A Transform developer’s task is to write the logic that translates between a Transform request sent from Maltego, and the data being accessed. The data can be in the form of a database (e.g. MySQL), a public or private API (e.g. a Restful interface), or any other source of data for which there is a mapping between the inbound request and a set of Entities to respond with.
The Maltego Desktop application removes much of the complexity of working with linked graphs, such as merging duplicate nodes, updating layouts, and visualizing the Entities. The Transform developer, therefore, need only be concerned with extracting the request object and querying the data. There is a significant requirement to liaise with the Transform designer and investigators requiring the information to build Transforms that will be useful.
Maltego uses an XML-based protocol between the desktop clients and the TDS, as well as between the TDS and the Transform Server. A Transform developer can choose to directly read and interpret the XML-based Transform request, and respond with the required XML response message, using a basic web server.
To simplify the process, there is a basic Python library that assists with the following tasks:
- Host a basic HTTP server with the Transform logic
Translate the XML Transform request message to Python objects that are easier to work with
Translate the response object back into the XML Transform response message required by the TDS
Provide a basic API to easily interact with the Python object, with methods constants to read the data from the request object and attach new Entities to the results
Sample request XML going from the Maltego Client to TDS when running the example "DNSToIP" Transform.
<MaltegoMessage>
<MaltegoTransformRequestMessage>
<Entities>
<Entity Type="DNSName">
<Genealogy>
<Type Name="maltego.DNSName" OldName="DNSName"/>
</Genealogy>
<AdditionalFields>
<Field Name="fqdn" DisplayName="DNS Name">alpine.paterva.com</Field>
</AdditionalFields>
<Value>alpine.paterva.com</Value>
<Weight>0</Weight>
</Entity>
</Entities>
<Limits SoftLimit="256" HardLimit="256"/>
</MaltegoTransformRequestMessage>
</MaltegoMessage>
Sample response XML of the above request going from TDS to Maltego client when running the example "DNSToIP" Transform.
<MaltegoMessage>
<MaltegoTransformResponseMessage>
<Entities>
<Entity Type="maltego.IPv4Address">
<Value>
<![CDATA[173.230.156.137]]>
</Value>
<Weight>
100
</Weight>
</Entity>
</Entities>
<UIMessages>
<UIMessage MessageType="Inform">
Slider value is at: 256
</UIMessage>
</UIMessages>
</MaltegoTransformResponseMessage>
</MaltegoMessage>
Output in the client
The next article lists other Transform libraries available in different languages. After that, we will focus on setting up an environment for and using the Maltego TRX Python Library (commonly referred to as ‘maltego-trx’).