https://www.petergirnus.com/blog daily 0.75 2025-07-08 https://www.petergirnus.com/blog/ivanti-epmm-security-update-july-2025-critical-os-command-injection-vulnerabilities monthly 0.5 2025-07-08 https://www.petergirnus.com/blog/ivanti-security-update-for-july-2025-connect-secure-and-policy-secure-vpn-appliances monthly 0.5 2025-07-08 https://www.petergirnus.com/blog/sap-security-update-july-2025 monthly 0.5 2025-07-08 https://www.petergirnus.com/blog/how-to-mount-an-aws-s3-bucket-on-macos monthly 0.5 2024-04-25 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/797984f5-f143-4c5f-bd52-ba2c38ab1e51/2024-04-25_13-13-57.png Blog - How to Mount an AWS S3 Bucket on macOS - Make it stand out Figure - Apple macOS System Extension Blocked Warning https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/ff9d0d2c-1a85-4587-8ef9-b9aa5583d0f5/2024-04-25_13-22-06.png Blog - How to Mount an AWS S3 Bucket on macOS - Make it stand out Figure 2 - Enabling System Extesnions on macOS Silicon https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/84daccf3-ce57-4ee8-998d-45b119d0e2a5/2024-04-25_13-25-01.png Blog - How to Mount an AWS S3 Bucket on macOS - Make it stand out Figure 3 - Enable System Extensions shutdown prompt https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/9fa9a278-38ae-40a9-900f-a0269d956dc9/2024-04-25_13-29-32.png Blog - How to Mount an AWS S3 Bucket on macOS - Make it stand out Figure 4 - Startup Security Utility inside the macOS Recovery Environment https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/bdf706db-8852-4a5a-9689-f69980d072b9/2024-04-25_13-39-32.png Blog - How to Mount an AWS S3 Bucket on macOS - Make it stand out Figure 5 - Security Policy Required for macFUSE Extensions https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/ff74450d-7f95-453a-9b08-1492e66a868d/2024-04-25_14-14-06.png Blog - How to Mount an AWS S3 Bucket on macOS - Make it stand out Figure 6 - Enable the macFUSE extension in Security & Privacy https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/0ac1a862-f933-4493-8269-7036f2235c98/2024-04-25_14-22-15.png Blog - How to Mount an AWS S3 Bucket on macOS - Make it stand out Figure 7 - AWS S3 Bucket to Mount as a Local Drive https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/132cac1c-3f7e-475f-8f75-5c1fac02627f/2024-04-25_14-25-09.png Blog - How to Mount an AWS S3 Bucket on macOS - Make it stand out Figure 8 - File sharing between locally mounted AWS S3 share https://www.petergirnus.com/blog/where-to-find-file-extension-associations-in-the-windows-registry monthly 0.5 2024-04-24 https://www.petergirnus.com/blog/wireshark-display-filter-http-requests-for-get-and-post-packets monthly 0.5 2024-03-06 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/1ed0cf9e-ec81-4ec2-86b0-3243b0c8d9f0/wireshark-http-display-filter-bar.png Blog - Wireshark: Filter HTTP GET & POST Request Packets - Make it stand out Figure 1 - Wireshark Display Filter Bar https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/382e347d-5a0c-4616-909b-834f5c27f828/wireshark-display-filter-http-get-request.png Blog - Wireshark: Filter HTTP GET & POST Request Packets - Make it stand out Figure 2 - Wireshark display filter for HTTP GET Requests https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/e56fa6cc-0215-4dfa-933d-3e52e282d643/wireshark-display-filter-http-post-request.png Blog - Wireshark: Filter HTTP GET & POST Request Packets - Make it stand out Figure 3 - Wireshark display filter for HTTP POST Requests https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/6d69904c-f35b-47d9-b9cd-d5b995e623d9/wireshark-display-filter-get-and-post-request.png Blog - Wireshark: Filter HTTP GET & POST Request Packets - Make it stand out Figure 4 - Wireshark display filter for HTTP GET & POST Requests https://www.petergirnus.com/blog/git-tools-methods-for-finding-git-timestamps monthly 0.5 2024-02-29 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/d83932ef-77a9-4226-a218-07703c89a91c/github-friendly-date-hover.png Blog - Git Tools: Methods for Finding Git Timestamps - Make it stand out Figure 1 - Hovering over GitHub "Friendly Date" https://www.petergirnus.com/blog/git-tools-commit-and-push-changes-to-a-git-submodule monthly 0.5 2024-02-26 https://www.petergirnus.com/blog/git-tools-pull-the-latest-changes-for-a-git-submodule-or-git-submodules monthly 0.5 2024-02-26 https://www.petergirnus.com/blog/expressjs-organizing-routes-and-routing-for-an-api monthly 0.5 2024-02-25 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/c6dcc11d-a30b-4bab-bc1f-754190376db5/npm-init-builds-package-json-file.png Blog - Expressjs: Organizing Routes and Routing for an API - Make it stand out Figure 1 - The result of running npm init is a new package.json file https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/f490be0d-f7da-4bba-909e-12510ce117f7/expressjs-dependency-in-package-json.png Blog - Expressjs: Organizing Routes and Routing for an API - Make it stand out Figure 2 - The result of running npm install express is adding express as a project dependency https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/92bd6c5d-363c-4526-a792-3a9d5fef5a26/expressjs-sample-directory-structure.png Blog - Expressjs: Organizing Routes and Routing for an API - Make it stand out Figure 3 - The nested directory structure for our Express routes https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/606fbcff-739f-43ba-980e-fc96d15d8f9a/routesjs-and-appjs-file-in-express-app.png Blog - Expressjs: Organizing Routes and Routing for an API - Make it stand out Figure 4 - We create the routes.js file and app.js file https://www.petergirnus.com/blog/fix-npm-error-eacces-permission-denied-mkdir monthly 0.5 2024-02-24 https://www.petergirnus.com/blog/crypto-scams-hacking-campaigns-compromise-coinbase-accounts monthly 0.5 2024-02-22 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/23df3426-5c20-421e-9a71-348fb62b1539/coinbase-phishing-email.png Blog - Crypto Scams: Hacking Campaigns Compromise Coinbase Accounts - Make it stand out Figure 1 - A Coinbase-themed phishing email https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/7b1fb202-736e-4f19-b0e1-28689bd374a0/coinbase-phishing-email-html.png Blog - Crypto Scams: Hacking Campaigns Compromise Coinbase Accounts - Make it stand out Figure 2 - Source code snippet of a Coinbase phishing email pointing to Google Drive https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/dc76b14c-9ed7-4d79-87a1-bc32686a69bb/coinbase-virustotal-yara-results.png Blog - Crypto Scams: Hacking Campaigns Compromise Coinbase Accounts - Make it stand out Figure 3 - Collection of Google Drive Phishing Emails collected from VirusTotal https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/07722898-5713-4e67-b438-48170519fc2c/coinbase-phishing-pdf-document.png Blog - Crypto Scams: Hacking Campaigns Compromise Coinbase Accounts - Make it stand out Figure 4 - A malicious PDF document with a button that links attached to an attacker-controlled domain https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/c0395989-6f1c-47d5-8029-eb64b49363ae/coinbase-phishing-pdf-code.png Blog - Crypto Scams: Hacking Campaigns Compromise Coinbase Accounts - Make it stand out Figure 5 -The PDF obj contains the malicious link when the "Verify Account Information" button is pressed. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/3c19f34f-c9a0-48a4-9ce1-93e1d6fc8b98/dns-request-to-malicious-azure-storage.png Blog - Crypto Scams: Hacking Campaigns Compromise Coinbase Accounts - Make it stand out Figure 6 - Network traffic showing DNS request to Microsoft Blob Storage https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/a7e86224-a561-4de2-b460-9053b4972cea/coinbase-vs-coinbase-phishing-login.png Blog - Crypto Scams: Hacking Campaigns Compromise Coinbase Accounts - Make it stand out Figure 7 - Side-by-Side between Coinbase Portal & Phishing Portal https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/664d6d0c-a16c-4871-aa75-d174db0cd5f4/fake-coinbase-page-post-request.png Blog - Crypto Scams: Hacking Campaigns Compromise Coinbase Accounts - Make it stand out Figure 8 - HTTPS POST request is sent to the attacker C2 server https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/e4d2eeee-9259-48b6-8ebc-a425af80a584/fake-coinbase-server-name.png Blog - Crypto Scams: Hacking Campaigns Compromise Coinbase Accounts - Make it stand out Figure 9 - HTTPS/TLS connection to coinbasce-crypto[.]com https://www.petergirnus.com/blog/how-do-i-git-clone-a-specific-commit-in-git monthly 0.5 2024-02-20 https://www.petergirnus.com/blog/git-tools-including-a-git-repo-into-another-repo-using-git-submodules monthly 0.5 2024-02-20 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/504cd17f-59cb-4a72-a1d6-62f78ec3d8a1/github-profile-repositories-view.png