jQuery Auto-Complete Text Box with ASP.NET MVC

These days it is not uncommon to have text boxes automatically suggest items based on what we type. The results are further filtered as we type to give us the option to simply select an available item with the mouse or keyboard. One of the first examples of this in the wild was Google Suggest.

Figure 13.1 Google Suggest filters options as you type

A rudimentary implementation of this would simply monitor key-presses and fire off ajax requests for each one. Of course this means that fast typist would trigger many requests, most of which would be immediately discarded for the next request coming in 5 milliseconds. A good implementation will take into account a typing delay and also provide keyboard/mouse support for selecting the items.

Luckily jQuery has an extensive list of plugins available.

The basic idea is you have a simple text box on your page. The jQuery plugin adds the necessary behavior to handle key press events and fire the appropriate Ajax requests off to a URL that will handle the request. The URL needs point to a controller action, and by convention the response is formatted in a special way so the plugin could handle the response.

Assume for our purposes that we wanted to filter US Cities in the text box. The first step is to add a controller, action, and view for displaying the UI for this example. Ensure that jquery (in this case jquery-1.2.6.js) and jquery.autcomplete.js are referenced at the top of the view (or master page).

Next, add the text box. In this example we will call it city.

<%= Html.TextBox("city") %>

Package this up with a simple controller (Listing 13.1).

Listing 13.1 – a controller & action for displaying our test page

public class HomeController : Controller { public ActionResult Index() { return View(); } } 

Figure 13.2 – Our simple view with a text box.

Now we add a little Javascript to add the autocomplete behavior.

Place this in the of the page. You can see that the URL for the autocomplete behavior is specified as Url.Action(“Find”, “City”). This will point to a Find() action on the CityController. We’ll need to write this controller & action next.

Local Data Mode

The autocomplete plugin can also filter local data structures. This is useful when you have a limited set of data and you want to minimize requests sent to the server. The autcomplete plugin in local mode is also much faster, since there is no Ajax request happening behind the scenes. The only downside is that you must render the entire array onto the view.

Listing 13.3 – An action to find cities from an autocomplete ajax request

public class CityController : Controller { private readonly ICityRepository _repository; public CityController() { //load up a CSV file with the city data string csvPath = Server.MapPath("~/App_Data/cities.csv"); //the repository reads the csv file _repository = new CityRepository(csvPath); #2 } //this constructor allows our tests to pass in a fake/mock instance public CityController(ICityRepository repository) #3 { _repository = repository; } //the autocomplete request sends a parameter 'q' that contains the filter public ActionResult Find(string q) #4 { string[] cities = _repository.FindCities(q); //return raw text, one result on each line return Content(string.Join("\n", cities)); } } 

The details of the CityRepository can be found in the code samples provided with the book. For now, we will focus on the new Find(string q) action. Since this is a standard action, you can actually just navigate to it in your browser and test it out. Figure 13.3 shows a quick test.

Listing 13.3 – A simple HTTP GET for the action with a filter of “hou” yields the expected results.

Now that we are sure that the action is returning the correct results, we can test the textbox. The Javascript we added earlier hooks up to the keypress events on the textbox and should issue queries to the server. Figure 13.4 shows this in action.

Figure 13.4 – The results are display in a

tag. We can apply CSS to make it look nicer.

The drop down selections are unformatted by default, which makes them a little ugly. A little CSS magic will make it look much nicer. Listing 13.4 shows some sample CSS for this.

Listing 13.4 – CSS used to style the autocomplete results

<style type="text/css"> div.ac_results ul { margin:0; padding:0; list-style-type:none; border: solid 1px #ccc; } div.ac_results ul li { font-family: Arial, Verdana, Sans-Serif; font-size: 12px; margin: 1px; padding: 3px; cursor: pointer; } div.ac_results ul li.ac_over { background-color: #acf; } style> 



Figure 13.5 – The styled dropdown results look much nicer. The selected item is highlighted, and can be chosen with the keyboard or the mouse.

