Pretty handy when all you have is a possible bad IP and want to see if they are already on the "bad boy" list. Being able to see the URL serving up the malware is handy too so you can grab it for analysis.

New School Information Gathering ToorconX edition

Here is the outline for my New School Information Gathering talk that I gave at ToorconX.

Open Source Intelligence Gathering (OSINT)‏
FierceDNS
SEAT/Goolag
Google Mail Harvesters
Metagoofil
Online Tools: ServerSniff/DomainTools/CentralOps/Clez.net/Robtex/Spoke
Tying it all together with Maltego

I hid several slides to get the talk into the 20 minute time frame but you should see them in the posted slide deck.

Slides are available here:
http://www.carnal0wnage.com/research/Carnal-NewSchool-ToorconX.pdf

Comments and feedback are always welcome even though I received nothing back from all the people that emailed me asking for them last time :-(

-CG

Maltego for Information Gathering Part I

The first part of my article on Maltego for Information Gathering is available on EthicalHacker.net

http://www.ethicalhacker.net/content/view/202/24/

"According to their web site, "Paterva invents and sells unique data manipulation software. Paterva is headed by Roelof Temmingh who is leading a light and lethal team of talented software developers." On May 6 2008, they released a new version of a very kewl tool named Maltego.

"Maltego, is an open source intelligence and forensics application. It allows for the mining and gathering of information as well as the representation of this information in a meaningful way. Coupled with its graphing libraries, Maltego, allows you to identify key relationships between information and identify previously unknown relationships between them. It is a must-have tool in the forensics.security and intelligence fields!"

Chris Gates' talk at ChicagoCon 2008s entitled "New School Information Gathering" touched on many tools and techniques. One of the tools he introduced to the audience is Maltego v2. This first in a two part series expands on this new tool with a basic introduction to Maltego followed by step-by-step personal recon tutorials. Part II will focus on infrastructure enumeration with Maltego."

Maltego Community Edition Available

Paterva has released a community (free) edition of Maltego v2

From the site:

The Community Edition is limited in the following ways:

• A 15second nag screen
• Save and Export has been disabled
• Limited zoom levels
• Can only run transforms on a single entity at a time
• Cannot copy and paste text from detailed view
• Transforms limited to 75 per day
• Throttled client to TAS communication

http://www.paterva.com/maltego/community-edition/

Maltego v2 is out and its friggin awesome

I did a previous blog post using Maltego v1 and will be talking a bit about maltego at ChicagoCon but Maltego v2 is out and its a very nice upgrade.

from the site:

Version 2 of Maltego has been completely rewritten - it’s a complete new code base.
The following has been added from the KZ3 release:

• Load/Save of entire graphs means you can always go back to your investigation.
• Printing of graphs (over multiple pages) for discussions.
• Export of entities (CSV format) makes it easy to import Maltego data into other databases.
• Commercial grade layout library:
  • The layout and navigation have been optimized for speed and usability.
  • Four layout types to rearrange data the way YOU want it.
  • Two view types for finding relevant info on large graphs.
• More entities and 20 brand new transforms for even deeper searches and more information.
• Search/Find (on entity value, detailed info and additional fields) helps you to get to key nodes quicker.
• Multiple open graphs on different tabs for easy switching between graphs.
• Dedicated clear-all, zoom buttons for notebook users.
• Hollywood quality look & feel will impress your friends and your boss.
• Integrated help on transforms and entities to increase your learning curve.
• Complete user guide ensures you are never lost.
• Prepopulated and preconfigured transforms and transform sets saves you time.
• Population of API key integrated with license key so it’s never lost.
• Platform independent installer means you can install it anywhere.

I like it alot and one of the coolest features is the ability to create a graph and allow others to view it, not to mention print it out, save it, and export it as a .csv. Oh and the technorati blog keyword and link search is badass. You can check out this demo video to see what i am talking about: http://ctas.paterva.com/Maltego_Videos/Episode%203 and more screenshots here: http://www.paterva.com/maltego/screenshots/

I'm trying to tidy up slides for next week but expect a maltego post or article after chicagocon.

