Azure Application Gateway

Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications

This is very good overview of application gateway

for more details view this video:

Create Nuget Package

In this Post I will show how to create Nuget package:

In this video you can see :

In this video you can see:




Nuget Package explorer is used for publish to feed:
https://github.com/NuGetPackageExplorer/NuGetPackageExplorer

Then you can use this Nuget in your Solution:

https://blogs.naxam.net/configure-nuget-package-sources-for-your-project-cd8b96397360

How to prepare for the Exam AZ-900: Microsoft Azure Fundamentals

Learning 

https://marczak.io/

https://www.youtube.com/c/TimothyWarner1/videos

Practice 

https://www.udemy.com/course/az-900-practice-tests/learn/ https://www.examtopics.com/exams/microsoft/az-900

https://www.exam-answer.com/microsoft/az-900

90% of questions are from udemy course. 

examtopics is free for first 100 questions. i you want to have all questions for free you can check here:

https://pupuweb.com/microsoft-azure-fundamentals-az900-actual-exam-question-answer-dumps/

Forward emails without SMTP provider for free

 usually, when you buy a domain you need to buy anothr smtp provider to send email. gmail business has a packet for 5$ per user. 

If you want to use free email forwarding tool i suggest https://improvmx.com/ 

just set your mx record 

HOST VALUE PRIORITY @ mx1.improvmx.com 10 @ mx2.improvmx.com 20

Security awareness

Training github workshop
https://github.com/sapran/appsec_awareness_training


Enter your email and tells you if your email is being leacked
https://haveibeenpwned.com/


Owas top 10 volnerability
https://www.owasp.org/index.php/Top_10-2017_Top_10


Reward to hackers to found bugs
https://www.bugcrowd.com/bug-bounty-list/

web-dvwa is a docker sample in php which shows volnerabilities
the sample used is
https://hub.docker.com/r/vulnerables/web-dvwa/
docker pull vulnerables/web-dvwa
docker run --rm -it -p 1080:80 vulnerables/web-dvwa

Gives you xss code that you can use in xss
https://xsshunter.com/app

SQL INJECTION
http://sqlmap.org/


List of Payload for different payloads
https://github.com/danielmiessler/SecLists


Cheat sheet
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet


OWASP Zed Attack Proxy (ZAP)
https://www.zaproxy.org/


Sonarqube
https://www.sonarqube.org/
https://hub.docker.com/_/sonarqube/
continuous inspection of code quality to perform automatic reviews with static analysis of code to detect bugs, code smells, and security vulnerabilities


MS Threat Modeling Tool
https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling
can be used to draw your software diagram and shows you the threats

List on known Groups per country
https://attack.mitre.org/


Security Check for http headers
https://securityheaders.com/


Test SSL server certificate
https://www.ssllabs.com/ssltest/


DAST, or Dynamic Application Security Testing
SAST, or Static Application Security Testing
IAST or Interactive Application Security Testing


Burp Suite is a graphical tool for testing Web application security
https://portswigger.net/burp

more functionality than fiddler, to start proxy should set to localhost 8080
Go here and download and install certificate http://localhost:8080/
intercept is to record traffic

https://attack.mitre.org/
List of organization and attacks

check your security headers

https://securityheaders.com/

Mobile-Cloud-Workshop Learn Azure and Mobile

- Hands on Labs on build real Mobile Application and Backend services based on Azure. We will follow the diagram below in the deployment:

- App Services
- Functions & Logic Apps
- Application Insights – to monitor application that are in production
- Containers – simplify application deployments
- API Management
- SQL Databases
- Mobile DevOps & Xamarin

Also, here (https://github.com/MikeCodesDotNet/Mobile-Cloud-Workshop/tree/master/Walkthrough%20Guide/00_Setup) you will find the prerequisites for the workshop.

