Maltego

Maltego is better for visual link analysis and interactive investigation, while SpiderFoot is better for automated OSINT collection. Professionals often use both: SpiderFoot for bulk data collection, Maltego for visualization and relationship mapping. SpiderFoot runs 200+ modules automatically; Maltego lets you manually explore findings on an interactive graph.

Basic understanding of DNS, WHOIS, and IP addressing is essential. Familiarity with OSINT concepts (passive vs active recon, data sources) helps significantly. Maltego itself is intuitive once you understand the graph interface, but interpreting results requires knowledge of internet infrastructure and investigation methodology.

Yes. Maltego has transforms for social media platforms including LinkedIn, Twitter, Facebook, Instagram, and others through the Transform Hub. These transforms map email addresses and names to social profiles, revealing organizational connections and public information.

Simple domain investigations take 15-30 minutes. Complex investigations with multiple seed entities and deep transform chains can take several hours. The time depends on the number of entities, the transforms used, and whether you use CE (limited results) or Pro (unlimited).

Yes, Maltego is legal. It only queries publicly available data sources. However, the data you gather may be subject to privacy laws (GDPR, CCPA). Always investigate only targets you are legally authorized to research, and respect data protection regulations in your jurisdiction.

Partially. Maltego has 'machines' (macros) that automate transform chains for repeated workflows. For full automation, use SpiderFoot or Recon-ng. Maltego excels at interactive, manual investigation where you make decisions at each step of the transform chain.

Maltego is an open-source intelligence (OSINT) and graphical link analysis tool used for mapping relationships between pieces of information from public internet sources. It visualizes connections between domains, IP addresses, email addresses, people, organizations, and other entities as an interactive graph.

Maltego automates the collection and visualization of publicly available intelligence data. It queries DNS databases, WHOIS records, social networks, certificate transparency logs, and other public sources through transforms, then displays the results as a visual graph showing relationships between entities.

Maltego works through a transform system. Users add seed entities (domains, emails, people) to a graph, then right-click to run transforms that query public data sources and return results as new entities on the graph. Chaining transforms progressively deepens the investigation, revealing hidden connections between data points.

Install Maltego (apt install maltego on Kali Linux), create a free account at maltego.com, launch the application, add a starting entity to a new graph, right-click to run transforms, expand the investigation by running transforms on discovered entities, and export the graph when complete.

Maltego is pre-installed on Kali Linux. Launch it from the application menu or run 'maltego' in a terminal. If not installed, run 'sudo apt update && sudo apt install maltego'. On first launch, create a free account at maltego.com to activate transforms.

Transforms are small programs that query specific public data sources and return results as entities on the Maltego graph. Each transform targets a particular data type (DNS, WHOIS, social media, certificates). Built-in transforms cover common OSINT tasks; additional transforms are available through the Transform Hub.

Entities are the nodes in a Maltego graph. Each entity represents a type of data: Domain, IP Address, Email Address, Person, Company, Phone Number, or Social Media Profile. Entities have properties (attributes) and can be connected to other entities through transform results.

Maltego Community Edition (CE) is free and includes the full graph interface and built-in transforms. The CE edition limits results per transform (typically 10-12). Maltego Pro costs approximately $1,500/year and removes result limits, adds private transforms, and includes enterprise features.

Maltego Community Edition (CE) is the free version of Maltego that provides the full graphical interface, built-in transforms, and basic investigation capabilities. It limits each transform to 10-12 results, which is sufficient for learning and small-scale investigations but not for professional OSINT work.

Maltego's graph analysis displays entities as icons connected by relationship lines. Multiple layout algorithms (Hierarchical, Organic, Central) organize the graph. Users can filter entities by type, color-code by source, zoom into clusters, and identify patterns like communication networks and infrastructure relationships.

In cybersecurity, Maltego is used for OSINT reconnaissance, threat intelligence, incident response, and digital forensics. Security professionals use it to map target infrastructure, investigate phishing emails, trace threat actor infrastructure, and build comprehensive target profiles during penetration testing.

TheHarvester is a command-line tool focused on email and subdomain enumeration from search engines. Maltego provides visual graph analysis that maps relationships between all entity types. Use theHarvester for quick data collection and Maltego for visualizing and mapping the relationships in that data.

SpiderFoot is an automated OSINT tool with 200+ modules that runs reconnaissance without user interaction. Maltego provides interactive visual graph analysis for manual investigation. SpiderFoot automates collection; Maltego visualizes relationships. Many professionals use both tools together.

The Transform Hub is Maltego's marketplace for additional transform packs. It includes integrations with Shodan, VirusTotal, Have I Been Pwned, and dozens of other services. Many transforms require API keys, which you configure in Edit > Preferences > Transforms.

