Powershell Maltego Local Transform Example

Get-MaltegoTransformResponse.ps1

Param(
	$IP ##IP we will look up
)

#Define XML Header
$MaltegoHeader = @"
<MaltegoMessage>
<MaltegoTransformResponseMessage>
<Entities>
"@
#Define XML Footer
$MaltegoFooter = @"
</Entities>
</MaltegoTransformResponseMessage>
</MaltegoMessage>
"@
#Example Query:
#Invoke-RestMethod -Method GET -Uri "http://ip-api.com/json/4.2.2.2"

#Example Results:
#as          : AS3356 Level 3 Communications, Inc.
#city        : New York
#country     : United States
#countryCode : US
#isp         : Level 3 Communications
#lat         : 40.7128
#lon         : -74.0059
#org         : Level 3 Communications
#query       : 4.2.2.2
#region      : NY
#regionName  : New York
#status      : success
#timezone    : America/Chicago
#zip         :

#Invoke the API and store the response
$response = Invoke-RestMethod -Method GET -Uri "http://ip-api.com/json/$($IP)"


#Build the XML Container around the values
$MaltegoLocation = "<Entity Type='Location'><Value>$($response.City), $($response.region), $($response.Country)</Value></Entity>"
$MaltegoOrganization = "<Entity Type='Organization'><Value>$($response.org)</Value></Entity>"

#Output
Write-Host "$MaltegoHeader$MaltegoLocation$MaltegoOrganization$MaltegoFooter"

#Example Output:
#PowerShell> .\Get-MaltegoTransformResponse.ps1 4.2.2.2
#<MaltegoMessage>
#<MaltegoTransformResponseMessage>
#<Entities><Entity Type='Location'><Value>United States</Value></Entity><Entity Type='Organization'><Value>Level 3 Communications</Value></Entity></Entities>
#</MaltegoTransformResponseMessage>
#</MaltegoMessage>