HTTP requests with PowerShell's Invoke-WebRequest – by Example

If you ever find yourself on a Windows system needing to make a HTTP request, the Invoke-WebRequest cmdlet will be your friend. Let’s have a look on how to send various things with iwr (legit alias!) and how to get around common issues. We will be focussing on (manually) sending/requesting data, not so much on reading/parsing it. In case it’s the first time you’re using Invoke-WebRequest or doing stuff with PowerShell in general, I recommend reading this post sequentially from top to bottom. ...

April 12, 2019

Hidden in plain sight: Alternate Data Streams

Have you ever wondered how a file in a file listing is shown with size 0 bytes but can still contain data? Or maybe wondered where all that meta data is stored, how malware can infect files or just how you can “hide” stuff in a file? Let’s talk about Alternate Data Streams to learn more. ADS - Alternate Data Streams When you hear “Alternate Data Streams” you may think about resource forks in Mac OS HFS. But we’re talking about Windows and NTFS. Back in the days of Windows NT 3.1 (ha!), NTFS streams were actually implemented to support the Mac resource forks. ...

February 23, 2019

Running a script in the Windows Local System account

Today I needed to debug a scheduled script and test its behavior when run in the Windows Local System account instead of my regular domain user’s (this was on Windows Server 2016 but should work the same in (much) older versions). I did a bit of research and found a tool from the PsTools suite on sysinternals called PsExec. It is mainly for executing programs on remote machines and gives you the ability to launch interactive command prompts. Good stuff, even though we only need a tiny portion of its capabilities. ...

August 17, 2018