The mnemtego from johnnykv

mnemtego's Introduction

Mnemtego

This project will provide Maltego transforms for Mnemosyne.

Install

This project is not ready for production yet, but if you REALLY want to try it out - follow this procedure:

pip install canari
git clone https://github.com/johnnykv/mnemtego
cd mnemtego
python setup.py install
canari install-package mnemtego

Transforms

Currently the following transforms are available:

IP to honeypot attacks.
IP to attacked protocols.
Domain to URL's.
- Expands a domain to all URL's within that domain which somehow has been reported on HPFeeds.
URL to (potential) malware extractions (hashes).
- Expands a URL to hashes of all reported extractions (PDF, Javascript, SWF, JAR, etc).
- The binary itself will have to be downloaded manually from mnemosyne.
Extractions (hashes) to URL's.
- Expands a hash to all URL which has been serving this file.

Example graph

The following graph shows how a query on a specific .ru domain revealed that it was serving a piece of Adobe Flash (SWF) malware. Furthermore it was revealed that this specific malware (a5a1308ee3ca7f75fe85fe4d9a14752f) was also served from 8 other sites.

mnemtego's People

Contributors

Stargazers

Watchers

mnemtego's Issues

Transforms to URL entities does not work as intended.

The entity belows comes from the mnemosyne Somain->URL transform. The XML is picked up by Maltego, but no entity is drawn. If one manually pre/postfix the Type attribute of Entity it works - strange... Suspect that this could be a flaw in Maltego.

This is the XML generted by canarie - it look as expected, but does not work.

<MaltegoMessage>
 <MaltegoTransformResponseMessage>
  <Entities>
    <Entity Type="maltego.URL">
     <Value>http://evilsite.com</Value>
     <Weight>1</Weight>
    </Entity>
   </Entities>
  </MaltegoTransformResponseMessage>
</MaltegoMessage>

The same XML, but prefixed Type with a single space - and the import works.

<MaltegoMessage>
 <MaltegoTransformResponseMessage>
  <Entities>
    <Entity Type=" maltego.URL">
     <Value>http://evilsite.com</Value>
     <Weight>1</Weight>
    </Entity>
   </Entities>
  </MaltegoTransformResponseMessage>
</MaltegoMessage>