Blog - Git Tools - Including a Git Repo Into Another Repo Using Git Submodules - Make it stand out Figure 1 - Select New Repository from the Repositories View on GitHub https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/4b601c15-9d2c-4545-a378-ae506b8b4a77/github-create-a-new-repository.png Blog - Git Tools - Including a Git Repo Into Another Repo Using Git Submodules - Make it stand out Figure 2 - GitHub Create a New Repository https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/dc352064-baea-498e-949f-f6a52fab2b3e/github-empty-repository-view.png Blog - Git Tools - Including a Git Repo Into Another Repo Using Git Submodules - Make it stand out Figure 3 - Empty repository view on GitHub https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/9e65ae58-41da-4dbb-844b-a5ce0c9982be/github-after-pushing-readme.png Blog - Git Tools - Including a Git Repo Into Another Repo Using Git Submodules - Make it stand out Figure 4 - Our GitHub repo after pushing our README.md file Once the above sequence of Git commands has been executed, we should see the new README.md file in our GitHub repository. Next, we can move on to add a submodule to our repository with the git add submodule command. Add submodules with git submodule add To demo the git add submodule command, we will git clone the Git source code repository as a submodule into our root project repository. In order to add a submodule to our repo, run the following commands: https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/4df4365a-1870-40ff-a76c-a3a41d33d264/github-git-submodule-listing.png Blog - Git Tools - Including a Git Repo Into Another Repo Using Git Submodules - Make it stand out Figure 5 - Git submodule as seen after pushing to GitHub https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/c44a5b96-cbc6-40f9-b2c4-9ee539ea5673/gitmodules-file-contents.png Blog - Git Tools - Including a Git Repo Into Another Repo Using Git Submodules - Make it stand out Figure 6 - Contents of .gitmodules file https://www.petergirnus.com/blog/how-to-install-nodejs-on-windows-macos-and-linux monthly 0.5 2024-02-18 https://www.petergirnus.com/blog/nodejs-expressjs-http-requests-using-the-google-chrome-devtools-console monthly 0.5 2024-02-18 https://www.petergirnus.com/blog/setup-configure-a-webdav-server-ubuntu-linux-apache monthly 0.5 2024-02-06 https://www.petergirnus.com/blog/install-google-chrome-on-ubuntu-linux-arm64 monthly 0.5 2024-01-29 https://www.petergirnus.com/blog/in-the-footsteps-of-wmighost-wimmie-advanced-malware-continues-to-abuse-windows-management-instrumentation-wmi monthly 0.5 2023-12-06 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/e658f2c0-fd25-4481-8d83-f8135d76f4b7/winmgmts-wmi Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 1 - WMIGhost intiates a WMI object https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/72c7dbec-7e94-4821-8ac3-455f53f367bc/wmi-query-function.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 2 - WMIGhost function WMI used to perform queries https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/a7a48176-84fb-4187-9785-b36f04578f80/GetOSInfo-function.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 3 - The WMIGhost GetOSInfo Function Using this function WMIGhost collects the operating system type, service pack version, and computer name. We can create a functional equivalent in PowerShell using the following command. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/71e360c3-fc1f-4751-a4d2-a9e5f3648de1/Get_MacAddress-function.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 4 - The WMIGhost GetMacAddress Function https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/b094b2d0-4a70-4d89-96d7-6ba299915a37/wmighost-activescripteventconsumer.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 5 - WMIGhost Calls the WMI class ActiveScriptEventConsumer (scrcons.exe) to execute JavaScript By using the Win32_Process class WMIGhost can kill the scrcons.exe for defense evasion. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/8b8a100b-ad83-49a9-870c-3f05fd212d7c/wmighost-cleanobjects-function.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 6 - WMIGhost kills the scrcons.exe process using WMI WMIGhost: Generating HTTP Parameters & Sending WMI Data Once the sensitive information is collected with the help of WMI, the WMIGhost malware moves to generate the HTTP request to POST the information gathered via WMI to the attacker command-and-control server. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/5d9f70bc-d870-4aa4-9267-70cd6ebc899d/wmighost-generateurlparam-function.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 7 - WMIGhost Generates HTTP POST parameters from WMI objects https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/e982f009-abf6-4011-ba9f-15dcc0daa27d/wmighost-post-request.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 8 - Generated POST parammeters are sent to the attacker C2 Once the objects derived from querying WMI are generated these objects are sent as parameters to the attacker C2 server via a POST request. Once received the threat actor C2 server will decide which commands to send to the infected host based on the information gathered through WMI. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/a872de22-a158-435b-bdba-e697d5ad7873/js-wmiquery-function.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 9 - The WMIQuery function fetches the Winmgmts service and performs the WMI query https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/e96b76d2-f28f-4646-bbb8-d89ac27ebea3/wmi-select-statement-js.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 10 - WMI WQL select statement written as the ServiceManager property https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/4bf012b9-b9ed-428e-978e-e12284947b13/GetNetworkInfo-function.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 11 - The GetNetworkInfo() function fetches IP Addresses & the Mac Address https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/c11e2040-da63-4855-9088-9c08d0b45b3e/collectsysteminfo-function.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 12 - The CollectSystemInfo() function runs GetNetworkInfo() as well as retrieves system info We can simulate the CollectSystemInfo function with the following Windows PowerShell function to demonstrate its functionality. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/6aa9bf2f-c02f-4004-b526-4723cd2d24b0/generatequerystring-function.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 13 - The GenerateQueryString() Function https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/a2760d13-254e-4f41-b8ef-a32c113f9de1/PostData-function.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 14 - The PostData() method uses ActiveX for HTTP requests https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/d2238ff7-ec5a-4011-93a5-1fff097c5b83/encoded-generatequerystring.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 15 - The PostData() method sends the encoded WMI payload to the attacker C2 The malware uses the ServiceManager prototype EncodeString function to encode a parameter “platform”; this platform object is the information gathered through querying WMI. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/38077b18-6887-4649-8b7b-b50957478b2b/inertstring-and-encodestring-function.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 16 - Prototype functions InvertString() & EncodeString() https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/652afd38-4642-4484-99f0-715b33eef12a/wireshark-network-analysis.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 17 - An HTTP POST request is sent to the attacker C2 containing information gathered through WMI Security analysts can carve the HTTP request and, using a simple regex pattern, copy the POST request into a text editor and filter out the parameters, which will leave a single encoded string. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/6df5ddcf-3bcd-4dff-bba4-698967fac140/filter-http-post-params.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 18 - Using RegEx patterns to filter out HTTP param key values Once the HTTP parameter key values are removed analysts can pass the encoded string into a script that decodes the string resulting in its decoded version. In this example I’ve created a NodeJS application to decode the encoded strings based on the Malware’s encoding and decoding functions. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/8edbb2d2-8097-4b39-9f8c-66b0af0ed110/decoded-queryparams.