C# 6.0 Language Preview

There’s nothing particularly revolutionary or earth-shattering in C# 6.0. If you compare it to other significant releases, like generics in C# 2.0, LINQ in C# 3.0 or TAP in C# 5.0, C# 6.0 is more of a “dot” release than a major one. (The big news being the compiler has been released as open source.)

 

1.     Indexed Members and Element Initializers

2.     Auto-Properties with Initializers

3.     Primary Constructors

4.     Static Using Statements

5.     Declaration Expressions

6.     Exception-Handling Improvements

 

Check below reference for more details.

 

Reference: http://msdn.microsoft.com/en-us/magazine/dn683793.aspx

 

 

Note:

The above C#-specific are implemented entirely in the compiler, without any dependency on an updated Microsoft .NET Framework or runtime.

This means you can adopt C# 6.0 in your development without having to upgrade the .NET Framework for either development or deployment.

In fact, installing the C# 6.0 compiler from this release involves little more than installing a Visual Studio 2013 extension, which in turn updates the MSBuild target files.

 

 

Hope this helps.

 

Arun Manglick

 

VS 2013 - Browser Link

Browser Link – SignalR channel between browser and Visual Studio

 

The new Browser Link feature in VS 2013 lets you run your app within multiple browsers on your dev machine, connect them to Visual Studio, and simultaneously refresh all of them just by clicking a button in the toolbar.

 

You can connect multiple browsers (including IE, FireFox, Chrome) to your development site, including mobile emulators, and click refresh to refresh all the browsers all at the same time.  This makes it much easier to easily develop/test against multiple browsers in parallel.

 

Browser Link also exposes Browser Link API  o enable developers to write Browser Link extensions. 

By enabling developers to take advantage of the Browser Link API, it becomes possible to create very advanced scenarios that crosses boundaries between Visual Studio and any browser that’s connected to it.

 

Web Essentials takes advantage of the API to create an integrated experience between Visual Studio and the browser’s developer tools, remote controlling mobile emulators and a lot more.

 

 

Hope this helps.

 

Arun Manglick

 

Web Application Security & Non-Hacking Tools & Techniques

Below are major threat categories. We'll study here different tools and techniques to prevent such attacks.

1. Cross Site Scripting(XSS) & HTML Injection 
2. Cross site request Forgeries(CSRF)
3. Session Hijacking
4. Injection
• SQL Injection
• HTML Injection
• HTTP header injection
• Mail-header injection
• OS command injection
5. Sensitive Data Handling
6. Phishing Attack
7. Click-Jacking
8. Directory Traversal
9. Race Condition
10. Access Control
11. Encryption
12. Programming
13. Input Validation

Security Vulnerability Tools: 

• Ref: https://phoenixnap.com/blog/vulnerability-assessment-scanning-tools
• Few :
• W3AF - Web Application Attack Framework - Free and open-source vulnerability scanning tool for web applications. It creates a framework which helps to secure the web application by finding and exploiting the vulnerabilities. Also has exploitation facilities used for penetration testing work as well. 
• Acunetix  - Paid web application security scanner (open-source version also available) with many functionalities provided. Around 6500 vulnerabilities scanning range is available with this tool. In addition to web applications, it can also find vulnerabilities in the network as well. Provides ability to automate your scan. HSBC, NASA, USA Air force are few industrial giants who use this for vulnerability tests.
• Intruder - Paid vulnerability scanner specifically designed to scan cloud-based storage. Intruder software starts to scan immediately after a vulnerability is released. The scanning mechanism in Intruder is automated and constantly monitors for vulnerabilities. Also identify network vulnerabilities as well as provide quality reporting and suggestions.

1). Cross Site Scripting(XSS):

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. 

• XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.
• An attacker can use XSS to send a malicious script to an unsuspecting user. 
• The end user’s browser has no way to know that the script should not be trusted, and will execute the script. 
• The malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. 
• These scripts can even rewrite the content of the HTML page.