The auto-complete plug-in has many options for you to configure to your needs. For the simple case that we’ve shown here, it’s as simple as this:

$(your_textbox).autocomplete('your/url/here'); 

Other options for the plugin are listed below:

inputClass	This class will be added to the input box.
resultsClass	default value: “ac_results”
loadingClass	The class to apply to the input box while results are being fetched from the server. Default is “ac_loading.”
lineSeparator	Default is \n
minChars	The minimum # of characters before sending a request to the server. Default is 1.
delay	The delay after typing when the request will be sent. Default is 400ms.

There are many more options, but these are some common ones. To set these options, you include them in a dictionary as the second argument to the autocomplete method like this:

$("input#city").autocomplete('<%= Url.Action("Find", "City") %>', { minChars : 3, delay : 300 }); 

This type of functionality is immensely useful for selecting from large lists. It keeps your initial page size down by not loading all of these items at once and is very user-friendly.

SQL Injection tutorial to Hack websites Hacking websites

we try to discussed about SQL Injections method of hacking websites here. Some of my website users reported that those articles are little bit difficult to understand for new users who wish to learn hacking. For the sake of new users who wish to learn website hacking and SQL injection, i am writing this article at such a basic level that the user who didn't even have any prior knowledge of SQL can start SQL Injecting websites. This article is also beneficial for hackers too as it will refresh their concepts that what really we have to do and look into website URL if we want to hack website or its database using SQL injection. So Guys read on very basic SQL injection tutorial...
hacking websites, sql injection attack
SQL injection tutorial to hack websites | Hacking website databse


What is SQL Injection?
Basically SQL Injections or simply called Structured Query Language Injection is a technique that exploits the loop hole in the database layer of the application. This happens when user mistakenly or purposely(hackers) enters the special escape characters into the username password authentication form or in URL of the website. Its basically the coding standard loop hole. Most website owners doesn't have proper knowledge of secure coding standards and that results into the vulnerable websites. For better understanding, suppose you opened a website and went to his Sign in or log in page. Now in username field you have entered something say Adnan and in the password box you pass some escape characters like ',",1=1, etc... Now if the website owner hasn't handled null character strings or escape characters then user will surely get something else that owner never want their users to view.. This is basically called Blind SQL.

Requirements for SQL Injection:
1. You need a web browser to open URL and viewing source codes.
2. Need a good editor like Notepad ++ to view the source codes in colored format so that you can easily distinguish between the things.
3. And very basic knowledge of some SQL queries like SELECT, INSERT, UPDATE, DELETE etc..

What you should look into website to detect is it vulnerable to SQL injection attack or not?
First of all you can hack those websites using SQL injection hacks that allows some input fields from which can provide input to website like log in page, search page, feedback page etc. Nowadays, HTML pages use POST command to send parameters to another ASP/ASPX page. Therefore, you may not see the parameters in the URL. However, you can check the source code of the HTML, and look for "FORM" tag in the HTML code. You may find something like this in some HTML codes:

< F O R M action=login. aspx method=post>
< i n p u t type=hidden name=user v a l u e=xyz>
< / F O R M>
Everything between the < f o r m > and < / f o r m > parameters (remove spaces in words) contains the crucial information and can help us to determine things in more detailed way.


There is alternate method for finding vulnerable website, the websites which have extension ASP, ASPX, JSP, CGI or PHP try to look for the URL's in which parameters are passed. Example is shown below:

http://example.com/login.asp?id=10


Now how to detect that this URL is vulnerable or not:
Start with single quote trick, take sample parameter as hi'or1=1--. Now in the above URL id is the parameter and 10 is its value. So when we pass hi'or1=1-- as parameter the URL will look like this:

http://example.com/login.asp?id=hi' or 1=1--


You can also do this with hidden field, for that you need to save the webpage and had to made changes to URL and parameters field and modify it accordingly. For example:

< F O R M action=http://example.com/login. asp method=p o s t >
< i n p u t type=hidden name=abc value="hi' or 1=1--">
< / F O R M >


If your luck is favoring you, you will get the login into the website without any username or password.


