Moulick Aggarwal Moulick

Native Secure Enclave backed ssh keys on MacOS

It turns out that MacOS Tahoe can generate and use secure-enclave backed SSH keys! This replaces projects like https://github.com/maxgoedjen/secretive

There is a shared library /usr/lib/ssh-keychain.dylib that traditionally has been used to add smartcard support to ssh by implementing PKCS11Provider interface. However since recently it also implements SecurityKeyProivder which supports loading keys directly from the secure enclave! SecurityKeyProvider is what is normally used to talk to FIDO2 devices (e.g. libfido2 can be used to talk to your Yubikey). However you can now use it to talk to your Secure Enclave instead!

How to use Bitwarden CLI with macOS Touch ID

If you want to use Bitwarden CLI for ssh have a look at: How to use use Bitwarden CLI for SSH-Keys in macOS

Wirtten and tested on macOS Ventura

Configure Touch ID for the `sudo` command

To allow Touch ID on your Mac to authenticate you for sudo access instead of a password you need to do the following.

Circumventing Deep Packet Inspection with Socat and rot13

I have a Linux virtual machine inside a customer's private network. For security, this VM is reachable only via VPN + Citrix + Windows + a Windows SSH client (eg PuTTY). I am tasked to ensure this Citrix design is secure, and users can not access their Linux VM's or other resources on the internal private network in any way outside of using Citrix.

The VM can access the internet. This task should be easy. The VM's internet gateway allows it to connect anywhere on the internet to TCP ports 80, 443, and 8090 only. Connecting to an internet bastion box on one of these ports works and I can send and receive clear text data using netcat. I plan to use good old SSH, listening on tcp/8090 on the bastion, with a reverse port forward configured to expose sshd on the VM to the public, to show their Citrix gateway can be circumvented.

Rejected by Deep Packet Inspection

I hit an immediate snag. The moment I try to establish an SSH or SSL connection over o

Proxifying a VMware Fusion virtual machine on macOS

This is a little guide that helps you to "proxify" a VMware Fusion virtual machine on macOS. This can be useful if you want to isolate and analyse web traffic to/from an application by running it in a VM.

Prerequisites

VMware Fusion 11 Pro
Transparent HTTP/HTTPS proxy (e.g. Burp Suite Pro or mitmproxy)

javascript:(function(){
  allowCopyAndPaste = function(e){
  e.stopImmediatePropagation();
  return true;
  };
  document.addEventListener('copy', allowCopyAndPaste, true);
  document.addEventListener('paste', allowCopyAndPaste, true);
  document.addEventListener('onpaste', allowCopyAndPaste, true);
})();

ANSI Escape Sequences

Standard escape codes are prefixed with Escape:

Ctrl-Key: ^[
Octal: \033
Unicode: \u001b
Hexadecimal: \x1B
Decimal: 27

Hyperlinks (a.k.a. HTML-like anchors) in terminal emulators

[ Update 2025-03-24: Commenting is disabled permanently. Previous comments are archived at web.archive.org. ]

Most of the terminal emulators auto-detect when a URL appears onscreen and allow to conveniently open them (e.g. via Ctrl+click or Cmd+click, or the right click menu).

It was, however, not possible until now for arbitrary text to point to URLs, just as on webpages.

kubectl -n kube-system create sa tiller
kubectl create clusterrolebinding tiller --clusterrole cluster-admin --serviceaccount=kube-system:tiller
helm init --service-account tiller

	! Ublock Origin rules to hide the Amazon.com Cart sidebar that can't be officially hidden

	! hide the sidebar
	www.amazon.com###nav-flyout-ewc
	www.amazon.com###nav-flyout-anchor

	! ensure the rest of the site covers full width
	www.amazon.com##body:style(padding-right: 0px !important)

	#!/bin/bash -xe

	# Below command can be replaced to the required CLI, including with custom JSON output, assuming the NextToken is in the same location.
	AWS_CLI_COMMAND="aws elasticbeanstalk list-platform-versions --max-records 100 --query={NextToken:NextToken,PlatformARNs:PlatformSummaryList[*].PlatformArn}"
	OUTPUT_FILE="./output-$(date +%s)"

	function CLI_call() {
	if [ ! -v NEXT_TOKEN ]; then
	cli_output=$($AWS_CLI_COMMAND)
	else