Cross-site scripting (XSS) vulnerabilities occur when:

• Untrusted data enters a web application, typically from a web request.
• The web application dynamically generates a web page that contains this untrusted data.
• During page generation, the application does not prevent the data from containing ontent that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes, mouse events, Flash, ActiveX, etc.
• A victim visits the generated web page through a web browser, which contains malicious script that was injected using the untrusted data.
• Three Types of XSS:
• Type 1: Reflected XSS (or Non-Persistent) - The server reads data directly from the HTTP request and reflects it back in the HTTP response.
• Type 2: Stored XSS (or Persistent) - The application stores dangerous data in a database, message forum, visitor log, or other trusted data store. At a later time, the dangerous data is subsequently read back into the application and included in dynamic content.
• Type 0: DOM-Based XSS - In DOM-based XSS, the client performs the injection of XSS into the page; in the other types, the server performs the injection.

Security Solution:

1. No HTML tag should be allowed as input data
• ASP.NET Razor Views are HTML Encoded by default (also ASP.NET MVC 4)
• For aggressive stripping use Microsoft AntiXSS library
• Use HTML.Encode <%: %> provided by ASP.Net MVC for output
2. All inputs should be HTML escaped
• Prevent HTML tags in inputs by default, globally. (To turn it off - ValidateInput=false / AllowHTML) (ASP.NET MVC 4)
• Use Microsoft Anti-Cross Site Scripting Library (AntiXSS) and set it as default HTML encoder.
• Use AntiXSS Sanitizer object to call GetSafeHtml or GetSafeHtmlFragment before saving HTML data to the database
3. All attributes should be put  in double quote parentheses
4. Ensure no Script tag is included in the input value
5. Specify the charset  to Content Type on HTTP response header
• Modify web.config code on IIS with following to specify charset and content-type as (name="Content-Type" value="text/html; charset='UTF-8'" )
6. Use HttpOnly attribute to the cookie
7. Use of AllowHtml Attribute in MVC
8. Encode HTML Tags - 
1. Encode the string input using HtmlEncode method. 
2. Write a Regular Expression to replace HTML tags by replacing its encode character
9. Enable ASP.NET request validation - Either ValidateRequest="true"or remove the ValidateRequest page attribute 

2). Cross site request Forgeries(CSRF):

CSRF vulnerabilities occur when:

• When attacker tricks the victim into submitting a malicious request by inheriting the identity and privileges of the victim to perform an undesired function on the victim's behalf. 

CSRF is an attack in which a user logs in to a website like ABC.com and after login user opens other site called malicious site in another tab, then this malicious site sends request to (ABC.com) valid site using existing credential or existing session for attacking the site. Valid site( ABC.com) assumes that this coming request is a valid request or coming from a valid user, so it executes that request and site is hacked by the CSRF.

A successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.

Security Solution:

1. In ASP.NET MVC:
• Client Side:
• Protect HTML form by using Html.AntiForgeryToken() inside the form. 
• @using(Html.BeginForm()) {
• @Html.AntiForgeryToken()
•  -- Rest of the form goes here.
• }
• This will render something like the following
• form action="/UserProfile/Edit" method="post" 
• input name="__RequestVerificationToken" type="hidden" value="B0aG+O+Bi/5..." 
• -- rest of form goes here --
• /form
• Using Html.AntiForgeryToken() will also give visitor a cookie whose name begins with __RequestVerificationToken.
• This cookie will contain the same random value as the corresponding hidden field. This value remains constant throughout the visitor’s browsing session and every request to server

• Server Side:

• Validate incoming form submissions by adding the [ValidateAntiForgeryToken] attribute to the target action method. Here’s an example:
• [ValidateAntiForgeryToken]
• public ActionResult Edit(string email, string hobby)
• {
• // Rest of code unchanged
• }
• This authorization filter ensure checking that the incoming request has a Request.Form entry called __RequestVerificationToken.
• And also ensure checking the request comes with a cookie of the corresponding name, and that their (I.e. Form field and Cookie) random values match.
• If not, it throws an exception (saying “a required anti-forgery token was not supplied or was invalid.”) and blocks the request.
• Else, request is pass thru and response is returned

