Maltego Relationship Mapping

You've spent hours gathering DNS records, scanning ports, and scraping whois data, but the pieces refuse to assemble into a single, usable picture. That painfully familiar reality is exactly why professional penetration testers reach for Maltego — a tool that transforms scattered reconnaissance data into a visual web of relationships. In this hands-on lesson, you'll learn to use Maltego for relationship mapping, turning raw OSINT into a strategic map that guides your next attack step and, just as importantly, helps you explain findings to non-technical stakeholders.

The problem this lesson solves

When you're attacking a target (legally and with permission, of course), the information you collect is usually a pile of unrelated facts: an IP address here, an email address there, a domain name, a social media handle. Without structure, you're flying blind. You might waste hours chasing dead ends, or worse, miss a crucial connection that would have revealed the entire network's architecture.

Reconnaissance is only as good as your ability to analyze it. Maltego solves this by turning your data into a relationship graph — a visual map that shows exactly how each piece of information connects to the others. Instead of staring at a text file, you see a node-and-edge diagram where a single domain name branches out to its subdomains, the IP addresses that host them, the email addresses found on those pages, and the physical locations of the servers.

Core concept / mental model

Think of Maltego as Google Maps for your target's digital footprint. Just as city maps show you streets, landmarks, and how they connect, Maltego shows you:

• Entities — the 'landmarks': domains, IP addresses, email addresses, people, organizations, phone numbers, and more.
• Links — the 'streets': the relationships between entities (e.g., a domain resolves to an IP, an email belongs to a person).
• Transforms — the 'tours': automated queries that take one entity and find related entities for you.

Here's a simplified mental model:

Domain "example.com"
   ├── Resolves to → IP 93.184.216.34
   │        └── Hosts → Web Server
   ├── Has MX Record → mail.example.com
   │        └── Resolves to → IP 203.0.113.5
   └── Found on → whois record → Name: John Doe
            └── Email: j.doe@example.com
                       └── Also used by → personalblog.com

Every time you run a transform, you're essentially asking Maltego to 'show me what else is connected to this.' The more transforms you run, the richer the graph becomes — but beware, too much data can clutter your map. The art is knowing when to expand and when to focus.

How it works step by step

Maltego is a Java-based desktop application. The community edition (free) is sufficient for most learning, while the commercial 'Pro' version adds more transforms and unlimited results. Here's the standard workflow:

1. Start a new graph — choose 'New Graph' (either the standard 'Investigate' or 'Classic' layout).
2. Select a palette — on the left, you'll see entity types like Domains, IP Addresses, People, etc.
3. Drag your starting entity to the canvas — this is your seed: a domain you own, an IP address you've found, or a person's name.
4. Run a transform — right-click the entity, choose 'Run Transform', and select one of the available options (e.g., 'To DNS Name', 'To IP Address', 'To Email').
5. Watch the graph build — each transform adds new entities and links. Right-click any new entity to further expand.
6. Analyze and document — as your graph grows, look for patterns: multiple domains pointing to the same IP, repeated email handles, or unexpected connections between people.

Pro Tip: Always start with a single, well-known entity (like a domain you own) to avoid overloading the graph. The free community edition limits transform results, but that's often enough for demonstration.

Hands-on walkthrough

Let's walk through a complete example using a (fictional) domain you control: example-company.com. This hands-on exercise will cement the fundamentals.

Step 1: Install and launch Maltego

If you haven't already, download the Community Edition from the official Maltego site. After installation, launch it and register a free account.

Step 2: Create a new graph and add a domain

1. In the 'Investigate' section, click New Graph.
2. On the left, under Palette, find Domain under the Infrastructure category.
3. Drag the Domain entity onto the canvas.
4. Double-click the entity and rename it to example-company.com.

Your canvas should now show a single green node representing the domain.

Step 3: Run your first transforms

Right-click the domain entity and hover over Run Transform. Choose To DNS Name to discover subdomains. The transform may find records like www.example-company.com or mail.example-company.com. This step may take a few seconds, and results appear as new nodes connected by a line labeled 'Resolves to'.

Now, run To IP Address on the domain. This will link to the IP address that hosts the website.

Pro Tip: Use To Email on a domain to find email addresses indexed in public sources. You may need to run several transforms to get meaningful data.

Step 4: Expand from an IP address

Select the IP node you found, then run To Domain to see what other domains are hosted on the same server. This is where you may discover related companies or side-projects.

Step 5: Use a person as a seed

Drag a Person entity to the canvas and name it John Doe. Run To Email and To Phone Number. This demonstrates how you can start from a human and map out their digital footprint — very useful in social engineering assessments.

Step 6: Save and export your graph

Once you're satisfied, go to File > Export Graph and save as an image (PNG) or PDF for your report. Your final graph should look something like this (simplified):

[example-company.com]
   ├── www.example-company.com
   ├── mail.example-company.com
   └── 93.184.216.34
          ├── another-site.net
          └── backup-site.org

Compare options / when to choose what

Maltego isn't the only tool for relationship mapping. Here's a quick comparison to help you decide when to use each one:

Pro Tip: For a single, quick lookup, dig is faster and lighter than opening Maltego. But when you're mapping an entire attack surface, Maltego's visual graph is unbeatable for spotting patterns.

Troubleshooting & edge cases

• No results from a transform — Often due to rate limiting or lack of public data. Try a different transform or wait a few minutes. Also, verify the entity type is correct (e.g., a domain vs. an IP).
• Graph is too cluttered — Use the 'Focus' feature (press F) on a node of interest, or delete low-value nodes. You can also use the 'Minimize' button to collapse whole branches.
• Transform errors like 'Authentication required' — Many transforms require you to configure API keys for services like Shodan or whois. Go to Manage -> Options -> Transforms and enter your keys.
• Maltego becomes slow — Large graphs consume memory. Close unnecessary tabs and consider running transforms in batches rather than 20 at once.
• Free version gives limited results — The community edition may cap transform results at 12 per query. If you outgrow it, consider the commercial version or alternate tools.

What you learned & what's next

You've now learned to use Maltego for relationship mapping — from creating a new graph and running transforms to analyzing the resulting network and exporting your findings. You understand the core concept that entities and links form a visual map of your target's digital footprint, and you've compared Maltego with other tools to choose the right one for each situation.

In the next lesson, we'll dive into active network scanning with Nmap, where you'll learn how to map out live hosts and open ports. The relationship map you build today will guide which IPs to probe first.

Final Pro Tip: Always keep a written record of your graph's findings — not just the graph image. Note the source of each link (the transform used). This provenance is crucial for your penetration testing report's credibility.