Local Maltego transforms that extract emails behind GitHub accounts and repositories, powered by gitcolombo.
| Transform | Input entity | Output |
|---|---|---|
| [Gitcolombo] Alias → Emails | Alias (GitHub username) |
Emails behind that account |
| [Gitcolombo] Account URL → Emails | URL to a GitHub profile |
Emails behind that account |
| [Gitcolombo] Repo URL → Emails | URL to a git repo |
Emails of all committers in the repo |
Output entities are maltego.EmailAddress. Each link's weight (and
thickness) reflects how strong the finding is:
| Weight | Meaning |
|---|---|
| 100 | PGP key, mailbox verified by GitHub |
| 90 | Commit name matches the profile name |
| 85 | PGP key (unverified) / author↔committer identity overlap |
| 80 | Email resolved to a real GitHub account |
| 75 | Commit trailer (Signed-off-by, Co-authored-by, …) |
| 65 / 55 | Plain commit author / committer |
| 20 | noreply / service address |
The link label lists the exact sources an email came from.
A self-contained venv keeps this off your system Python:
python3 -m venv .venv
.venv/bin/pip install -r requirements.txtmake_mtz.py writes gitcolombo.mtz with the three transforms pre-wired to
that venv and this folder as the working directory:
python3 make_mtz.py --command "$PWD/.venv/bin/python3" --workdir "$PWD"Re-run it (same command) whenever you move the folder or switch interpreter.
Import | Export tab → Import Config → pick gitcolombo.mtz →
Next through the wizard. The three transforms appear under the Local
transform set — no manual command/working-directory setup needed.
Optional but recommended — raises GitHub's rate limit from 60/hr to 5000/hr. Set it in the shell Maltego is launched from, so the transforms inherit it:
export GITHUB_TOKEN=<a fine-grained PAT with public_repo read scope>The Repo URL transform clones the repository (into a temp dir, cleaned up
afterwards), so a working git binary is required.
Instead of the .mtz, you can add each by hand — press
New Local Transform… in Maltego and set:
- Command:
python3(or the full path to your Python) - Parameters:
project.py local <name>— one of:gitcolomboaliastoemails,gitcolomboaccounturltoemails,gitcolomborepourltoemails - Working directory: this folder
Run python3 project.py list to see the local transform names.
Any transform can be run straight from the shell:
python3 project.py local gitcolomboaliastoemails "Soxoj"
python3 project.py local gitcolomborepourltoemails "https://github.com/Soxoj/maigret"