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 19 - The decoded string which was sent to the attacker C2 via HTTP Post This decoded query string gives us the first clue that this sample could be related to scripts seen in WMIGhost or at the very least inspired by this previously analyzed Malware as most are identical. Compare & Contrast: WMIGhost vs. MicrosoftEdgeUpdateTaskMachineCore_37f6967892b.js One of the most striking similarities between scripts deployed in WMIGhost and MicrosoftEdgeUpdateTaskMachineCore_37f6967892b.js is the usage of the same query strings. Once we have decoded the POST parameters in MicrosoftEdgeUpdateTaskMachineCore_37f6967892b.js see that the query parameters are almost identical with MicrosoftEdgeUpdateTaskMachineCore_37f6967892b.js now including IPAddress parameter but without a runtime or time parameter. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/5873c213-ee61-4722-9016-38601d72e70a/compare-wmighost-other-sample.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 20 - WMIGhost vs. MicrosoftEdgeUpdateTaskMachineCore_37f6967892b.js query string As covered earlier, MicrosoftEdgeUpdateTaskMachineCore_37f6967892b.js contains an encoding mechanism to mask the network traffic. We can see the call to encode the plaintext parameters in the POST request preparation. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/449148bf-e33e-4b7f-a2f6-8db37cc246e1/compare-wmighost-other-post-function.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 21 - WMIGhost vs. MicrosoftEdgeUpdateTaskMachineCore_37f6967892b.js Initial POST request The WMIGhost and MicrosoftEdgeUpdateTaskMachineCore_37f6967892b.js samples can be classified as backdoors. These samples can receive commands from the attacker's command and control (C2) server and transmit the results of those commands. While both samples employ the exact query string, our focus has been on the WMI component. However, it is an interesting similarity between the two samples. The difference in MicrosoftEdgeUpdateTaskMachineCore_37f6967892b.js, however, is that the network request containing the command output is also encoded using the same encoding routine. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/05db92c1-052f-40ab-b714-2055e1d9524f/wmighost-c2-command-parsing.png Blog - Footsteps of WMIGhost - Advanced Malware Continues to Abuse Windows Management Instrumentation (WMI) - Make it stand out Figure 22 - WMIGhost vs. MicrosoftEdgeUpdateTaskMachineCore_37f6967892b.js identical command and commandresult query strings While the encoding mechanism is rudimentary, it is a step up from the original plaintext POST request. It gives some level of defense evasion against unsophisticated network and endpoint security devices that cannot decode this traffic. Conclusion The recent discovery of a JavaScript file that shares similarities with WMIGhost, also known as Wimmie, highlights the persistent threat of malware exploiting Windows Management Instrumentation (WMI) for malicious activities. The original WMIGhost malware used WMI to extract system information and communicate with a command-and-control server. The newly uncovered file, disguised as a MicrosoftEdgeUpdateTaskMachineCore script, shows these threats' sophistication and evolving nature. This comparison not only reveals the technical intricacies and potential for WMI misuse by threat actors but also serves as a critical reminder of the need for continuous vigilance and advanced defensive strategies to protect against such WMI-based malware intrusions. Cybersecurity professionals must remain proactive in threat hunting and reverse engineering efforts to identify, understand, and mitigate these insidious attacks on Windows-based systems. https://www.petergirnus.com/blog/rust-macos-how-to-install monthly 0.5 2023-10-23 https://www.petergirnus.com/blog/winget-python-install-python-on-windows monthly 0.5 2023-10-19 https://www.petergirnus.com/blog/windows-bashrc-file-powershell-equivalent monthly 0.5 2023-10-19 https://www.petergirnus.com/blog/how-to-install-rust-on-windows monthly 0.5 2023-10-16 https://www.petergirnus.com/blog/rust-reqwest-http-get-json monthly 0.5 2023-10-15 https://www.petergirnus.com/blog/cybersecurity-secure-by-default-vs-secure-by-design monthly 0.5 2023-10-11 https://www.petergirnus.com/blog/rust-metadata-extensions-stdoswindowsfsmetadataext-trait-for-the-windows-os monthly 0.5 2023-10-09 https://www.petergirnus.com/blog/rust-metadata-extensions-stdoslinuxfsmetadataext-for-the-linux-os monthly 0.5 2023-10-09 https://www.petergirnus.com/blog/rust-standard-library-stdfs-getting-file-metadata-with-code-examples monthly 0.5 2023-10-09 https://www.petergirnus.com/blog/cisa-nsa-identity-and-access-management-iam-vendor-developer-challenges monthly 0.5 2023-10-05 https://www.petergirnus.com/blog/browser-web-scraping-scrape-data-with-chrome-developer-tools monthly 0.5 2023-10-04 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/17be056c-0260-48a3-8de4-786732946d73/browser-devtools-click-selector.jpg Blog - Browser Web Scraping - Scrape Data With Chrome Developer Tools (Chrome DevTools) - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/0fc84e81-c89a-44c8-834c-897ceb8cf72d/browser-devtools-select-element.jpg Blog - Browser Web Scraping - Scrape Data With Chrome Developer Tools (Chrome DevTools) - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/fb3913e9-da7f-46ae-bcf3-0fc67a29a313/browser-devtools-select-console.jpg Blog - Browser Web Scraping - Scrape Data With Chrome Developer Tools (Chrome DevTools) - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/66c0a2b0-c9ea-4bb5-9333-0090da2188f7/browser-devtools-navigate-next-webpage.jpg Blog - Browser Web Scraping - Scrape Data With Chrome Developer Tools (Chrome DevTools) - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/42c472c1-689b-4651-9214-d6455560a339/browser-devtools-rerun-scrape-function.jpg Blog - Browser Web Scraping - Scrape Data With Chrome Developer Tools (Chrome DevTools) - Make it stand out Re-running our scrape function on different pages grows our array https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/bb3e85cf-6ba3-4d03-b258-477b9a0eccde/browser-devtools-copy-to-clipboard-to-file.jpg Blog - Browser Web Scraping - Scrape Data With Chrome Developer Tools (Chrome DevTools) - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/d23e9a8a-346c-49b9-8c88-f1b832320077/browser-devtools-save-console-to-file.jpg Blog - Browser Web Scraping - Scrape Data With Chrome Developer Tools (Chrome DevTools) - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://www.petergirnus.com/blog/rust-standard-library-filetype-struct-code monthly 0.5 2023-10-03 https://www.petergirnus.com/blog/exploring-ransomware-samples-written-as-windows-batch-file-hta-hybrids monthly 0.5 2023-10-01 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/4945558e-a249-4991-807f-333328938e2a/ramonware-ransomware-github.jpg Blog - Exploring Ransomware Samples Written As Windows Batch File / HTA Hybrids - Make it stand out RamonWare Batch Ransomware on GitHub https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/ba7e5c70-91ae-4dcb-91a4-0ebbb48562cc/ramonware-ransomware-on-discord.jpg Blog - Exploring Ransomware Samples Written As Windows Batch File / HTA Hybrids - Make it stand out Ransomware message hosted on Discord as an image https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/1c85eeb1-4b13-4937-92c5-4558f7c7b0c7/any-run-cmd-process.jpg Blog - Exploring Ransomware Samples Written As Windows Batch File / HTA Hybrids - Make it stand out cmd.exe process as seen through app.any.run malware sandbox https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/7d9b64e3-2e70-42c9-b1a7-8b0998f11bf9/ransomware-one-liner-batch.jpg Blog - Exploring Ransomware Samples Written As Windows Batch File / HTA Hybrids - Make it stand out The Batch for loop one-liner responsible for file encoding https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/89872e92-c31d-4cad-83d2-cbc5e8a7d573/mshta-ransomware-hta.jpg Blog - Exploring Ransomware Samples Written As Windows Batch File / HTA Hybrids - Make it stand out mshta.exe is assigned to Batch variable https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/e84154da-b3cf-4e04-a201-aaabeb07911d/hta-application-with-ransomeware-message.jpg Blog - Exploring Ransomware Samples Written As Windows Batch File / HTA Hybrids - Make it stand out The HTA application displays the ransom message. