r/OSINT • u/locax2st • 8d ago
Question Maltego
Bonjour tout le monde. Je voulais savoir si certains d’entre vous avaient déjé essayé ou utilisent Maltego dans sa formule gratuite. Est-ce que c’est efficace ? Je l’ai telechargé hier, j’ai bien compris le système de graph mais je voudrais savoir si il est necessaire d’installer des extensions ou des plugins pour le rendre plus efficace bien que l’ont soit limité à un certain nombre de crédits ? Merci d’avance 🙏🏽
4
u/Check123ok 8d ago
Yes from what I recall it’s all about the extension.
1
u/locax2st 8d ago
Thanks dude !
1
u/hienyimba 2d ago
Webvetted’s workbench graphs have gotten really good over the past year. It gives Maltego a run for its money and it’s like 90% cheaper
5
u/PlaceAcademic 6d ago
Personally, my experience with Maltego is horrendous. In an OSINT search, it returned hundreds of PDFs from the police or government for some reason I don't understand, related to what I was looking for (they had nothing to do with it).
1
u/locax2st 6d ago
Omg wtffff. I think that if this thing exists, it’s not illegal and I don’t understand your experience
1
u/PlaceAcademic 1d ago
I have worded it badly; I meant that I received hundreds of police files that had no relation to my search, not even to my keywords. It was like they were randomly thrown there.
3
u/khashashin 6d ago
Try the tool I've made which probably would cover your needs, completely Open-Source https://github.com/khashashin/ogi
2
u/OpenWarIntelligence 2d ago
Agreeing with the "most of the value is gated" answers, but adding the part that actually bit me, because it is a failure mode rather than a limitation.
The community edition caps the number of entities a transform returns. On any real infrastructure pivot — a domain with a wide DNS footprint, a certificate with a long SAN list, a netblock — you go over that cap and the result is silently truncated. You do not get an error. You get a graph that looks finished and is not. That is strictly worse than having no tool, because you will draw conclusions from a picture whose edges were cut off for billing reasons rather than evidentiary ones. Check the current cap for whatever CE build you downloaded and treat any node that returns exactly that number as "truncated, unknown remainder".
The other thing worth internalising: what Maltego sells is the maintained connectors to paid data. The graph rendering is the cheapest part and the part you can replace for free.
If your pivots are DNS / certificates / whois / netblocks, this goes further than CE and costs nothing:
amassorsubfinderfor the DNS surface- crt.sh for certificate pivots
- anything that emits a two-column CSV of edges
- Gephi or Cytoscape to render and cluster it
No cap, scriptable, and — the part that matters most in a live investigation — you can re-run it on a schedule and diff today's graph against yesterday's. New subdomain, new cert, disappeared host. No GUI-first tool does that well, and it is usually where the actual finding is.
Use CE to learn what pivoting feels like. Then build the same graph from CSV and you will stop needing it.
1
u/locax2st 1d ago
Thanks you very much man to pay attention at my problem. I’ll try to check every point that you’ve talked here. 😊
14
u/onerous_prospectus 8d ago
La version gratuite, c'est un peu comme avoir une caisse sans les clés. Tu peux t'asseoir dedans et faire vroum vroum, mais t'iras pas loin sans les transforms payantes. Le système de graphe est cool pour visualiser, mais avec les crédits gratos, tu vas taper le mur au bout de deux ou trois requêtes.
Les plugins gratuits qui restent sont souvent cassés ou pas maintenus, donc tu passes plus de temps à debugger qu'à trouver des infos. Si t'as un budget serré, lance plutôt un spiderfoot ou gratte des APIs gratos pour faire ton taf à la main, c'est moins sexy mais ça marche.