Open-Source Security Tools
Maltego: Mapping an Attack Surface
Maltego is the OSINT graph: domains on one end, subdomains, mail servers, certificate names, exposed documents, and people on the other, all connected as a picture an analyst can build outward from one entity. Its transforms (lookup engines in the sky) chain third-party data sources, and the value is not any single lookup but the propagation — how the picture of an organization's external footprint grows from one domain name. We use it in the reconnaissance phase, where a picture beats a list every time.
Key points
- Start from one entity (a company domain) and expand in layers: DNS and subdomain transforms first, certificates and document metadata next, people and email last.
- Transforms are rate-limited and third-party: costs show up in API keys, and a polite engagement paces its queries instead of hammering data sources at once.
- Every leaf on the graph is a claim, not a fact: cross-check subdomains you plan to act on before they enter a test plan.
- The graph view earns fees the list view does not: clusters expose patterns (one dev named twice in certificates, legacy hosts on one subnet) that spreadsheets hide.
- Community edition is real and limited (daily transform runs, commercial-use terms); decide honestly which limits bite your project before you standardize on it.
- Watch what you expose while you probe: search engines and data providers log your queries, and engagements that require stealth run OSINT through infrastructure you control.
- Keep privacy and data-protection rules in view: names and employee data collected about real people carry handling obligations under GDPR-class regimes, even when gathered from public sources.
- Everything in Maltego targets the outside world without touching it: that is what makes it the safest phase of an engagement, and authorization still belongs in the file because clients care what was asked about them.
Field note
I keep one Maltego session open during recon and let it collect while I work — the surprise graph leaf (a forgotten staging subdomain in a certificate) typically becomes the report's cover finding.
Frequently asked questions
Is Maltego just for hacking recruitment-style OSINT?
No: it is a general link-analysis graph that security teams use for external footprint mapping, incident scoping, and supply-chain questions.
Community or paid edition?
Community covers solo learning and small jobs; paid matters when transform volume, private transform servers, or commercial-use terms enter client engagements.
Do people use other data sources with it?
Transforms plug into many providers (search, certificate transparency, breach indexes); the graph is the constant, and you pick feeds per engagement based on cost and coverage.
Why not script OSINT instead?
Graphs connect better than scripts do for exploratory work, and the visual layout is what the client-facing recon chapter actually needs.
How Kinetikatech helps with open-source security tools
We've handled this hundreds of times: The testing toolbox professionals actually keep loaded: scanners, sniffers, crackers, and web proxies explained the way they are used on real engagements — commands, flags, outputs, and where each one sits in a methodology. With Penetration Testing and Linux Server Security, you get the full loop, we assess, we implement, we watch it around the clock, and we pick up within 30 minutes when it matters.