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/e2e2d7d3-7560-4898-83d7-820608bc200d/ramonware-ransomeware-message.jpg Blog - Exploring Ransomware Samples Written As Windows Batch File / HTA Hybrids - Make it stand out The ransom message as displayed by the HTA application https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/3aad2def-e6e2-4a08-ad12-67924b89a545/ransomware-sandbox-process-tree.jpg Blog - Exploring Ransomware Samples Written As Windows Batch File / HTA Hybrids - Make it stand out The process tree of the Batch ransomware https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/20209844-7430-4b9b-8718-1b34da6a2ffb/virustotal-batch-ransomware-retrohunt.jpg Blog - Exploring Ransomware Samples Written As Windows Batch File / HTA Hybrids - Make it stand out VirusTotal retrohunt results https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/b5d125e0-7e77-42c0-89c1-87ec84426a15/virustotal-batch-ransomware-0-detection.jpg Blog - Exploring Ransomware Samples Written As Windows Batch File / HTA Hybrids - Make it stand out VirusTotal 0 detections for Batch Ransomware This highlights the continued usefulness of Windows Batch as a language to remain fully undetected by antivirus solutions and the continued difficulties in detecting these types of files. https://www.petergirnus.com/blog/rust-vs-cc-ensuring-memory-safety-and-security monthly 0.5 2023-09-16 https://www.petergirnus.com/blog/creating-writing-reading-files-in-rust monthly 0.5 2023-09-16 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/00590431-9f3d-4523-97f0-240b462b3989/file_mod_directory.jpg Blog - Rust std::fs: Creating, Writing, & Reading Files In Rust - Make it stand out file_mod structure example https://www.petergirnus.com/blog/breaking-down-cisas-open-source-software-security-roadmap monthly 0.5 2023-09-14 https://www.petergirnus.com/blog/starting-google-chrome-from-the-linux-command-line monthly 0.5 2024-05-31 https://www.petergirnus.com/blog/how-to-install-google-chrome-on-debian-linux monthly 0.5 2023-09-14 https://www.petergirnus.com/blog/rust-parsing-directories-and-file-entries-with-direntry monthly 0.5 2023-09-16 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/13d0fc8e-0493-4e4e-9d70-975517a2ade5/rust_src_mod_structure_example.jpg Blog - Rust std::fs: Parsing Directories & File Entries with DirEntry - Make it stand out Example mod directory structure https://www.petergirnus.com/blog/how-to-create-directories-in-rust-with-dirbuilder monthly 0.5 2023-09-16 https://www.petergirnus.com/blog/scanning-files-with-regular-expressions-regex-in-rust monthly 0.5 2023-09-11 https://www.petergirnus.com/blog/how-to-compile-yara-rules-and-scan-files-wth-rust monthly 0.5 2023-09-09 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/61f90000-41ce-46aa-ab75-bc014a86cf0b/rust-and-yara.jpg Blog - How To Compile YARA Rules & Scan With Files Rust - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://www.petergirnus.com/blog/curl-command-line-ultimate-reference-guide monthly 0.5 2023-09-07 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/f1f8494c-b2e4-4810-8a39-0dbb39b736e7/wireshark-window.jpg Blog - cURL - The Ultimate Reference Guide - Make it stand out Wireshark Window https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/b5a95144-3a99-44d2-90cf-d27bc412e9b5/http-multipart-mime-boundary-wireshark.jpg Blog - cURL - The Ultimate Reference Guide - Make it stand out HTTP Multipart Example in Wireshark https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/8c200e9c-f0bc-4dc9-8647-b81f404e443b/wireshark-curl-request-target.jpg Blog - cURL - The Ultimate Reference Guide - Make it stand out Wireshark curl --request-target demo https://www.petergirnus.com/blog/how-to-install-sysinternals-on-windows monthly 0.5 2023-09-05 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/7d115a49-270a-4824-af81-06ac1a96b562/winget-search-sysinternals.jpg Blog - How to Easily Download & Install the Sysinternals Suite on Windows - Make it stand out Output of the winget search sysinternals command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/f2976f5c-3335-4622-880a-9f97f497f823/winget-show-sysinternals.jpg Blog - How to Easily Download & Install the Sysinternals Suite on Windows - Make it stand out Output of the winget show “Sysinternals Suite” command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/c883a913-005d-449f-87f3-08aec0c8d438/winget-install-sysinternals.jpg Blog - How to Easily Download & Install the Sysinternals Suite on Windows - Make it stand out Output of the winget install “Sysinternals Suite” command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/31875574-5394-4c2e-b2ff-7f477c1c4f6a/winget-list-sysinternals.jpg Blog - How to Easily Download & Install the Sysinternals Suite on Windows - Make it stand out Output of the winget list “Sysinternals Suite” command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/87f0a08b-cdae-4168-b5e8-4cc0a5ea9f46/listing-out-sysinternals-suite-with-powershell.jpg Blog - How to Easily Download & Install the Sysinternals Suite on Windows - Make it stand out Output of powershell command to list sysinternals applications https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/dc0d2eae-81b9-4850-9ddd-bf28f3103983/powershell-env-path-split-string.jpg Blog - How to Easily Download & Install the Sysinternals Suite on Windows - Make it stand out Finding WindowsApps using the $env:Path variable and string splitting operations Important to note is that the %LOCALAPPDATA%\Microsoft\WindowsApps should be included by default in the Path variable on all modern Windows devices, so this demonstration only serves as a verification exercise. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/476a06c0-2e45-443b-aa91-635611f2652d/Procmon-sysinternals-main-screen.jpg Blog - How to Easily Download & Install the Sysinternals Suite on Windows - Make it stand out Running Procmon.exe from PowerShell https://www.petergirnus.com/blog/how-to-download-install-putty-on-windows monthly 0.5 2023-09-04 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/436d81bc-dbd7-4f8d-ab46-be8e6a89ec39/winget-search-putty.jpg Blog - How to Download & Install PuTTY On Windows - Make it stand out Output of the winget search putty command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/a119a368-93b7-40dd-8eb2-2f60a121647c/winget-show-putty.jpg Blog - How to Download & Install PuTTY On Windows - Make it stand out Output of the winget show putty command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/0dbf64bf-0b16-4879-94ad-7887587a0740/winget-show-XPFNZKSKLBP7RJ.jpg Blog - How to Download & Install PuTTY On Windows - Make it stand out Output of the winget show XPFNZKSKLBP7RJ command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/cf44816a-101a-4890-be3e-b4d0ab7b325b/winget-show-XPFNZKSKLBP7RJ-2.jpg Blog - How to Download & Install PuTTY On Windows - Make it stand out Highlighted Publisher, Installer Url, and SHA256 of PuTTY package https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/37932a49-d1d1-42cb-9147-f2d7b4c50566/microsoft-app-store-putty-home.jpg Blog - How to Download & Install PuTTY On Windows - Make it stand out Microsoft App Store PuTTY Homepage https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/f9eca150-2581-45bc-bfbf-da77b42e3fa0/winget-show-putty.putty.jpg Blog - How to Download & Install PuTTY On Windows - Make it stand out Output of the winget show PuTTY.PuTTY command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/98d941ad-531b-4c4b-ac66-f83425841cbd/winget-show-putty.putty-simon-tatham.jpg Blog - How to Download & Install PuTTY On Windows - Make it stand out Highlighted Publisher, Installer Url, and SHA256 of PuTTY package https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/62c615d3-38f7-476c-a5c4-a614f3207c08/winget-install-putty.putty.jpg Blog - How to Download & Install PuTTY On Windows - Make it stand out Output of the winget install PuTTY.PuTTY command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/4826fe72-5c13-479d-93b4-d1727d28e560/running-putty-from-powershell.jpg Blog - How to Download & Install PuTTY On Windows - Make it stand out If successful executed we should be greeted with the PuTTY Configuration Window. Awesome! You have now successfully installed PuTTY and can move on to explore its many components, features and use cases in greater detail. Conclusion In conclusion, PuTTY stands as a testament to the enduring relevance of a well-designed and robust software tool in the ever-evolving landscape of remote connectivity and secure communication. Its availability for download through various channels, including the web, Microsoft Windows App Store, and the Windows Package Manager (WinGet), showcases its adaptability to meet the demands of different user preferences and platforms. Throughout this article, we've explored the modern methods for downloading and installing PuTTY, highlighting its accessibility and user-friendly approach. As we delved into its key features and components, we gained an understanding of how PuTTY streamlines the process of connecting to remote servers while maintaining a steadfast commitment to data security. From its support for modern SSH and