Author: David Bressler (@bostonlink)

Video Demo: http://www.youtube.com/watch?v=C7u0z6I_EXE

pamalt is a project that integrates the PAN web API to create Maltego transforms. This functionality gives the ability to Information Security Teams and SOCs the ability to graph and create Machines (Maltego Radium) to view the threat landscape of an organization.

• src/pamalt_canari directory is where all modules are stored
• src/pamalt_canari/transforms directory is where all nwmaltego transforms are stored
• src/pamalt_canari/transforms/common directory is where the nwmodule is stored and is a PAN REST API wrapper
• src/pamalt_canari/transforms/common/entities.py is where all nwmaltego custom entities are defined
• maltego/ is where the Maltego entity exports are stored.
• src/pamalt_canari/resources/maltego directory is where the entities.mtz files are stored for auto install and uninstall.

pamalt_canari has currently been tested on Mac OS X and Linux. Further testing will be done on Windows in the near future.

pamalt_canari is supported and tested on Python 2.7.3 The canari framework must be installed to use this package See: https://github.com/allfro/canari

Once you have the Canari framework installed and working, follow the directions below to install pamalt_canari

Install the package:

$ cd pamalt_canari
$ python setup.py install

Then install the canari package by issuing the following:

$ canari create-profile pamalt_canari

Then do the following (thanks to Nadeem Douba @ndouba):

INSTRUCTIONS:

1. Open Maltego.
2. Click on the home button (Maltego icon, top-left corner).
3. Click on 'Import'.
4. Click on 'Import Configuration'.
5. Follow prompts.
6. Enjoy! Once installed you must edit the pamalt_canari.conf file with the PAN appliance hostname or IP address.

$ vim ~/canari/pamalt_canari.conf

Upon running the first transform the package will ask for user credentials to the PAN appliance. It then creates a cookie for use within the package. There is no need to store username or password credentials within the configuration file.

Rich Popson (@Rastafari0728)
Nadeem Douba (@ndouba)
Paterva (@Paterva)
MassHackers (@MassHackers)