But why ' or 1=1-- ?
Take an asp page that will link you to another page with the following URL:

http://example.com/search.asp?category=sports

In this URL 'category' is the variable name and 'sports' is it's value.

Here this request fires following query on the database in background.

SELECT * FROM TABLE-NAME WHERE category='sports'

Where 'TABLE-NAME' is the name of table which is already present in some database.
So, this query returns all the possible entries from table 'search' which comes under the category 'sports'.

Now, assume that we change the URL into something like this:

http://example.com/search.asp?category=sports' or 1=1--


Now, our variable 'category' equals to "sports' or 1=1-- ", which fires SQL query on database something like:
SELECT * FROM search WHERE category='sports' or 1=1--'

The query should now select everything from the 'search' table regardless if category is equal to 'sports' or not.
A double dash "--" tell MS SQL server to ignore the rest of the query, which will get rid of the last hanging single quote (').
Sometimes, it may be possible to replace double dash with single hash "#".

However, if it is not an SQL server, or you simply cannot ignore the rest of the query, you also may try

' or 'a'='a

It should return the same result.
Depending on the actual SQL query, you may have to try some of these possibilities:

' or 1=1--
" or 1=1--
or 1=1--
' or 'a'='a
" or "a"="a
') or ('a'='a
'or''='

How to protect you own websites from SQL injection?

Filter out character like ' " - / \ ; NULL, etc. in all strings from:
* Input from users
* Parameters from URL
* Values from cookie
That's all for today,

Google Maps Control for ASP.NET

Introduction

Most of us are familiar with the Google maps. Google has provided a very reach API to use in our own applications. But, we need some sort of JavaScript knowledge in order to use it. I don't know about others, but for me, it was a little difficult to use JavaScript along with the Google APIs in ASP.NET pages, specifically when using server-side functions to draw Google maps dynamically. For example, in my case, I wanted to pull latitude/longitude information from a SQL Server database and then use that to insert pushpins on a Google map. If you are familiar with the AJAX framework, you know the answer. You will have to call ASP.NET server-side functions from JavaScript and use the retrieved data to draw a Google map. How simple is that? :). Not at all; at least, not for me. So, I have decided to write a user control which can take care of the JavaScript part and allow me to concentrate on the server-side functions.

Features

• Enables you to draw Google maps. No JavaScript knowledge required. Just drag and drop a control on your page.
• Uses AJAX calls to retrieve server-side data.
• Enables you to change pushpin positions on the fly. No need to refresh the full map.
• Enables you to change pushpin icons on the fly.
• Optimized to give you the best performance, i.e., only those pushpin data will be retrieved from the server that have changed.

How to use

In this part of the article, I don't want to explain how I created this control. Instead, I want you to start using it.

Requirements

• Visual Studio 2005 or higher
• Microsoft ASP.NET AJAX framework. You can download it from here.
• Internet Explorer 7.0 or Mozilla Firefox 2.x. (Note: It may work on other browsers. I have tested on IE and Firefox only.)

Follow these steps in order to use it in your ASP.NET website:

• Download the source from link provided on the top of this page. Extract it somewhere on your hard-drive.
• Open the extracted folder as a website in Visual Studio, and run it. When you run this website, you will be able to navigate to a few sample pages.
• To use this control in your application, copy the following files to your ASP.NET application in the same structure as shown below:

Now, we will add a reference to the AJAX library. If you are already using AJAX controls in your application, you can skip the following four steps.

Adding the AJAX Framework to your website

• Right click on your website in Solution Explorer, and click Add Reference.



• In the Add Reference window, select the System.Web and System.Web.Extensions libraries, and click OK. Note the library versions (in the picture, it is 1.0.61025.0; you may have another version, you can use any version).