telnet protocols to its ability to securely transmit data, PuTTY offers a comprehensive solution for those who seek reliable and safe communication channels in an interconnected data driven world. If you like to learn more about using PuTTY you can explore the PuTTY User Manual which comprehensive documentation on the PuTTY tool. If you’d prefer a PDF copy of the PuTTY User Manual you can find that here. https://www.petergirnus.com/blog/how-to-install-yara-malware-analysis-tool-on-windows monthly 0.5 2023-09-04 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/bb9efb88-f016-468d-ad58-15b4c92d8192/winget-search-yara.jpg Blog - How to Install the YARA Malware Analysis Tool On Windows - Make it stand out Output of the winget search yara command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/23d5a1e6-ab42-4b38-8466-ad4ca87fcfe6/winget-show-yara.jpg Blog - How to Install the YARA Malware Analysis Tool On Windows - Make it stand out Output of the winget show VirusTotal.YARA command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/5cf0c32c-8f1e-4db8-8076-645e61037e12/winget-install-yara.jpg Blog - How to Install the YARA Malware Analysis Tool On Windows - Make it stand out Output of the winget install VirusTotal.YARA command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/fc0b9944-0dcc-48b1-a8c3-fbf707a04b5f/yara-scan-example.jpg Blog - How to Install the YARA Malware Analysis Tool On Windows - Make it stand out Output of the yara command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/d3b8807c-489b-40f3-a534-c1a0dc773613/yara-usage-help.jpg Blog - How to Install the YARA Malware Analysis Tool On Windows - Make it stand out Output of the yara —help command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/ed97d2d5-a9f1-4919-bb14-8253465d5ebe/yara-scan-with-compiled-rules-example.jpg Blog - How to Install the YARA Malware Analysis Tool On Windows - Make it stand out Output of the yara command against compiled rules https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/86194873-ff68-4996-884b-e8a8f731bd5c/yarac-usage-help.jpg Blog - How to Install the YARA Malware Analysis Tool On Windows - Make it stand out Output of the yarac —help command https://www.petergirnus.com/blog/how-to-sshfs-on-windows monthly 0.5 2023-10-16 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/f825d892-dbf5-42e0-9359-e59796e3f4e0/winget-show-winfsp-command.jpg Blog - SSHFS On Windows: How To Use - Make it stand out winget show WinFsp.WinFsp output https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/15ff2629-27a3-4db8-a5ef-fb9ce21fa3c7/winget-install-winfsp-command.jpg Blog - SSHFS On Windows: How To Use - Make it stand out winget install WinFsp.WinFsp output https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/6fa0ad15-79f9-41e1-9381-b44bb18c7765/winget-show-sshfs-win-command.jpg Blog - SSHFS On Windows: How To Use - Make it stand out winget show SSHFS-Win.SSHFS-Win output https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/cb56ca43-b4c6-457a-99a4-7ccf72543ed4/winget-install-sshfs-win-command.jpg Blog - SSHFS On Windows: How To Use - Make it stand out winget install SSHFS-Win.SSHFS-Win output https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/c7a46a35-8600-4a96-89ac-fd352571ac5b/windows-explorer-map-network-drive.jpg Blog - SSHFS On Windows: How To Use - Make it stand out Select This PC > Map network drive in Windows Explorer After this a Windows dialog will appear, in this window we need to specify the Drive to mount to as well as the external SSHFS Folder. In order to do so we need the username, host, and remote directory to mount. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/5c213a59-0ae1-4a4b-a921-e0951671299d/windows-explorer-map-network-drive-folder-location.jpg Blog - SSHFS On Windows: How To Use - Make it stand out Specify the Drive & remote SSHFS Folder to mount https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/2cf0681a-3b73-4a50-840d-c9689df6e75a/windows-explorer-map-network-drive-password.jpg Blog - SSHFS On Windows: How To Use - Make it stand out Windows Security password prompt when connecting https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/21e7e992-cc9c-4ace-a42f-9b604d99c99b/windows-explorer-mounted-sshfs-drive-success.jpg Blog - SSHFS On Windows: How To Use - Make it stand out Mounted SSHFS drive in Windows Explorer https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/0f462af6-e966-47ba-b6b3-00cd8d789db8/windows-powershell-net-use-mounting-drive.jpg Blog - SSHFS On Windows: How To Use - Make it stand out Mounting an SSHFS drive using the net use command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/fadfe7f8-886b-45ec-8ca5-8ae2ade15a62/windows-powershell-ls-remote-drive.jpg Blog - SSHFS On Windows: How To Use - Make it stand out Confirming SSHFS drive mount with the ls command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/018c18d8-7a9b-4cfe-88a5-a4ed5fd468c7/net-use-del-drive.jpg Blog - SSHFS On Windows: How To Use - Make it stand out Using net use to delete a drive https://www.petergirnus.com/blog/how-to-use-ssh-on-microsoft-windows monthly 0.5 2023-09-05 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/50bef6d9-4a79-4afa-a910-bb04cff3deb8/winget-search-openssh.jpg Blog - How To Use SSH on Windows - Make it stand out winget search openssh https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/21e2c8cb-dc6a-40a1-bf5c-99f9156121ef/winget-list-command.jpg Blog - How To Use SSH on Windows - Make it stand out winget list Microsoft.OpenSSH.Beta https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/9cc67ffa-708f-4d88-8604-4cb8f790b902/winget-show-package-info-other.jpg Blog - How To Use SSH on Windows - Make it stand out winget show Microsoft.OpenSSH.Beta https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/dcd4c783-2f3b-4e56-9036-f413f9189a97/winget-install-openssh.jpg Blog - How To Use SSH on Windows - Make it stand out winget install Microsoft.OpenSSH.Beta https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/dd448379-f780-48ac-b328-61e6ebd98b39/windows-powershell-enable-%26-start-ssh-agent.jpg Blog - How To Use SSH on Windows - Make it stand out Sequence of commands to enable & start ssh-agent service https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/069d0c3c-dbd4-469f-87a7-f84a7b836adb/windows-ssh-keygen-command.jpg Blog - How To Use SSH on Windows - Make it stand out Generating a new ssh key-pair using the ssh-keygen command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/e4a5be84-1d75-4151-8d07-04ce6196ca94/windows-ssh-add-command.jpg Blog - How To Use SSH on Windows - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/3f93e018-50c9-456b-85f1-57cb48a2addf/linux-windows-ssh-key-location.jpg Blog - How To Use SSH on Windows - Make it stand out The Windows public ssh key located on my Linux machine https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/c1158aa5-ca99-40f9-b49d-41010cc0156b/powershell-get-netipaddress-output.jpg Blog - How To Use SSH on Windows - Make it stand out Get-NetIPAddress command output https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/9ce335f4-3bdd-47fa-9a51-c829511e0802/linux-uname-command-output.jpg Blog - How To Use SSH on Windows - Make it stand out Running the uname -a command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/3d4c3c1d-b7b0-404d-a9f2-dd0b215d5d84/ssh-command-to-windows-from-linux.jpg Blog - How To Use SSH on Windows - Make it stand out Running the SSH command to connect to Windows from Linux https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/3e69dbfd-362c-4226-b0f9-91d55afbbd6b/apt-install-ssh-ubuntu.jpg Blog - How To Use SSH on Windows - Make it stand out Running the sudo apt install -y ssh https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/cce1ed23-e985-434e-bc98-4ac4c00e1bfd/ubuntu-ssh-keygen-command-output.jpg Blog - How To Use SSH on Windows - Make it stand out Running the ssh-keygen command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/63e86ea8-b113-45db-9555-28f7a25ad3f8/ubuntu-ssh-add-command-output.jpg Blog - How To Use SSH on Windows - Make it stand out Running the ssh-add command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/b796be43-8ab8-4699-8c09-f99df29fa9c5/windows-linux-public-key-location.jpg Blog - How To Use SSH on Windows - Make it stand out Verifying the Linux SSH public key with the ls command https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/35fef28d-e79e-447f-b0ad-da58fd3cedbd/ssh-connection-from-windows-to-ubuntu.jpg Blog - How To Use SSH on Windows - Make it stand out Connecting to our Linux machine from Windows with the ssh command https://www.petergirnus.com/blog/how-to-use-sudo-in-powershell monthly 0.5 2023-10-16 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/dfdf13af-0fc7-4801-b516-e1b66bfcab24/winget-search-gsudo.jpg Blog - Sudo in PowerShell: Get Administrator Privileges With gsudo - Make it stand out winget search gsudo Once found, we can then download this package using winget with a simple command. The winget install command will grab the necessary package from GitHub and install it for us. We’ll be installing gsudo with the following command. