-: In this video, I'd like to show you 2 2
how to target a person. 3 3
So, we're gonna start with literally just a name, 4 4
just a person's name, and then we'll see 5 5
how we can gather information about that person, 6 6
and then build up an attack strategy as well. 7 7
And as we do that, I'm gonna show you some more features 8 8
of Maltego and how to configure a few more settings. 9 9
So, I'm gonna start a new graph 10 10
by clicking on the plus sign right here. 11 11
I'm gonna look for personal, 12 12
and I'm gonna look for a person. 13 13
And right here, we have a person entity. 14 14
Now, as I said in this example, I'm gonna assume 15 15
that I have a target, and I know their name. 16 16
I know their first name, and their second name. 17 17
And again, that target is me, 18 18
and my first name is Zaid, 19 19
and my second name is Sabith. 20 20
So, I'm gonna go here on the property list. 21 21
I'm gonna set the first name. 22 22
Just double-click it. 23 23
I'm gonna set it to Zaid, 24 24
and then I'm gonna set the surname to Sabith. 25 25
And I'm just gonna set this to capital. 26 26
Doesn't really matter but just looks better. 27 27
Now, let's see what information 28 28
can we gather about this entity. 29 29
Again, as we usual, all we have to do 30 30
is just right-click it, and see what we can get. 31 31
So, I'm already in the Paterva category, 32 32
and I'm gonna go to all transformers, 33 33
and you can see we can get associated emails. 34 34
We can transfer this to a radio person. 35 35
We can try to get a phone number. 36 36
We can try to get a Twitter account. 37 37
You can try all of these. 38 38
For now, I'm gonna try to get a website 39 39
or websites for this person. 40 40
Now, this is gonna ask you if you want 41 41
to look for a specific domain name. 42 42
I'm gonna assume that I know nothing. 43 43
So, I'm just gonna put a space in here in both entries. 44 44
So, that just means look up for any websites 45 45
that are associated with this person. 46 46
Now, you can see that we managed 47 47
to get a number of websites right here, 48 48
and all of these websites 49 49
are associated with Zaid Sabith. 50 50
Now, that doesn't really mean that these websites 51 51
are actually associated with your target, 52 52
'cause there could be another person named Zaid Sabith. 53 53
So, you'll have to go on each one of these, 54 54
and see which ones actually are related to that person. 55 55
For example, if we click on the Facebook here, 56 56
I'm gonna double-click it to see what information is there, 57 57
and I'm gonna go on the properties, 58 58
and you'll see that we have the Facebook URLs 59 59
that are associated with that person with that name. 60 60
Now, I'm gonna copy all of these, 61 61
and I'm just gonna put them in a text file, 62 62
so we can read them better. 63 63
And you can see we have three profiles. 64 64
Now, in a real life situation, you should be going 65 65
into each of these profiles, and see which ones 66 66
actually are related to your person. 67 67
I'm not gonna do that because the three of them 68 68
are actually not related to me at all. 69 69
So, this is really not useful, and you'll just move in. 70 70
In this case, you'll just come back, 71 71
move into the next entity, and see what's useful. 72 72
And I highly recommend you delete the ones 73 73
that are not useful, because they'll just make it harder 74 74
to look through things. 75 75
So, you can just click it, press delete, 76 76
and that'll delete it for you. 77 77
Now, the LinkedIn profile right here again, 78 78
you can double-click it, 79 79
and see which profile it links you to, 80 80
but again, it's not my own profile, 81 81
and you can see that once you actually go through the URL. 82 82
So, for now I'm just gonna delete that. 83 83
And you can see the rest of the stuff in here 84 84
is actually all related to me. 85 85
So, it's all related to your target, 86 86
and you can try and double-click each one of them, 87 87
go to the properties, look for the URL, 88 88
and open it in your browser. 89 89
When you do that, you'll get the information 90 90
that's related to that person, 91 91
and hopefully it'll help you to form some sort 92 92
of an attack strategy or help you get even more information. 93 93
For now, because I've already looked on all of them, 94 94
I'm gonna focus on one of them which is the udemy link, 95 95
so the information related to me on udemy. 96 96
I'm gonna double-click this like we did before, 97 97
and I'm gonna go on properties, 98 98
and you can see that we have a URL or description here. 99 99
I'm gonna copy that. 100 100
I'm gonna put it in my text file right here, 101 101
and I'm just gonna copy the URL, 102 102
and open it in my browser right here. 103 103
So, you can see that this URL is related 104 104
to our target person, and you can see 105 105
that it's leading us to a course that's taught by myself. 106 106
Now, this is not really useful. 107 107
We can see that the target person 108 108
is teaching online courses. 109 109
Whatever, not very useful. 110 110
But if we go back and look at the other URLs. 111 111
So this had two URLs if I scroll back to the left, 112 112
we can see we have the first URL right here, 113 113
and this URL is my profile URL. 114 114
So, I'm gonna copy it again, and paste it in the browser. 115 115
And you can see this is showing us the profile 116 116
for the target person. 117 117
You can see that it's the same name. 118 118
You can see their picture, so you know this is your target. 119 119
You can see a description about what they do, 120 120
but you probably already know that, 121 121
but you can see some useful stuff. 122 122
For example, you can see that they used to work 123 123
with a company called iSecurity. 124 124
So again, you can go to what we did previously. 125 125
Research iSecurity, add their website as a target, 126 126
and then gather all the information that we were able to do, 127 127
and then use that to build up a strategy against Zaid. 128 128
Now, we're not gonna do that 129 129
because I've already done something like that. 130 130
So, we're gonna try to see 131 131
what other information we can get. 132 132
What's really useful in here, we can see that the person 133 133
is sharing a few links. 134 134
So, they're sharing their YouTube channel. 135 135
They're sharing their LinkedIn profile. 136 136
They're sharing their Facebook, 137 137
and they're sharing their own blog. 138 138
All of these, you can go ahead and browse all 139 139
of these things to gather more information 140 140
about that person. 141 141
Now, you need to keep in mind that I'm setting my target 142 142
to myself, which is an aware person 143 143
about computer and information technology, 144 144
and even the target I targeted 145 145
in my previous video, iSecurity. 146 146
It's an information technology company, 147 147
and even with that, we were able 148 148
to gather so much information. 149 149
So, when you're targeting normal companies or normal people, 150 150
it'll be so much easier to get effective information. 151 151
So right now, if you actually go look at the YouTube, 152 152
look at the LinkedIn, and look at the Facebook, 153 153
you really won't get much. 154 154
Like, even if you click on the Facebook, 155 155
you'll see the Facebook won't lead you to anything. 156 156
You need to log in, and even after logging in, 157 157
you won't get too much useful information. 158 158
What's useful in my case is if we go on the blog, 159 159
and we're gonna go to the about, 160 160
and what's useful in this, 161 161
is we have the email address of the target person, 162 162
and we have their Twitter account, 163 163
so this information were not included on udemy, 164 164
and now we have two really useful pieces of information. 165 165
So, in the next video, 166 166
we'll see how we can use this information 167 167
to gather even more info about our target, 168 168
and hopefully be able to build up an attack strategy.