• Note: The MVC Framework’s antiforgery system has a few other handy features:
• Antiforgery cookie’s name has a suffix that varies according to the name of your application’s virtual directory. This prevents unrelated applications from accidentally interfering with one another.
• Html.AntiForgeryToken() accepts optional path and domain parameters; these are standard HTTP cookie parameters that control which URLs are allowed to see the cookie. 
• For example, unless you specifically set a path value, the antiforgery cookie will be visible to all applications hosted on your domain (for most applications, this behavior is fine).
• __RequestVerificationToken hidden field value contains a random component (matching the one in the cookie), but that’s not all. 
• If the user is logged in, then the hidden field value will also contain their user name (obtainedfrom HttpContext.User.Identity.Name and then encrypted).
• [ValidateAntiForgeryToken] checks that this matches the logged-in user. This adds protection in the unlikely scenario where an attacker can somehow write (but not read) cookies on your domain to a victim’s browser and tries to reuse a token generated for a different user

3). Session Hijacking

In computer science, session hijacking, sometimes also known as cookie hijacking is the exploitation of a valid computer session—sometimes also called a session key—to gain unauthorized access to information or services in a computer system.

Best way to prevent session hijacking is enabling the protection from the client side. It is recommended that taking preventive measures for the session hijacking on the client side. The users should have efficient antivirus, anti-malware software, and should keep the software up to date.

4). Click Jacking:

Clickjacking is an attack that tricks a user into clicking a webpage element which is invisible or disguised as another element. This can cause users to unwittingly download malware, visit malicious web pages, provide credentials or sensitive information, transfer money, or purchase products online.

A better approach to prevent clickjacking attacks is to ask the browser to block any attempt to load your website within an iframe. You can do it by sending the X-Frame-Options HTTP header.

//👇 new code

app.use(function(req, res, next) {

  res.setHeader('X-Frame-Options', 'sameorigin');

  next();

});

You configured an Express middleware that adds the X-Frame-Options HTTP header to each response for the browser. The value associated with this response header is sameorigin, which tells the browser that only pages of the same website are allowed to include that page within an iframe.

Hope this helps.

Regards,

Arun Manglick

EF Version List

The first two versions of Entity Framework shipped with the .NET Framework and had versions numbers that aligned with the version of the framework that they were included in (3.5 and 4).

After this EF started shipping independently and adopted the http://semver.org standard for semantic versioning.

 

Here is a summary of the Entity Framework releases and the features they added. This table includes all the fully supported releases of Entity Framework and the latest pre-release version.

 

 

Product name	Release date	Supported .NET Versions	VS Version	Details
EF (or EF 3.5)		3.5	2008 SP1	Basic O/RM support using the Database First workflow.
EF 4.0		4.0	2010	New features in this release included: • POCO Support, • Lazy loading, • Testability improvements, • Customizable code generation and the • Model first workflow
EF 4.1		4.0	2010	• Published on NuGet. • Simplified DbContext API and the • Code First Workflow.
EF 4.3		4.0	2010	• New Code First Migrations feature: Allowing a database created by Code First to be incrementally changed as your Code First model evolves.
EF 5		4.0, 4.5	2010, 2012	Ttargeting .NET 4.5 Features: -------------------------------------- • Enum support, • Table-Valued Functions, • Spatial Data Types and • Various Performance Improvements. • Entity Framework Designer in Visual Studio 2012 also introduces    o Support for multiple-diagrams per model,    o Coloring of shapes on the design surface and    o Batch import of stored procedures.
EF 6		4.0, 4.5	2010, 2012, 2013	Tooling To add support for the EF6 runtime and to enable shipping out-of-band between releases of Visual Studio. The tooling itself does not include any new features, but most of the new runtime features can be used with models created in the EF Designer.   Runtime The following features work for models created with Code First or the EF Designer:   • Async Query and Save • Connection Resiliency • Code-Based Configuration. • Dependency Resolution. • Interception/SQL logging. • Testability improvements. • DbContext can now be created with a DbConnection that is already opened. • Improved Transaction Support. • Enums, Spatial and Better Performance on .NET 4.0 -. • Improved performance of Enumerable.Contains in LINQ queries. • Improved warm up time (view generation) • Pluggable Pluralization & Singularization Service. • Custom implementations of Equals or GetHashCode. • DbSet.AddRange/RemoveRange • DbChangeTracker.HasChanges. • SqlCeFunctions.   Code First only: • Custom Code First Conventions. • Code First Mapping to Insert/Update/Delete Stored Procedures • Idempotent migrations scripts. • Configurable Migrations History Table. • Multiple Contexts per Database • DbModelBuilder.HasDefaultSchema • DbModelBuilder.Configurations.AddFromAssembly method • Custom Migrations Operations. • Default transaction isolation level is changed to READ_COMMITTED_SNAPSHOT . • Entity and complex types can now be nestedinside classes.

