Kali Linux Day13: Maltego Tutorial Kali Linux 2026 — OSINT Link Analysis & Entity Mapping Guide

In Day 12 we used Burp Suite to intercept and analyse web application traffic — operating at the HTTP layer of a single target. Today we zoom out entirely and look at the organisation from the outside. Maltego operates before you ever send a packet to a target — it assembles intelligence from public sources to map the full landscape of what you are dealing with. This reconnaissance phase is what the Kali Linux 180-Day Mastery Course builds systematically — every tool in sequence for a reason.

What Is Maltego and Why It Changes OSINT Investigations

Maltego is a visual link-analysis and OSINT platform developed by Paterva. It represents intelligence as a graph — nodes are entities (domains, IPs, emails, people, organisations) and edges are the relationships between them. Every transform you run either adds new nodes to the graph or connects existing ones, building an ever-more-complete picture of your target’s digital footprint.

The power of graph-based intelligence is in non-obvious connections. When you run a text-based OSINT tool like theHarvester, you get a list. You can see individual data points but you cannot immediately see that three different email addresses from three different sources all resolve to the same server, or that a domain you had not considered is hosted on the same IP range as your primary target. Maltego makes these structural relationships visually immediate.

Professional threat intelligence analysts use Maltego to map criminal infrastructure, track phishing campaign origins, and connect disparate indicators of compromise. Corporate security teams use it to monitor their own attack surface. Penetration testers use it in the reconnaissance phase to identify every publicly accessible asset before testing begins. The tool works in all three contexts because the underlying intelligence model is universal.

Maltego Kali Linux 2026 — Install, Register and First Launch

Maltego Community Edition is pre-installed on Kali Linux but requires a free registration to activate transforms. The registration takes two minutes and unlocks the full Community Edition transform set — approximately 30 transform categories covering DNS, WHOIS, email, social media, and certificate transparency.

After logging in, Maltego runs a transform seed download that installs the Community Edition transform set. This takes 2–3 minutes on a fast connection. Once complete, the Transform Hub appears showing available transform providers. The free built-in transforms are already active. Optionally install additional free hubs including Shodan, VirusTotal Community, and Have I Been Pwned from the Hub.

Entities and Transforms — The Core Maltego Intelligence Model

Understanding entities and transforms is the conceptual foundation of all maltego tutorial usage. Every piece of intelligence in Maltego is represented as an entity — a typed object with a value and optional additional properties. Every transform is a function that takes one entity type as input and produces one or more entity types as output.

Entity types include: Domain, DNS Name, IP Address, Email Address, Person, Phone Number, Company/Organisation, Website URL, Netblock (CIDR range), AS Number, Social Media Profile, Document, Location, and more. Custom entities can be added through transform hubs. Each entity type has a distinct icon in the graph making entity types visually distinguishable at a glance.

Transform categories you will use most in reconnaissance: DNS transforms (domain → IPs, NS records, MX records, subdomains), WHOIS transforms (domain → registrant, registrar, creation date, nameservers), Email transforms (domain → associated email addresses), Person transforms (name → social profiles, email addresses), and IP transforms (IP → geolocation, ASN, reverse DNS, hosting provider).

Mapping Domain Infrastructure With DNS and WHOIS Transforms

DNS transforms are the highest-yield starting point for any Maltego investigation. A single domain entity expanded through all DNS transforms typically yields IP addresses, nameservers, mail servers, and in many cases CDN providers and hosting information — all from a single right-click menu in under 60 seconds.

The “To Domains on IP” transform is particularly valuable for targets using shared hosting or poorly separated infrastructure. When multiple domains share a single IP address, it indicates they are likely owned by the same organisation — or that compromising one could expose the others. On dedicated hosting, a single IP domain map confirms the target’s server isolation.

Email Enumeration and Person Entity Mapping

Email address discovery through Maltego goes significantly further than theHarvester’s search engine scraping. The combination of WHOIS registrant emails, certificate transparency DNS names, and social profile transforms creates a multi-dimensional picture of the people behind an organisation’s infrastructure — information that feeds directly into social engineering scenario planning for authorised penetration tests.

Building a Complete OSINT Graph — From Domain to Full Infrastructure Map

A complete Maltego investigation follows a structured expansion pattern. You start narrow — one entity — and systematically expand outward through transforms at each layer. The key discipline is knowing when to stop expanding. Every new entity can generate dozens more through transforms. Without boundaries, a graph becomes incomprehensibly large and loses analytical value.

Layer 1 — Seed: Your single starting entity. For a domain-based investigation, this is the primary domain. For a person-based investigation, it might be a known email address or full name.

Layer 2 — Direct expansion: Run all applicable transforms on the seed. This gives you first-order relationships — IPs, nameservers, registrant info, certificate SANs, associated email addresses.

Layer 3 — Targeted deepening: Select the highest-value entities from Layer 2 and run specific transforms on those. Do not run all transforms on all entities — select based on investigation objectives. For infrastructure mapping, deepen IP entities. For personnel mapping, deepen email and person entities.

Layer 4 — Cross-referencing: Look for nodes with multiple incoming edges — these are entities connected to multiple other entities in your graph. They indicate shared infrastructure, key personnel, or pivot points that deserve deeper investigation.