Maltego Advanced functionality
by Palenath
Posted on 06/20/2020
I advise you first of all to have some python base to do your custom transformation. Maltego offers a large choice of transformations however you may find that you're missing your transformation so we'll see how to make our transformations here are some examples of custom transformations like this one:
Or Toutatis Maltego
First of all you need a project for the example we'll see how I made a transformation that allows you to use the hashes.org api directly in maltego.
First of all, start by downloading this file
MaltegoTransform.py
which will allow you to do your transformation without going through a server
from MaltegoTransform import *
import requests
hashToIdentify=sys.argv[1]#is the variable with the values of the entity from which you perform the transformation.
trx = MaltegoTransform() # I declare the class trx that corresponds to the object MaltegoTransform
apikey="yourapikey"
#I'm not going to detail what makes it possible to use the Hashes.org api because it depends on what you want to do
#To avoid detailing each function, I put a mini documentation just below.
def checkHash(hash,apikey):
req = requests.get("https://hashes.org/api.php?key={}&query={}".format(apikey,hashToIdentify)).json()
if req["status"]=="success":
if str(req["result"][hashToIdentify])!=str("None"):
return({"result":{"plaintext":req["result"][hashToIdentify]["plain"],"algorithm":req["result"][hashToIdentify]["algorithm"]}})
else:
return({"result":"Not Found"})
else:
return({"result":"Not Found"})
check = checkHash(hash,apikey)
if check["result"]!="Not Found":
trx.addEntity("maltego.Phrase",check["result"]["plaintext"]).setNote("Plain text Hash, the Type of the Hash is "+str(check["result"]["algorithm"]))
else:
trx.addEntity("maltego.Phrase","Not found")
print(trx.returnOutput())#Returns all entities of the trx object
Functionality of de MaltegoTransform.py :
Methods:
setType(type: str): Set the entity type (e.g. "Phrase" for maltego.Phrase entity)setValue(value: str): Set the entity valuesetWeight(weight: int): Set the entity weightaddDisplayInformation(content: str, title: str): Add display information for the entity.addProperty(fieldName: str, displayName: str, matchingRule: str, value: str): Add a property to the entity. Matching rule can bestrictorloose.setIconURL(url: str): Set the entity icon URLsetBookmark(bookmark: int): Set bookmark color index (e.g. -1 for BOOKMARK_COLOR_NONE, 3 for BOOKMARK_COLOR_PURPLE)setNote(note: str): Set note content
Link Methods:
setLinkColor(color: str): Set the link color (e.g. hex "#0000FF" for blue)setLinkStyle(style: int): Set the link style index (e.g. 0 for LINK_STYLE_NORMAL, 2 for LINK_STYLE_DOTTED)setLinkThickness(thick: int): Set link thickness (default is 1)setLinkLabel(label: str): Set the label of the link
Installing these custom transformations in Maltego :
You have to click on

Fill you with the information of your transformation

And complete you once again with the information from your transformation

And you can use your transformation on the chosen entity you can find this transformation on my github

Osint FR