No. Maltego is strictly a passive OSINT tool. It queries public data sources (DNS databases, WHOIS records, social networks, certificate transparency logs) and never sends packets to target systems. For active scanning, use Nmap, Masscan, or similar tools.

Maltego saves investigations as .mtgx (Maltego Graph Exchange) files. This format preserves all entities, relationships, transform results, and graph layout settings. You can also export graphs as SVG images, CSV data, or GraphML for use in other tools.

Some transforms work without API keys (basic DNS, WHOIS transforms). However, many powerful transforms (Shodan, VirusTotal, Have I Been Pwned, social media) require API keys. Configure them in Edit > Preferences > Transforms. Free tiers are available for most services.

During penetration testing, Maltego maps target infrastructure before active scanning. It discovers subdomains, email addresses, IP ranges, hosting providers, and social connections through passive OSINT. This information feeds into Nmap for port scanning and Metasploit for exploitation.

Yes. Maltego includes transforms for discovering social media profiles associated with people and organizations. You can connect names to Twitter, LinkedIn, and other social profiles, then map social networks to identify relationships and affiliations.

Maltego itself is legal software. It queries only publicly available data sources. However, using the information gathered for unauthorized access, harassment, stalking, or other illegal activities is prohibited. Always use Maltego ethically and in compliance with local privacy laws (GDPR, CCPA).

A transform is a small piece of code that takes one entity as input, queries a data source (passive DNS, WHOIS, crt.sh, social APIs), and returns related entities onto the graph. Chaining transforms is how you expand an investigation — for example, Domain → To DNS Names → To IP Address → To Netblock. Transforms are grouped into transform sets and installed from the Transform Hub.

Community Edition (CE) is free, requires a registered account, and caps transform results (typically 12 entities per run) with a limited set of public transforms. Maltego Pro removes result limits, adds commercial transforms, and enables larger graphs. Enterprise adds collaboration, on-prem data integration, and case management. Beginners on Kali should start with CE — it is enough to learn the full workflow.

Not to start. The built-in standard transforms (DNS, WHOIS, certificate transparency) work without keys. However, many high-value transforms — Shodan, VirusTotal, Hunter, and other commercial data sources — require you to add an API key under Transform settings. Add keys only for services you have accounts with, and treat them as secrets.

Maltego is pre-installed on full Kali images — launch it from the menu or run maltego. If it is missing, install with sudo apt update && sudo apt install maltego. On first launch you register or log in with a free Maltego account, accept the license, and choose the Community Edition product to begin.

This is almost always a Java/JVM problem. Maltego runs on the JVM and needs a compatible Java runtime and enough memory. Verify Java with java -version, ensure a 64-bit JRE is used, and if graphs are large, raise the heap in maltego.vmoptions (e.g. -Xmx4g). Clearing the config directory or running maltego --reset resolves corrupted-profile startup failures.

Maltego is interactive and visual — you drive the investigation entity by entity and read relationships from a graph. SpiderFoot is fully automated and web-based, running hundreds of modules unattended. Recon-ng is a CLI framework for scripted, at-scale OSINT. Use Maltego when the relationships matter and you want to explore them visually; use SpiderFoot/Recon-ng when you want hands-off bulk collection.

Yes. You can export the graph as an image (SVG/PNG) for reports, as CSV for entity and link data, or as GraphML for import into other graph tools. Export from the graph toolbar or File menu. For repeatable reporting, keep a consistent layout (Hierarchical or Organic) and annotate key entities with notes before exporting.

Maltego ships with entity types for domains, DNS names, IP addresses, netblocks, AS numbers, websites, email addresses, people, organizations, phone numbers, documents, and social-media profiles. You can also create custom entities. Investigations usually start from a Domain, Person, or Email and branch outward via transforms.

Yes — it is one of the best tools to learn OSINT because the visual graph makes abstract relationships concrete. Start with the free Community Edition, run a single Domain entity through the standard transforms, and watch the infrastructure map build up. Pair it with a structured guide and practice only on domains you own or are authorized to investigate.

Maltego sits in the reconnaissance phase. It passively maps a target's external footprint — subdomains, mail servers, IP ranges, staff, and third-party services — before any active testing. Those findings feed active tools: subdomains and IPs go to Nmap for scanning, discovered services to vulnerability tooling, and emails to phishing or credential-testing engagements (only within authorized scope).

Common causes: you hit the Community Edition result cap, the required API key is missing or invalid, the data source is rate-limiting you, or the entity value is malformed (e.g. a domain typed with https://). Check the transform output/error panel, confirm keys under Transform settings, wait out rate limits, and verify the entity value is clean before re-running.

No. Maltego requires a free registered account for first login and license activation, and its transforms query online data sources, so an internet connection is required. There is no meaningful offline mode — the value comes from live queries to public OSINT sources. You can, however, reopen and analyze previously saved graphs offline.