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/41f9edd1-bfbe-4543-9a82-f7ec85ba0609/winget-install-geradog.gsudo.jpg Blog - Sudo in PowerShell: Get Administrator Privileges With gsudo - Make it stand out winget install geradog.gsudo Once installed we need to make sure that gsudo is correctly added to the Windows Path environment variable. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/b7f9d58c-ebbd-4eef-9b2a-6da7ae2d3000/windows-powershell-updating-path.jpg Blog - Sudo in PowerShell: Get Administrator Privileges With gsudo - Make it stand out windows powershell updating path variable process We can verify that the path was indeed changed to include the path to gsudo in a persistent manner by closing out the powershell console and running the following command. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/96600bbf-aaf8-446f-8c98-69d45dad53c0/windows-env-path-includes-gsudo.jpg Blog - Sudo in PowerShell: Get Administrator Privileges With gsudo - Make it stand out Windows path variable now includes the path to gsudo https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/8d8e14c4-99bd-4afa-b9df-71656e033526/gsudo-uac-prompt.jpg Blog - Sudo in PowerShell: Get Administrator Privileges With gsudo - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/b69ffd9d-6122-42d9-a6d8-0d2b735a32b9/gsudo-elevated-prompt.jpg Blog - Sudo in PowerShell: Get Administrator Privileges With gsudo - Make it stand out gsudo elevated prompt window Once we have successfully run gsudo notice the elevated terminal. We can verify the window is elevated by running gusdo again. If already elevated gsudo will return an already running with elevated permissions error. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/3ceff507-6c92-41ff-86a8-5069730e2a5e/gsudo-verify-admin.jpg Blog - Sudo in PowerShell: Get Administrator Privileges With gsudo - Make it stand out gsudo already running with specified user/permission-level error https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/d24cb6eb-e2fd-4d0c-bc5a-596fb79724de/gsudo-help-comand.jpg Blog - Sudo in PowerShell: Get Administrator Privileges With gsudo - Make it stand out gsudo —help command You can also visit the gsudo documentation page for usage tips and tricks as well as everyday usage. If you run into any issues there is also a common troubleshooting page as well as a known issues page. Conclusion In this post we took a look at how to install the gsudo the Windows functional equivalent of sudo. Using gsudo we are able to elevate our terminal to the Administrator account similar to how the sudo command runs commands as the Linux root user. https://www.petergirnus.com/blog/how-to-install-windows-10-on-vmware-fusion monthly 0.5 2023-09-02 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/0e33bd2a-8a41-445c-9dca-697fd530c816/windows10-download-page.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Microsoft Windows Software Download Page - Windows 10 ISO https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/f915e45f-7051-413c-879a-93a1028fe558/windows-release-information-page.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Microsoft Windows Release Health Page https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/0d328a54-c453-4b8c-9d50-29cf6930875c/windows-releases-known-issues-page.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/4984ee2e-c5dd-4f1e-a66b-35f679381eb7/windows-10-iso-select-edition.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Select Windows 10 Edition ISO https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/ddd1ba9b-2a1c-4fcf-91c4-761ebb631d89/windows-10-iso-select-language.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Select Windows Product Language https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/b381c044-3f5d-455a-9e46-44e900d1618d/windows-10-iso-select-cpu-version.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Select Windows 10 64-bit or 32-bit Download https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/1650a57d-9aaa-4072-88c1-acc0e8f14345/chrome-download-of-windows-10-iso.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Windows 10 ISO Download on Google Chrome https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/a118ba2f-c9a3-43c0-919e-59c84249a37a/vmware-fusion-add-new-vm.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Add new virtual machine on VMWare Fusion https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/6d1085d1-d8a6-4419-87ed-10df5621e8c5/vmware-fusion-select-iso-image.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Choose the Windows 10 ISO Image https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/a015b0cc-9bee-49f6-96b2-4330b6b859d4/vmware-fusion-windows-easy-install-create-user.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Create a Windows 10 Account on Windows Easy Install https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/8020952c-d437-471d-bc6d-2f027361513e/vmware-fusion-windows-select-windows-10-product.jpg Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Select Windows 10 Product Version https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/6b3db158-57e2-46c3-96ae-67a33a9b41f2/vmware-fusion-windows-integration-option.jpg Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Select VMWare Fusion Windows Integration Option https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/f344fb31-d5c8-4c2b-9c2b-1e7e02eede49/vmware-fusion-windows-10-finish-configuration.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out VMWare Fusion Finalize Windows 10 Configuration Screen https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/625b865b-f088-42c4-9f12-b74df4be7084/vmware-fusion-save-your-virtual-machine.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out VMWare Fusion Save Windows 10 Virtual Machine https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/638d13a9-fbf3-4950-811f-1e53c16a87bf/vmware-fusion-select-network-adaptor.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out VMWare Fusion Select Network Adaptor In the Network Adaptor settings simply uncheck the Network Adaptor. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/408287ec-85e0-429c-afe5-0e69ee6f1a89/vmware-fusion-uncheck-network-adaptor.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out VMWare Fusion Unselect Connect Network Adaptor https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/15c1546e-5b6f-49b5-810b-f338fab24e9a/vmware-fusion-select-processors-%26-memory.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out VMWare Fusion Select Processors & Memory https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/7b7ae7e3-b407-4751-9b04-ed023cf67967/vmware-fusion-increase-processors-%26-memory.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out VMWare Fusion Increasing Processors & Memory https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/6b8e281f-7abb-4a97-a4cd-efdaf65bc32a/vmware-fusion-play-button.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out VMWare Fusion Play Button https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/babedf08-90bf-4640-9272-9f688991eacf/windows-setup-installing-windows-screen.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Windows Setup Installing Window Screen https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/24525b66-e2df-4c66-882f-2fff5393cd54/windows-setup-installing-windows-getting-ready.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Windows Setup Getting Ready Screen https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/e2e3456f-2641-470d-8d52-2628efd35d4f/windows-setup-this-might-take-awhile.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Windows Setup This Might Take Awhile Screen https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/17b050e4-deb3-492d-b7a1-9524e515515f/windows-login-screen.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Windows Login Screen https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/802e6df5-c706-483f-b2ce-965d0e951770/microsoft-windows-10-desktop-screen.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Microsoft Windows 10 Desktop Screen https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/feff18dc-3c62-4130-a496-017b569be2e7/vmware-fusion-select-settings.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out VMWare Fusion options, select Settings https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/3b7bfdcf-ab44-469d-bd00-61ba4cc70353/vmware-fusion-network-adaptor.