C# Configuring Swagger in WebAPI

https://docs.microsoft.com/en-us/aspnet/core/tutorials/getting-started-with-swashbuckle?view=aspnetcore-2.2&tabs=visual-studio

https://github.com/RicoSuter/NSwag/wiki/NSwagStudio
https://docs.microsoft.com/en-us/aspnet/core/tutorials/getting-started-with-nswag?view=aspnetcore-2.2&tabs=visual-studio

IFrame embeding browser permissions

by default asp.net is setting x-frame-options: SAMEORIGIN which doesnt allow anywebsite to embed your IFRAME to disable that you need to

  System.Web.Helpers.AntiForgeryConfig.SuppressXFrameOptionsHeader = true;

But the make sure to have this value to same origin in web.config

<add name="X-Frame-Options" value="SAMEORIGIN" />

The X-Frame-Options header may contain one of three tokens:

DENY

SAMEORIGIN

ALLOW-FROM origin 

read more: https://bit.ly/2pGxI1n

you can allow a website by

X-Frame-Options: ALLOW-FROM https://yourwebsite.com

but new browser are also taking look at this value on header: 

Content-Security-Policy: frame-ancestors 'self' https://yourwebsite.com

more about it

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

https://www.keycdn.com/blog/http-security-headers/

https://content-security-policy.com/

IIS Application initialization

As of IIS 8 Application Initialization is part of the IIS feature set. For IIS 7 and 7.5 there's a separate download available via Web Platform Installer. Using IIS 8 Application Initialization is an optional install component in Windows or the Windows Server Role Manager:


This is an optional component so make sure you explicitly select it.

IIS Configuration for Application Initialization
Initialization needs to be applied on the Application Pool as well as the IIS Application level. As of IIS 8 these settings can be made through the IIS Administration console.

Start with the Application Pool:


Here you need to set both the Start Automatically which is always set, and the StartMode which should be set to AlwaysRunning. Both have to be set - the Start Automatically flag is set true by default and controls the starting of the application pool itself while Always Running flag is required in order to launch the application. Without the latter flag set the site settings have no effect.

Now on the Site/Application level you can specify whether the site should pre load:


At this point ASP.NET apps should auto-load. This is all that's needed to pre-load the site if all you want is to get your site launched automatically.

If you want a little more control over the load process you can add a few more settings to your web.config file that allow you to show a static page while the App is starting up. This can be useful if startup is really slow, so rather than displaying blank screen while the user is fiddling their thumbs you can display a static HTML page instead:






This allows you to specify a page to execute in a dry run. IIS basically fakes request and pushes it directly into the IIS pipeline without hitting the network. You specify a page and IIS will fake a request to that page in this case ping.ashx which just returns a simple OK string - ie. a fast pipeline request. This request is run immediately after Application Pool restart, and while this request is running and your app is warming up, IIS can display an alternate static page - Startup.htm above. So instead of showing users an empty loading page when clicking a link on your site you can optionally show some sort of static status page that says, "we'll be right back". I'm not sure if that's such a brilliant idea since this can be pretty disruptive in some cases. Personally I think I prefer letting people wait, but at least get the response they were supposed to get back rather than a random page. But it's there if you need it.

Note that the web.config stuff is optional. If you don't provide it IIS hits the default site link (/) and even if there's no matching request at the end of that request it'll still fire the request through the IIS pipeline. Ideally though you want to make sure that an ASP.NET endpoint is hit either with your default page, or by specify the initializationPage to ensure ASP.NET actually gets hit since it's possible for IIS fire unmanaged requests only for static pages (depending how your pipeline is configured).


https://weblogs.asp.net/scottgu/auto-start-asp-net-applications-vs-2010-and-net-4-0-series

Xamarin Push notification using FireBase

First download the sample here:
https://developer.xamarin.com/samples/monodroid/Firebase/FCMNotifications/

Then you have to create a project in Firebase
http://firebase.google.com

download google-services.json
right click on the google-service.json and set the Build Action vlaue to GoogleServicesJson



when your app is running the device get the token.

