Maltego transforms for investigative journalism
Hello community ! In this repository, you will find several Maltego Transforms designed to help investigative journalism.
Currently, you will find the following transforms :
Before getting to the technical stuff, if you want to learn with fun how these OSINT tools are working, you can read the following stories from real world :
You must download Maltego from https://www.maltego.com/downloads/. These transforms have been tested with Maltego 4.6.0. You can use the free version (Maltego Community) by creating an account on the Maltego website. In Community version, Maltego will have some limitations :
maltego-trx is the python 3 library allowing to extend Maltego by creating python Transforms. You can find it here : https://github.com/MaltegoTech/maltego-trx
You just have to install the library in the system with :
pip install maltego-trx
Checkout the project in a directory of your choice (example "investigation_tools") :
cd investigation_tools/
git clone https://github.com/Reflets-info/maltego-tools.git
Go to the directory, create the virtual environnement and install the dependencies :
cd maltego-tools/reflets-transforms/
python3 -m venv venv_reflets
source ./venv_reflets/bin/activate
pip3 install -r requirements.txt
To update the project, got to the git directory and update the code :
cd investigation_tools/maltego-tools/
git pull
WARNING : if you update the project, you must first start you Maltego and clean the old config to be sure that the new configuration will be ok. You must go to the "Tranforms" / "Transform Manager" to delete the old transforms (CompanyPappers, PersonPappers). Then you must got to "Entities" / "Manage entities" and delete the old entities : DetailedCompany, HeadquartersAdress, Dirigeant.
You must import the Maltego configuration in the "Import | Export" tab, option "Import Config". The configuration file you have to import is located here :
maltego-tools/maltego-config/Pappers.mtz
Then, you must configure the transforms path to your project directory. To do this, got to "Transforms" tab, "Transform Manager" option. Then you must type "Pappers" in the search bar and you will see two lines in the result list. Click on each of them and change the following configuration options :
Command line : Here you must specify wich python to call. You must specify the python3 script generated by your virtual environnement. For exemple : /home/user/investigation-tools/maltego-tools/reflets-transforms/venv_reflets/bin/python3
Working directory : Here you must specify the installation directory for your transforms. For exemple : /home/user/investigation-tools/mlatego-tools/reflets-transforms/
To be able to use the Pappers.fr, you must register on their website : https://www.pappers.fr/api. You can register for free and get 100 tokens. These tokens will allow you to perform from 1 to 4 investigations a month.
You can access to the API key in the following URL : https://www.pappers.fr/mon-compte/api. Here, you will also be able to monitor your API consumption.
Then, open the configuration file located in "investigation-tools/maltego-tools/reflets-transforms/transforms/api_keys.yml". You will see a string "PUT_YOUR_API_KEY_HERE". You can replace this string with your API KEY.
WARNING : some users have tell us that you need a company email (not gmail) to create a developper access to the Maltego API.
You are ready to go !
We have created specific Entities to perform accurates search using specific pivot informations. You must configure these first Entities accordingly to have accurate results. Entities that are generated by the transforms are filled with necessary informations and you dont have to edit Entities later.
Start a new investigation and add one of the following entity in the Dasboard.
The Birthdate Month is also a critical pivot used by the tool. You must fill it in the followinf format : 1972-6, 2002-12, ... You can find these informations directly in the pappers.fr website by browsing manually.
Pappers - Fiche Entreprise : This transform use the siret/vat and the country code to get the company details from the correct Pappers API. If country code is "GB", "CH", "BE", it uses API IN V1. Otherwise, it falls back in API FR V2.
Pappers - Search Company Name : This search is based in company name and it does not use accurate pivot informations. Results may be non accurates.
Transforms on dirigeant are provided by country to be launched separatly to spare API consumption.
Transforms on dirigeant are provided by country to be launched separatly to spare API consumption.