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out VMWare Fusion Network Adaptor option https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/6737540c-19e5-4123-99d4-9add33f7d8c3/vmware-fusion-turn-on-network-adapter.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out VMWare Fusion select Connect Network Adapter https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/081455e8-a767-42f0-8574-0f250e7a9b71/microsoft-windows-store-windows-terminal.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out Microsoft Windows Applications Windows Terminal Page If you’d like to learn how to install Windows Applications using the Windows Package Manager (winget) tool feel free to read my previous blog post on this awesome tool. Taking a Snapshot To finalize installing Windows 10 on VMWare Fusion it’s a great idea to take a snapshot of the virtual machine post installation. This is done after you’ve installed the necessary software specific to your needs. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/fd8eb667-d68c-4602-8cd5-dd271b3abce2/vmware-fusion-take-a-snapshot-option.png Blog - How To Install Windows 10 on VMware Fusion - Make it stand out VMWare Fusion Take Snapshot https://www.petergirnus.com/blog/how-to-use-windows-package-manager-winget monthly 0.5 2023-10-04 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/fdb3b932-1eb2-4df1-8156-2ee7e14b9934/winget-version-command.jpg Blog - How To Use Windows Package Manager (WinGet) Tool - Make it stand out How to get winget version with winget-cli. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/406109c0-5490-4aa5-93fa-6ac0f403ceaa/Windows-App-Installer-Store-Page.jpg Blog - How To Use Windows Package Manager (WinGet) Tool - Make it stand out Microsoft Store Page - App Installer https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/2ed501ca-79eb-47ee-94cb-8c8f679681f2/winget-help-command.jpg Blog - How To Use Windows Package Manager (WinGet) Tool - Make it stand out How to get help information through winget-cli. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/2a6f54b3-75b0-4296-981a-4eabbc1d8963/winget-install-help-command.jpg Blog - How To Use Windows Package Manager (WinGet) Tool - Make it stand out How to get install help information through winget-cli. As you can see finding how to correctly use the winget-cli is a straightforward process. You can find more information on using winget from the Microsoft learn portal here. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/c1b52be4-8645-4296-a9ce-59144763fbf2/winget-search-powershell-results.jpg Blog - How To Use Windows Package Manager (WinGet) Tool - Make it stand out winget search powershell results https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/390a64e3-5824-4279-9c35-f68a767d943a/winget-show-package-info.jpg Blog - How To Use Windows Package Manager (WinGet) Tool - Make it stand out winget show Microsoft.OpenSSH.Beta https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/d9dce7ad-5d4a-45f5-9db6-cd809fce8e56/winget-install-powertoys.jpg Blog - How To Use Windows Package Manager (WinGet) Tool - Make it stand out winget install Microsoft.PowerToys https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/e33a2b2b-b512-4d96-b8e2-b80d955263b8/winget-uninstall-powertoys.jpg Blog - How To Use Windows Package Manager (WinGet) Tool - Make it stand out winget uninstall powertoys https://www.petergirnus.com/blog/what-is-reflective-code-loading-t1620 monthly 0.5 2023-09-02 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/d9f4e416-4438-41ec-81f0-75b36bd286e3/AdobeStock_335855451.jpeg Blog - Exploring Defense Evasion through Reflective Code Loading (T1620) - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/e06d196a-df20-4687-94fe-382fcebf7751/PowerShell-csc-exe-compile.jpg Blog - Exploring Defense Evasion through Reflective Code Loading (T1620) - Make it stand out Figure 1 - PowerShell Compiling a C# File With csc.exe https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/87800a6a-f84a-4454-aaf0-4b151d48609d/python-simple-http-server.jpg Blog - Exploring Defense Evasion through Reflective Code Loading (T1620) - Make it stand out Figure 2 - Running Python's Simple HTTP Server https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/1a065585-a1d0-4aef-acdd-af2f14294409/assembly-reflection-to-calculator.jpg Blog - Exploring Defense Evasion through Reflective Code Loading (T1620) - Make it stand out Figure 3 - Executable is Reflectively Loaded in Memory https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/4438c00b-18df-477c-a5fd-85329dc18623/python-http-server-logs.jpg Blog - Exploring Defense Evasion through Reflective Code Loading (T1620) - Make it stand out Figure 4 - Python HTTP Server Logs https://www.petergirnus.com/blog/how-to-make-http-requests-in-rust monthly 0.5 2023-09-04 https://www.petergirnus.com/blog/decrypting-https-traffic-with-mitmproxy-amp-wireshark monthly 0.5 2023-09-02 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/e252122c-3f42-4de3-b7a4-518a9c620a69/mitm-proxy.png Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/0d4434b8-df9a-48c0-9e0f-e62604d0dd28/version.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Verifying that mitmproxy is installed on our host. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/7cc89de7-7553-4b6b-99e3-c234eeb08070/wireshark-logo.png Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/9b6b972c-b7ff-4e69-95e2-0f12808afa6a/wireshark_int_screen.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out This screen shows us the available network interfaces wireshark can sniff on. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/d090c697-4c94-4296-a27f-34579d2db0ff/encrypted_example.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/4d4ee4bf-593e-4dce-80e6-233f12a9d9a7/macOS-system-pref.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/f4214985-7e59-4171-851f-e3b8a2d19fee/macOS-system-pref-network.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/9fe062dd-9a92-4e47-8bb3-7e0bedc3ce02/macOS-system-pref-proxy-settings.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/81cbe06a-61b2-42f0-9708-976ad419e21e/windows_search_settings.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/84fa0564-b3a3-455c-ae6e-46e785b448cb/open_network_settings.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/8557f33b-d270-4f98-864e-fcb90b18ba20/proxy_settings_windows.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/45117887-cc1b-42f3-9d7a-e63708cbd4bf/traffic_not_passing_through_proxy.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Traffic IS NOT passing through mitmproxy. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/644bd591-04d7-47fe-b710-f423a6216c2a/image-asset.jpeg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Traffic IS passing through mitmproxy. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/c808e559-a908-4800-9609-4da8af31b29b/macos-dl-cert-authority.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/871fb53c-0068-454f-890e-c7f14301479f/macos-cert-downloads.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/097b7bc7-1c82-4165-8669-5c9ec986141a/macos-cert-keychain-import.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/4ee7b66c-c280-4c3d-a6ba-923f1da900fc/macos-cert-keychain-import-point-to-file.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/765d8210-c964-409d-a92a-c2da497ea2b2/macos-cert-keychain-pem-imported.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/097b6b69-d12b-40c8-a65b-284e7e44cefe/macos-cert-keychain-pem-always-trust.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/823677a7-a746-42b4-bef0-c8cf97eb373a/windows-dl-cert-authority.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/8f5777b0-67a7-4910-b8fa-66d133934672/windows-cert-downloads.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/4faf391a-f14a-4704-8c6e-db35a05ddaa3/windows-cert-store-loc.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Store Location should be Current User https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/d5db8627-c29b-4191-8b3f-32fd8330b359/windows-cert-cert-loc.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Be sure that the File name is pointed to the location of our certificate https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/90c75148-5199-4011-8782-c5beb58de462/windows-cert-cert-key-prot.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Leave the defaults with no password for Private key protection https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/aabec3c0-fdb4-41e5-8ab5-3377146a1d0f/windows-cert-cert-store.