People
Real humans and their online masks.
- > Names
- > Email Addresses
- > Phone Numbers
Visualizing relationships for intelligence gathering.
Learn how to perform open-source intelligence (OSINT) and visualize complex data relationships.
Think of a detective movie. The detective has a big board on the wall. They pin up pictures of suspects and tie red strings between them to show how they connect. Maltego is that board, but inside your computer.
Reading a long list of 1,000 email addresses is very hard. It is boring. Your brain cannot see the patterns. You might look at the list for hours and learn nothing.
Looking at a picture is easy. If you see one circle connected to 50 other circles by thick lines, you instantly know what is important. Maltego turns boring words into clear pictures.
Every map needs points. In Maltego, these points are called Entities. An entity is just a piece of a clue. Here are the main types of clues you can find:
Real humans and their online masks.
Places on the internet where data lives.
The machines that run the internet.
Bad things that can cause harm.
In Maltego, you start with one single clue. You right-click it and choose a Transform. A transform is a search tool. It takes your one clue, searches the internet, and brings back new clues that are connected to the first one. Let's look at how it grows.
One Email Address
Three New Clues Found!
How do people actually use this? Let us pretend we are trying to find out who made a bad website that steals passwords.
We start with a clue. We put the fake website name (like "stealyourpassword.com") into our map.
We click a button to ask: "What computer runs this website?" Maltego draws a line to a new box showing an IP Address.
We click the IP Address and ask: "Who pays for this computer?" Maltego searches records and gives us a name: "John Doe".
Now our map shows a clear path from the bad website, to the computer, right to the real person. The mystery is solved.
Maltego does not hack or break into secret files. It only looks at things that are already public. It is like an extremely fast librarian that reads the whole internet for you.
Lists of who owns what website, company names, and public phone books.
Public profiles, public posts, and connections people share openly.
Lists made by good guys that track known bad websites and viruses.
Law enforcement uses it to build maps of criminal gangs, showing who talks to who.
Security teams use it to see if their company's computers are safe or if hackers are attacking them.
Journalists use it to uncover hidden facts and prove who is secretly paying for fake news.
When you open the program, the screen is broken into three simple parts.
This is the menu on the side. It has a list of all the different puzzle pieces you can drag onto your screen.
This is the big blank space in the middle. This is where you draw your map and connect the dots.
This is a small box that shows you the exact words and numbers behind the picture you clicked on.
Because this map-making tool is very powerful, you must use it properly. Do not spy on regular people for fun. Do not use it to bully or hurt others. Only use it to stop bad things, learn, and solve real problems safely.
A group named Paterva built this tool in 2007. They realized that security guards and computer experts had too much data to read. They decided to invent a visual board to make hunting bad guys easier. Today, it is used all over the world.
Maltego is not a normal website. It is a big program you have to download and install on your machine.
Works on standard Windows PCs. The most common way people use it.
Works on Apple computers. You just download the Mac file.
Used by hackers and security teams. Often comes pre-installed on special hacker computers (like Kali Linux).
Maltego is like a smart detective, but it doesn't know everything itself. It has to call other big databases on the phone and ask them for clues.
Many databases will say, "Who are you? I will only give you clues if you have a special password." This password is called an API Key.
You have to go to those database websites, sign up, get your long messy secret code (like:
1A2B3C4D5E), and paste it into Maltego's settings. Once you do that, the locked
door opens, and Maltego can pull clues from that specific website automatically.
Imagine you have 100 email addresses. If you have to click "Search" on every single one, your hand will hurt, and it will take all day.
Maltego has a feature called Machines. These are little robots you can turn on. You give the robot the 100 emails, press "Start", and the robot clicks the search buttons for you rapidly. You just sit back and watch the map build itself.
When you find hundreds of clues, your screen will look like a messy spider web. You won't be able to read anything. Maltego has instant "clean up" buttons called Layouts.
Makes the map look like a family tree. One clue at the top, branching down to the bottom.
Puts the most important clue directly in the middle, and rings all the other clues around it in circles.
Stacks all the clues together in perfect little square boxes so they take up less space on your screen.
When your detective work is done, you cannot just leave it on the screen. You must save it so you can show your boss or your team. Maltego lets you export your work in simple ways:
If you buy the expensive professional version, you don't have to work alone. You and a friend in another country can log into the exact same map. If you drag a box on your screen, your friend sees the box move on their screen instantly. You can fight the bad guys as a team.
The biggest mistake beginners make is asking for too much data at once.
For example, if you put "google.com" on your map, and you tell Maltego: "Find every single website connected to Google."
Maltego will try to draw 100,000 dots on your screen all at the exact same time. Your computer will freeze, crash, and shut down. Always start with tiny, specific searches.
Reading is not enough. You must practice. Install the free Community Edition and try these two safe tasks today:
Put your own email address on the blank map. Click the search button. See what public websites your email is connected to. You might be surprised.
Drag a "Website" piece onto the board. Type in the name of a
big public company (like apple.com). Run the search to find the exact IP
Address number of their computers.
Master more skills with other tutorials from the OSINT series.