New Year Paranoia Thoughts

As we were at Safeway buying champagne and the sparking apple cider for the party last nite it really dawned on me the amount of personal data we give to stores in exchange for a couple dollars off at the register.

When you think about it, would you regularly post on the net when you buy condoms or butt cream from the drug store, or EVERYTHING you bought from the grocery store. While I don't consider myself strange or to have weird eating habits, I don't know that I'd be comfortable letting everyone know what I was buying -- even though evidently I am because i take my couple dollar discount.

While most of the info is just for marketing or statistics, some you have to wonder what its for. For example, Safeway (a grocery store) you enter in your phone number and you get the "Safeway member price" on alot of things that are on sale that week, thats cool, and i usually save 3 or 4 dollars per visit. But what does safeway do with that data? i don't get coupons or things like that in the mail or email (you only give them name and phone number but alot of stores ask for email now too) but where is all that information going and who is using it?

So, two thoughts I took away from it were:

1. Looking back at my maltego post (or just using google) look at the amount of information you can find about someone if you just know there name, email and phone number...kinda scary

2. Can that information be used to incriminate you? Say I was a suspect in a murder case and I had bought (and swiped my member rewards card) at the local hardware store when I bought lime, shovel, trash bags, and rope --hope I didn't pay with my debit mastercard either.

So, I guess my question is, in this day and age of really working hard to protect the privacy of our online identity with TOR, anonymous email accounts, limiting what personal information we do give out, and your favorite flavor or PGP do we need to work harder to protect our physical (real/human) identities, especially when that information is so easily and pretty much instantaneously transfered into the online realm?

I think I'll continue using the in-laws information at Safeway...just in case.

Happy New Year!

Paterva's Maltego for Information Gathering

If you haven't heard of Paterva's Maltego (formally Evolution) then you've been missing out! HD Moore and Valsmith first mentioned it in their tactical exploitation talk at Blackhat Vegas and Defcon.

From the Paterva Homepage:

• Maltego is a program that can be used to determine the relationships and real world links between:
  • People
  • Groups of people (social networks)
  • Companies
  • Organizations
  • Web sites
  • Internet infrastructure such as:
  • Domains
  • DNS names
  • Netblocks
  • IP addresses
  • Phrases
  • Affiliations
  • Documents and files

The documentation walks you through the initial setup and accepting of the transforms and getting API keys pretty well, so I wont cover it (go read you lazy bums). Once you get through that its time to use it.

Maltego comes with windows and linux binaries, so just run it ./maltego


Before you can start using Maltego you need to go to tools -->Manage transforms, then follow the wizard (read the documentation). you'll need to register on the Paterva site to get your API key and a couple other sites to get API keys from them.

Here is how Maltego looks after you start it up. To use it, you drag an icon from the infrastructure or personal section to the Maltego Graph (blue) section.

Using Person --> Chris Gates as the search

You can see in the Transform Execution section the results you got back from the various transforms and your graph being populated with the results

The Person --> Chris Gates output. it found several email addresses, forum posts, my Amazon profile, and other stuff that wasnt me (there are actually a ton of Chris Gates' out there).


We could have added a key word to really get better results for me specifically but given that we know the learnsecurityonline.com email is mine, lets use that for another search.

Let's check out doing Infrastructure --> Domain for learnsecurityonline.com


Not bad, I don't think the phone numbers are correct but the other results are relevant. We could have also used the whois transform and DNS bruteforce transform to enumerate some more hosts in the domain and to get the IP space.

That should be enough to get you started, i've been having fun picking random security bloggers I dont know to see what i can dig up about them, very fun. While I don't have a screenshot, the metadata search is awesome when Maltego finds "office" type documents and can be useful to reinforce you are on the track with your search.

Links!
Paterva: http://www.paterva.com
Maltego Downloads: http://www.paterva.com/web2/maltego/maltego-gui-1.0-download.html
Maltego Documentation: http://www.paterva.com/web2/maltego/maltego-docs.html

Presentations on Maltego:
CansecWest07 Presentation [PPT] (1.8MB)
FIRST 2007 Presentation [PPT] (4.5MB)