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Keep the default option on the Certificate Store https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/591da0f7-ae41-4aeb-b6bb-17048dc998fa/windows-cert-cert-completing.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Verify the File Name is pointed to your key and Content is PFX. If not PFX you downloaded the wrong key from http://mitm.it. If all is well click Finish. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/5d12c353-3079-4338-be8d-b344282c8bc2/windows-cert-cert-success.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out You should be notified that the import was successful after you click finish. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/c36b86d5-f466-47c5-a137-45ceeaed2965/ps1-run-mitmproxy.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/f0e8fe2d-a88f-491b-855d-18f8e155d4f1/image-asset.jpeg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out A list of flows intercepted by mitmproxy https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/f024728b-e160-4e92-9609-36d1223a019e/image-asset.jpeg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Sample decrypted flow, plaintext is redacted. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/7f73c337-bd6a-45c0-a25f-b3c4546e1d32/Wireshark-TLS-Pref-Open.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/36f5312a-684e-4360-a4a9-f16a30f4d2f3/Wireshark-TLS-Pref-Open-proto.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/436a52ec-ffbe-4e26-a7ec-2864a7afa6a5/Wireshark-TLS-Pref-TLS-master-secret.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/d34ef94e-b6e9-4e72-9f9e-71f4756da5a9/wireshark-select-interface.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/b6b970ec-d954-4cb9-b4ee-75fe21611ead/wireshark-443-filter.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/eece6732-1556-46a4-aca4-8e2821de373d/wireshark-decrypted-traffic.jpg Blog - Decrypt Traffic with Mitmproxy & Wireshark - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://www.petergirnus.com/blog/how-to-use-sshfs-on-macos monthly 0.5 2024-04-25 https://www.petergirnus.com/blog/how-i-passed-the-az-900-microsoft-azure-fundamentals-exam monthly 0.5 2023-08-31 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/1625221638242-ELUR2DF3UZY91RKC6GBA/microsoft-certified-azure-fundamentals+%282%29.png Blog - How I passed the AZ-900 Microsoft Azure Fundamentals Exam - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://www.petergirnus.com/blog/how-i-passed-the-clf-c01-aws-certified-cloud-practitioner-exam monthly 0.5 2023-09-04 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/1624739627691-URWA2T6UPUE8KGR0BQXJ/sybex-aws-certified-cloud-practitioner.jpg Blog - How I passed the CLF-C01 AWS Certified Cloud Practitioner Exam - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://www.petergirnus.com/blog/how-i-passed-the-200-201-cbrops-cisco-cyberops-associate-exam monthly 0.5 2023-09-04 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/1624039061829-L6QNYIHNQSMKP0FA401P/cisco-certified-cyberops-associate+%281%29.png Blog - How I passed the 200-201 (CBROPS) Cisco Cyberops Associate Exam - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/1624040283428-90E03EFWT4MPW9ZS04US/Cisco+CyberOps+Associate+CBROPS+200-201+Official+Cert+Guide.jpg Blog - How I passed the 200-201 (CBROPS) Cisco Cyberops Associate Exam - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/1624040193981-Y69JCSQTGI31SUN9C8O8/NIST-logo.jpg Blog - How I passed the 200-201 (CBROPS) Cisco Cyberops Associate Exam - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/1624045378473-0U8IPMRHY02MDOEEAEIL/cbrops-notion-exam-schedule.jpg Blog - How I passed the 200-201 (CBROPS) Cisco Cyberops Associate Exam - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/1624042994383-RRZXK4DO8SRLS5EPN9BF/notion-cbrops-notes-chapter+overview.jpg Blog - How I passed the 200-201 (CBROPS) Cisco Cyberops Associate Exam - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/1624043196279-O5DHZ20R20VS76YRRRY4/notion-cbrops-notes-chapter-sample.jpg Blog - How I passed the 200-201 (CBROPS) Cisco Cyberops Associate Exam - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/1624057867122-CUZWPJMD1VVRNEF3SQDQ/cbrops-chapter-1-mind-map.jpg Blog - How I passed the 200-201 (CBROPS) Cisco Cyberops Associate Exam - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://www.petergirnus.com/blog/category/filetypes monthly 0.5 https://www.petergirnus.com/blog/category/ssh monthly 0.5 https://www.petergirnus.com/blog/category/nodejs monthly 0.5 https://www.petergirnus.com/blog/category/fs monthly 0.5 https://www.petergirnus.com/blog/category/network monthly 0.5 https://www.petergirnus.com/blog/category/cloud monthly 0.5 https://www.petergirnus.com/blog/category/wireshark monthly 0.5 https://www.petergirnus.com/blog/category/rust monthly 0.5 https://www.petergirnus.com/blog/category/threat-hunting monthly 0.5 https://www.petergirnus.com/blog/category/how-to monthly 0.5 https://www.petergirnus.com/blog/category/git monthly 0.5 https://www.petergirnus.com/blog/category/mini+how-to monthly 0.5 https://www.petergirnus.com/blog/category/dev monthly 0.5 https://www.petergirnus.com/blog/category/devops monthly 0.5 https://www.petergirnus.com/blog/category/powershell monthly 0.5 https://www.petergirnus.com/blog/category/linux monthly 0.5 https://www.petergirnus.com/blog/category/cisa monthly 0.5 https://www.petergirnus.com/blog/category/programming monthly 0.5 https://www.petergirnus.com/blog/category/macos monthly 0.5 https://www.petergirnus.com/blog/category/azure monthly 0.5 https://www.petergirnus.com/blog/category/tech monthly 0.5 https://www.petergirnus.com/blog/category/s3 monthly 0.5 https://www.petergirnus.com/blog/category/rust-fs monthly 0.5 https://www.petergirnus.com/blog/category/registry monthly 0.5 https://www.petergirnus.com/blog/category/python monthly 0.5 https://www.petergirnus.com/blog/category/malware monthly 0.5 https://www.petergirnus.com/blog/category/chrome monthly 0.5 https://www.petergirnus.com/blog/category/google monthly 0.5 https://www.petergirnus.com/blog/category/npm monthly 0.5 https://www.petergirnus.com/blog/category/windows monthly 0.5 https://www.petergirnus.com/blog/category/certifications monthly 0.5 https://www.petergirnus.com/blog/category/cybersecurity monthly 0.5 https://www.petergirnus.com/blog/category/expressjs monthly 0.5 https://www.petergirnus.com/blog/category/systems+administration monthly 0.5 https://www.petergirnus.com/blog/category/javascript monthly 0.5 https://www.petergirnus.com/blog/category/crypto monthly 0.5 https://www.petergirnus.com/blog/category/bash monthly 0.5 https://www.petergirnus.com/blog/category/aws monthly 0.5 https://www.petergirnus.com/blog/category/nsa monthly 0.5 https://www.petergirnus.com/blog/tag/PowerShell monthly 0.5 https://www.petergirnus.com/blog/tag/Automation monthly 0.5 https://www.petergirnus.com/blog/tag/malware monthly 0.5 https://www.petergirnus.com/blog/tag/sap monthly 0.5 https://www.petergirnus.com/blog/tag/patch-day monthly 0.5 https://www.petergirnus.com/blog/tag/Certifications monthly 0.5 https://www.petergirnus.com/blog/tag/july monthly 0.5 https://www.petergirnus.com/blog/tag/Cybersecurity monthly 0.5 https://www.petergirnus.com/blog/tag/Windows monthly 0.5 https://www.petergirnus.com/blog/tag/cybersecurity monthly 0.5 https://www.petergirnus.com/blog/tag/InfoSec monthly 0.5 https://www.petergirnus.com/blog/tag/Scripting monthly 0.5 https://www.petergirnus.com/blog/tag/network monthly 0.5 https://www.petergirnus.com/blog/tag/threat-hunting monthly 0.5 https://www.petergirnus.com/blog/tag/2025 monthly 0.5 https://www.petergirnus.com/blog/tag/ivanti monthly 0.5 https://www.petergirnus.com/blog/tag/Cloud monthly 0.5 https://www.petergirnus.com/blog/tag/Cisco monthly 0.5 https://www.petergirnus.com/blog/tag/threat monthly 0.5 https://www.petergirnus.com/blog/tag/Amazon monthly 0.5 https://www.petergirnus.com/blog/tag/AWS monthly 0.5 https://www.petergirnus.com/home daily 1.0 2024-02-20 https://www.petergirnus.com/contact daily 0.75 2023-08-31 https://www.petergirnus.com/about daily 0.75 2023-09-03 https://images.squarespace-cdn.com/content/v1/60c543f3dd587909185f6a3f/1623957995190-C9TDJZ1WWD7LRMWFABZ5/image-asset.png About - Welcome! Hi, my name is Peter Girnus and I'm a threat researcher by profession living in sunny Austin, Texas. When not creating content or analyzing the vulnerabilities as a security researcher, I enjoy spending time with my family, learning new skills, sharpening existing ones, and programming/automating my life. Some things I enjoy: Travel Motorcycles Powerlifting Products Reading Gaming Animals Food Coffee & Tea Design Photography https://www.petergirnus.com/home-1 daily 0.75 2025-06-10 https://www.petergirnus.com/store daily 0.75 2023-09-04