• Go to your web.config file, and add the following lines between the <System.Web></System.Web> elements.
Collapse

    <httpHandlers>       <remove path="*.asmx" verb="*"/>              <add path="*.asmx" verb="*"        type="System.Web.Script.Services.ScriptHandlerFactory,        System.Web.Extensions,  Version=1.0.61025.0,        Culture=neutral,        PublicKeyToken=31BF3856AD364E35"        validate="false"/>               <add path="*_AppService.axd" verb="*"        type="System.Web.Script.Services.ScriptHandlerFactory,        System.Web.Extensions, Version=1.0.61025.0,        Culture=neutral,        PublicKeyToken=31BF3856AD364E35"        validate="false"/>              <add path="ScriptResource.axd" verb="GET,HEAD"        type="System.Web.Handlers.ScriptResourceHandler,        System.Web.Extensions, Version=1.0.61025.0,        Culture=neutral,        PublicKeyToken=31BF3856AD364E35"        validate="false"/>            </httpHandlers>          <httpModules>       <add name="ScriptModule"        type="System.Web.Handlers.ScriptModule,        System.Web.Extensions,        Version=1.0.61025.0, Culture=neutral,        PublicKeyToken=31BF3856AD364E35"/>     </httpModules>

Note : Make sure that the version of the System.Web.Extension library is the same as what you have selected when you added the reference.

Adding the Google Maps control to your webpage

• Open the page where you want to insert a Google map.
• Drag the GoogleMapForASPNet.ascx control to your page.



You won't be able to see the Google Maps control in Design view. Instead, you should see a Script Manager as part of this control.

• At this point, you can run your application, and you should be able to see a blank Google Maps control on your page, as shown below:



Let's add few pushpins on this map. For that, you will have to add some code in the Page_Load() event of your page.

Passing parameters to the Google Maps control

• You must specify the Google Maps API Key for this component. You can obtain this key from Google.
Collapse

if (!IsPostBack) {  GoogleMapForASPNet1.GoogleMapObject.APIKey = "GoogleMapKey>";

Note that the initialization code for the map should go inside the if (!IsPostBack) block.

• Optionally, you can specify which version of the Google Maps API to use. You can get more information about the Google Maps API version here.
Collapse

GoogleMapForASPNet1.GoogleMapObject.APIVersion = "2";

• Specify the width and height for the map. You can specify either in pixels, or in percentage relative to its container.
Collapse

 GoogleMapForASPNet1.GoogleMapObject.Width = "800px";  GoogleMapForASPNet1.GoogleMapObject.Height = "600px";

• Specify the zoom level. The default is 3.
Collapse

 GoogleMapForASPNet1.GoogleMapObject.ZoomLevel = 14;

• Specify the Center Point for the map. The map will be centered on this point.
Collapse

  GoogleMapForASPNet1.GoogleMapObject.CenterPoint      = new GooglePoint("CenterPoint", 43.66619, -79.44268);

• Add pushpins for the map. This can be done by initializing the GooglePoint type object. In the constructor of GooglePoint, the first argument is the ID of this pushpin. It must be unique for each pin. The second and third arguments are the latitude and longitude.
Collapse

  GoogleMapForASPNet1.GoogleMapObject.Points.Add(         new GooglePoint("1", 43.65669, -79.45278));

Alternatively, you can also do it like this:

Collapse

GooglePoint GP = new GooglePoint(); GP.ID = "1"; GP.Latitude = 43.65669; GP.Longitude = -79.43270; GoogleMapForASPNet1.GoogleMapObject.Points.Add(GP);

You can add as many pushpins as you wish. Now, run the website again, and you should see pushpins on the map.

Assigning custom icons to pushpins

• You can assign your own icons with the Google Maps control. For that, first, copy your icons in some directory under the root directory of your website. You can assign an icon to a pushpin as shown below:
Collapse

GP.IconImage = "icons/pushpin-blue.png";

Note that the path to the image is relative to the root folder. You should have an icons (or whichever) directory in the root folder of your website.

• You can add a description for a pushpin, which will pop up when the user clicks the pushpin.
Collapse

GP.InfoHTML = "This is Pushpin-1";



• You can format the InfoHTML property using standard HTML tags.

For example:

Collapse

GP.InfoHTML = "This is Pushpin-1";



Up to this point, I have explained you the basics of using the Google Maps control. Now, let's implement some advanced functionality. Let's say, we want to move pushpins when the user does some action. For example, when a user clicks on a button. For that, follow the steps below.

