Let's start by firing up Kali and then opening Maltego. We will be looking at gathering info on all the subdomains, the IP address range, the WHOIS info, all of the email addresses, and the relationship between the target domain and others. Maltego is capable of gathering information about either a network or an individual here we will focus on the former and leave individual information gathering for another time. Using Maltego in Kali to Recon a Target Network It is capable of a significant amount of information gathering about a prospective target in a single sweep of the domain. There is a community edition built into our Kali Linux that allows us 12 scans without purchasing Maltego.
In this tutorial, we will be using an active tool called Maltego, developed by Paterva, that can do many of these tasks with one simple scan. In previous guides, I have demonstrated multiple ways to perform reconnaissance including passive recon with Netcraft, active recon with Nmap or hping3, recon by exploiting DNS or SNMP, and many others. Without doing reconnaissance, you will likely be wasting your time and energy as well as risking your freedom. Before we attempt to exploit any target, it is wise to do proper reconnaissance.