To send notification to device you need serverkey which you get from firebase server and token which you get from device in running mode

To send by postmann



you can write small c# code to post to sever by webclient:

using (var client = new WebClient())
     {
        var values = "{\"to\" : \"toekn",\"notification\" : {\"body\" : \"test\",\"title\" : \"title\",\"icon\" : \"myicon\"}}";
         client.Headers.Set("Content-Type", "application/json");
          client.Headers.Set("Authorization", "key=serverkey");
         var response = client.UploadString("https://fcm.googleapis.com/fcm/send", values);
         }

Using Microsoft Azure

using System;
using Microsoft.Azure.NotificationHubs;

namespace SendToNotificationHub
{
    class Program
    {
        public static string connectionString = "Endpoint=sb://app.servicebus.windows.net/;SharedAccessKeyName=DefaultFullSharedAccessSignature;SharedAccessKey=yourkey";
        public static string NotificationHubPath = "your-hub";

        static void Main(string[] args)
        {
            SendNotificationAsync();
            Console.ReadLine();
        }


        private static async void SendNotificationAsync()
        {
            NotificationHubClient hub = NotificationHubClient.CreateClientFromConnectionString
            (connectionString, NotificationHubPath);
            var alert = "{\"aps\":{\"alert\":\"Hi!\"}}";
            await hub.SendAppleNativeNotificationAsync(alert);
        }
    }
}

Hosting net.tcp wcf on IIS Express and IIS

to host on IIS

on project properties

IIS express

Project files have the information related to the IIS Express and it’s basic settings; whereas there are several configuration files that are required to host and run a web application.  You can find all the IIS Express related files under \users\\My Documents \ IISExpress\Config .

Open the “applicationhost.config” file in any text editor, and search for your web application name. You will find a section similar to the image shown in below.

http://dailydotnettips.com/2014/01/29/5-internal-things-that-you-should-know-about-iis-express/

get Domain SID in windows server

TO get sid of a user, wun following command:

wmic useraccount where name="USER" get sid
wmic useraccount get name,sid

in C# can check user UserSid:

var me = WindowsIdentity.GetCurrent();
SecurityIdentifier sid = me.User;

To get Group Policy of a user in domain use

gpresult /r

More info about gpresult

block url in windows 10

in firewall you can create outbound role by ip but not by url
to be able to block url in windows

‪C:\Windows\System32\drivers\etc\hosts

add to the file
0.0.0.0 www.facebook.com

#Hint: make sure there is not space

Xamarin Publish to Google play

After installing Android SDK you need to enable Accelerator for having Fast emulator

To publish Xamarin Project on Google play:

https://developer.xamarin.com/guides/android/deployment,_testing,_and_metrics/publishing_an_application/

You dont need to do all above steps mentioned in xamarin website. (e.g create a google play account and upload it via browser)

Choose release instead of Release ( Goole play doesnt allow Debugging)

RightClick on Publish and then click on Archive.

After Archiving click on Distribute there you have to define a signing identity (Adhoc) then you can click on Save As and export the project.

Then you have to zipalign the apk file:

Update 2023: No need to sign it manually using Zipalign. just use abb format and after Disturbution can be uploaded to the play directly:

go to android skd folder

C:\Users\"username"\AppData\Local\Xamarin\MonoForAndroid\AndroidSDK

and jumped into “android-sdk\build-tools\” and for ease, pasted my .APK here.

open a terminal and navigated to the build tools folder, and typed in the followng command

1	zipalign.exe -f -v 4 mono.samples.helloworld-Signed.apk helloworld.apk

Transfer Autorisation devices

There are different companies provide one time password authorization:

RSA is one of leading companies in different authenticators like RSA SecureID hardware tokes and tokenles authentication

Kobil is a german company that offer transaction authorisation with mobile app and also provide ChipTAN/CardTAN authorisation

REINERSCT is also selling CardTAN generators

VASCO is a belgian company which provide differnt type of authorization. they provided servers to manage tan list management. some products like DIGIPASS

