johnnykv/mnemtego

Maltego tranforms for honeypot data

mnemtego's Issues

Transforms to URL entities does not work as intended.

The entity belows comes from the mnemosyne Somain->URL transform. The XML is picked up by Maltego, but no entity is drawn. If one manually pre/postfix the Type attribute of Entity it works - strange... Suspect that this could be a flaw in Maltego.

This is the XML generted by canarie - it look as expected, but does not work.

<MaltegoMessage>
 <MaltegoTransformResponseMessage>
  <Entities>
    <Entity Type="maltego.URL">
     <Value>http://evilsite.com</Value>
     <Weight>1</Weight>
    </Entity>
   </Entities>
  </MaltegoTransformResponseMessage>
</MaltegoMessage>

The same XML, but prefixed Type with a single space - and the import works.

<MaltegoMessage>
 <MaltegoTransformResponseMessage>
  <Entities>
    <Entity Type=" maltego.URL">
     <Value>http://evilsite.com</Value>
     <Weight>1</Weight>
    </Entity>
   </Entities>
  </MaltegoTransformResponseMessage>
</MaltegoMessage>

Add extraction to virustotal transform.