Learning PowerShell — Let’s Do It Together — Part 2

Kamran Saifullah
6 min readFeb 8, 2020

In the previous article which can be found at Part 1 we discussed the basis of PowerShell and also we took a look onto different cmdlets including Start-Process, Stop-Process, Get-Hotfix, Get-Help, Get-Command etc.

In this section which is Part 2, we will be looking onto different format types available in PowerShell. There are always some default behavior with the tools and software’s but they can be extended. In PowerShell they are called cmdlets. These cmdlets can be a part of Utility, Core etc. but can be utilized with PowerShell.

There is a particular format for the data which is displayed on the screen. We also know that there are rows and columns on the screen as well as grids too. So PowerShell gives us different options to format the output of our command. Let’s take a look onto those cmdlets together.

In order to find all the cmdlets which has the functionality for “Format” can be found by issuing the following command.

Get-Command -CommandType cmdlet -Name Format*

We can see that there 5 cmdlets but 4 cmdlets specifically made by Microsoft. Let’s take a look onto 4 of these cmdlets one by one.

1. Format-Table

At first, let’s take a look onto Format-Custom. As this cmdlet has to work with data which will be prompted on the screen. We will work with the processes to see how their output format can be changed by using these cmdlets.

In order to list the processes, we know that we need to use “Get-Proces” then we will have to pipe | the output of Get-Process cmdlet to Format-Table cmdlet.

We can see that this command has formatted the output in the form of table and this is the default behavior of PowerShell. If we don’t supply Format-Table and only do Get-Process. We will have the same output.

One thing has to be noted down here. There is a lot more information other than what is being displayed. Sometimes we are in the need to look for that information. For that we can use the following command to list everything that’s been hidden from being displaying on the screen.

Get-Process | Format-Table *

We can see that we have a lot more information now.

2. Format-Wide

The next format is the Format-Wide. This shows the data listed to one another. The command which is to be used is.

Get-Process | Format-Wide

3. Format-List

Now, we will take a look onto Format-List. This command generates a list of the data which is required to be displayed on the screen. The command to be utilized is as above.

Get-Process | Format-List

We can see that we have a list of processes and their corresponding information.

Also, a lot more information is hidden but we can also display that by supplying the wildcard (*).

Get-Process | Format-List *

We can see that we have a lot more information now.

4. Format-Custom

The last format that we will be looking at now is “Format-Custom”. This generates a custom output for the data that has to be printed on the screen. With Get-Process cmdlet we can also supply a particular process name to view that in particular format. Let’s use the following command to do this work.

Get-Process ‘Adobe CEF Helper’ | Format-Custom

Now we will be taking a look onto the cmdlets that has to work with the Output. We can use the below command to find the cmdlets that work solely with the output.

Get-Command -CommandType cmdlet -Name out*

We can see that total of 7 cmdlets. Let’s take a look onto these one by one.

1. Out-Default

This is the default output format and in actual does not have any effect on the output unless and until we write our down Out-Default function!

Get-Process | Out-Default

We can see that it does not have much effect on the output.

2. Out-GridView

Now let’s take a look onto the other cmdlet which is Out-GridView. This view allows us to view all the details in a nice and formatted GUI i.e. the GridView.

It’s good for someone who really hate command line and don’t want to use the CMD meanwhile it is also good for the eyes!

3. Out-Host

This is the default cmdlet for displaying the output on the screen. It doesn’t really matters if we supply this cmdlet or not.

We can see that this is same output which we will get when using simply the “Get-Process” cmdlet.

4. Out-Null

This is used only when we don’t want to display any output on the screen. This will be more valuable when there are a lot of garbage data or errors and we don’t want to get them displayed when we are working with the data.

5. Out-Printer

This cmdlet is used to send output to the default printer or to an alternate printer, if one specified.

6. Out-String

PowerShell works on Objects and everything we work with and see on the screens is somehow an object. We manipulate objects. This cmdlet “Out-String” uses the strings and returns them as a single string,. We can also direct the Out-String to return one string at a time. This also helps us in searching and manipulating the string output as we would wish in traditional shells when object manipulation is less convenient.

Let’s say that we have numbers from 1–10 and we want them to be displayed on a separate line each!

“1”, “2”, “3”, “4”, “5”, “6”, “7”, “8”, “9”, “10” | Out-String

We can see that, Out-String has treated every input supplied to be an Object and have then converted them into a string each and finally have displayed the output.

7. Out-File

This cmdlet is similar to the functions/functionality which allows us to save data input the files and also the output to be moved into specific files for log creation etc.

With the Out-File cmdlet we need to specify the location where there will be file created with the output which is required to be added within that file. Let’s suppose that we want to move all the processes running into a file so we can do it in the following ways.

Get-Process | Out-File -FilePath ‘C:\Users\Kamran Saifullah\Downloads\processes.txt’

We can see that a file has been created with the name of “processes”.

On opening the file, we can see that the processes information has been copied into this file!

I hope that you have learnt something valuable. We will dive more into PowerShell in our next article!

--

--

Kamran Saifullah

Malware/RE/Firmware Analysis, App Sec/Off Sec, VAPT, Phishing Simulations/SE | Risk Management, IS Governance, Audits, ISO 27001 LI