Changing workspace in visualstudio after renaming computer name

run in the Developer Command Prompt for Visual Studio
to get workspaces on your computer and getting collection name 

tf workspaces

result will be like 

Workspace     Owner      Computer Comment
------------- ---------- -------- ---------------
DEV2           Your Name COMPUTERNAME

DEV2           Your Name COMPUTERNAME

after that run following command:

tf workspaces /updateComputerName:MyOldComputerName 
/s:"http://MyServer:8080/tfs/MyCollection"

https://www.visualstudio.com/docs/tfvc/workspaces-command

How to install .NET 3.5 on windows 10 - Windows Update error 0x800F081F

If you receive Windows Update error 0x800F081F or 0x800F081F it means that a file needed by Windows Update is damaged or missing. Windows has troubleshooting tools that can help you address this problem.

Run the DISM tool

1. Insert your Windows 10 DVD, or double click its ISO image, or insert your bootable flash drive with Windows 10, depending on what you have. you can click on ISO image and choose amount

2. Open 'This PC' in File Explorer and note the drive letter of the installation media you have inserted. In my case it is disk I:
3. Open CMD with administrative privileges and type the following command:
Dism /online /enable-feature /featurename:NetFx3 /All /Source:X:\sources\sxs /LimitAccess

Replace X with your drive letter for Windows 10 installation media.

https://winaero.com/blog/offline-install-of-net-framework-3-5-in-windows-10-using-dism/

Microsoft linke

the fie i have on my onedrive

What is project management ?

Project management is the application of knowledge, skills, tools, and techniques to project activities to meet the project requirement. project management is accomplished through the application the appropriate application and integration of the 42 logically grouped project management processes comprising the 5 process Groups. these 5 process Groups are:

• Initiating
• Planning
• Executing
• Monitoring and Controlling and
• Closing

Managing a project typically include:

Identifying the various needs, concerns, and expectations of the stakeholder as the project is planned and carrier out.

Balancing the competing project constraints including, but not limited to:

• Scope
• Quality
• Schedule
• Budget
• Resources and
• Risk

SQL script to Shrink all databases

DECLARE @DBName varchar(255)
DECLARE @LogName varchar(255)
DECLARE @DATABASES_Fetch int
DECLARE DATABASES_CURSOR CURSOR FOR
    select distinct
        name, db_name(s_mf.database_id) dbName
    from
        sys.master_files s_mf
    where
        s_mf.state = 0 and -- ONLINE
        has_dbaccess(db_name(s_mf.database_id)) = 1 -- Only look at databases to which we have access
    and db_name(s_mf.database_id) not in ('Master','tempdb','model')
    and db_name(s_mf.database_id) not like 'MSDB%'
    and db_name(s_mf.database_id) not like 'Report%'
    and type=1
    order by 
        db_name(s_mf.database_id)
OPEN DATABASES_CURSOR
FETCH NEXT FROM DATABASES_CURSOR INTO @LogName, @DBName
WHILE @@FETCH_STATUS = 0
BEGIN
 exec ('USE [' + @DBName + '] ; DBCC SHRINKFILE (N''' + @LogName + ''' , 0, TRUNCATEONLY)')
 FETCH NEXT FROM DATABASES_CURSOR INTO @LogName, @DBName
END
CLOSE DATABASES_CURSOR
DEALLOCATE DATABASES_CURSOR

mysql database restore backup

backup: # mysqldump -u root -p[root_password] [database_name] > dumpfilename.sql

restore:# mysql -u root -p[root_password] [database_name] < dumpfilename.sql backup: C:\Parallels\Plesk\Databases\MySQL\bin>mysqldump.exe -u admin_user -pPASS
S admin_database > c:\file.sql

restore:
mysql -u user -p database < file.sql

MYSQL Query cache
http://www.databasejournal.com/features/mysql/article.php/3110171/MySQLs-Query-Cache.htm
http://www.cyberciti.biz/tips/enable-the-query-cache-in-mysql-to-improve-performance.html