 

Reference: Link

 

Regards,

Arun Manglick

Release Management - Visual Studio 2013

By using Release Management for Visual Studio 2013, development and operations teams can enable additional capabilities in Team Foundation Server 2013 so that they can more easily and more confidently configure and automate complex deployments to a variety of target environments. You can also model release processes, track approvals and sign-offs, and display release status graphically.

 

Release Management for Visual Studio 2013 requires Visual Studio Ultimate 2013, Visual Studio Premium 2013, or Test Professional 2013.

 The deployment agents are licensed separately for each target server.

 

Requisites: http://www.visualstudio.com/en-us/downloads#d-release-management

 

To enable the release management capabilities, install the Release Management Server for Team Foundation Server 2013.

To model release processes and enable graphical views of release status, install Release Management Client for Visual Studio 2013.

On every target machine to which you want to publish deployments, you must install Microsoft Deployment Agent 2013.

 

Please visit following link to view this new features of Visual Studio/TFS 2013 for managing releases (Covering - Release Management, Release Workflow Management, Release to various environments with approvals and release steps / sequence management).

 

http://www.visualstudio.com/get-started/manage-your-release-vs

 

 

Thanks & Regards,

Arun Manglick,

(PMP, PMI-ACP, CSM, MS-Project, CSSGB, ITIL V3, MCPD, MCTS, MTECH)

 

Release Automaion - VS 2013

Please visit following link to view new features of Visual Studio/TFS 2013 for managing releases (Covering - Release Management, Release Workflow Management, Release to various environments with approvals and release steps / sequence management).

 

http://www.visualstudio.com/get-started/manage-your-release-vs

 

 

Thanks & Regards,

Arun Manglick,

(PMP, PMI-ACP, CSM, MS-Project, CSSGB, ITIL V3, MCPD, MCTS)

 

VStudio, Framework & C# Version Mapper

Product name	Release date	Codename	Internal Version	Supported .NET Framework Versions	C# Version	ASP.NET Version
Visual Studio	1-Apr-95	N/A	4	N/A	NA	NA
Visual Studio 97	1-Feb-97	Boston	5	N/A	NA	NA
Visual Studio 6.0	1-Jun-98	Aspen	6	N/A	NA	NA
Visual Studio .NET (2002)	13-Feb-02	Rainier	7	1	1.0	1.0
Visual Studio .NET 2003	24-Apr-03	Everett	7.1	1.1	1.0	1.1
Visual Studio 2005	7-Nov-05	Whidbey	8	2.0, 3.0	2.0	2.0
Visual Studio 2008	19-Nov-07	Orcas	9	2.0, 3.0, 3.5	3.0	3.0, 3.5
Visual Studio 2010	12-Apr-10	Dev10/Rosario	10	2.0, 3.0, 3.5, 4.0	4.0	4.0
Visual Studio 2012	12-Sep-12	Dev11	11	2.0, 3.0, 3.5, 4.0, 4.5	5.0	4.5
Visual Studio 2013	17-Oct-13	Dev12	12	2.0, 3.0, 3.5, 4.0, 4.5, 4.5.1	5.0	4.5.1
C# Version
NA
NA
NA
1.0	Managed Code
1.0
2.0	§ Partial Classes § Static Classes § Generic Classes § Anonymous methods § Iterators § Nullable Types
3.0	§ Automatic Properties § Object Initializers § Collection Initializers § Extension Methods § Lambda Expressions -  p => expressions § Query Syntax § Anonymous Types § Var Keyword
4.0	• Named and Optional Arguments • Dynamic Binding • CoVariance & ContraVariance • COM specific interop features • Indexed Properties
5.0	1. Async Feature 2. Caller Information

 

 

Thanks & Regards,

Arun Manglick,

Project Manager - Forecasting
Mobile: 9158041782| 9850901262| Desk Phone: +912040265348 | http://www.synechron.com

SYNECHRON -
- 4,000+ professionals globally.
- USA | Canada | UK | The Netherlands | UAE | India | Singapore | Hong Kong | Japan