Creating an interactive map

You can create an interactive map using the Google Maps control. You can move pushpins when the user clicks on a button. Here is how you can do it.

• Insert a standard ASP.NET button on your web page. Write the following code in the Click event of this button:
Collapse

protected void Button1_Click(object sender, EventArgs e) {    GoogleMapForASPNet1.GoogleMapObject.Points["1"].Latitude += 0.003;    GoogleMapForASPNet1.GoogleMapObject.Points["1"].Longitude += 0.003; }

We are incrementing Latitude and Longitude values for the Pushpin 1 here. Note that I am using the ID (in the above code, "1") of the pushpin to set the new Latitude and Longitude.

• Run your application and click on the button. You will note that the whole page gets refreshed (or postback). To stop it from posting back, you need to wrap this button with an AJAX UpdatePanel. Go to the Visual Studio toolbox and drag an AJAX UpdatePanel control on your page.



• Move your button inside this UpdatePanel.



• Now, run the website again and click on the button. You should notice that the page is not posting back now and the pushpin moves on the map.

Auto refreshing the map and GPS navigation

You can use the AJAX Framework's timer control in a similar way as the button control (as I have explained above). On the Timer_Tick() event, you can specify the new latitude longitude for all the pushpins. This way, the map will move all the pushpins automatically after a specified time delay. You can hook up any GPS service with this control to create a GPS navigation system.

Creating polylines with the Google Maps control

• Create points for the polyline:
Collapse

GooglePoint GP1 = new GooglePoint(); GP1.ID = "GP1"; GP1.Latitude = 43.65669; GP1.Longitude = -79.44268; GP1.InfoHTML = "This is point 1"; GoogleMapForASPNet1.GoogleMapObject.Points.Add(GP1);  GooglePoint GP2 = new GooglePoint(); GP2.ID = "GP2"; GP2.Latitude = 43.66619; GP2.Longitude = -79.44268; GP2.InfoHTML = "This is point 2"; GoogleMapForASPNet1.GoogleMapObject.Points.Add(GP2);  GooglePoint GP3 = new GooglePoint(); GP3.ID = "GP3"; GP3.Latitude = 43.67689; GP3.Longitude = -79.43270; GP3.InfoHTML = "This is point 3"; GoogleMapForASPNet1.GoogleMapObject.Points.Add(GP3);

• Create a polyline between points GP1, GP2, and GP3:
Collapse

//Define polyline GooglePolyline PL1 = new GooglePolyline(); PL1.ID = "PL1"; //Give Hex code for line color PL1.ColorCode = "#0000FF"; //Specify width for line PL1.Width = 5;  //Add points PL1.Points.Add(GP1); PL1.Points.Add(GP2); PL1.Points.Add(GP3);

• Add a polyline to the Google Maps control:
Collapse

GoogleMapForASPNet1.GoogleMapObject.Polylines.Add(PL1);

Creating polygons with the Google Maps control

• Create points for the polygon:
Collapse

//Define Points for polygon GooglePoint GP1 = new GooglePoint(); GP1.ID = "GP1"; GP1.Latitude = 43.66675; GP1.Longitude = -79.4042;  GooglePoint GP2 = new GooglePoint(); GP2.ID = "GP2"; GP2.Latitude = 43.67072; GP2.Longitude = -79.38677; . .//Define GP3,GP4,GP5,GP6 and GP7 in similar way . GooglePoint GP7 = new GooglePoint(); GP7.ID = "GP7"; GP7.Latitude = 43.66656; GP7.Longitude = -79.40445;

• Create the polygon using the above points:
Collapse

//Create Polygon using above points GooglePolygon PG1 = new GooglePolygon(); PG1.ID = "PG1"; //Give Hex code for line color PG1.FillColor = "#0000FF"; PG1.FillOpacity = 0.4; //Stroke is outer border of polygon. PG1.StrokeColor = "#0000FF"; PG1.StrokeOpacity = 1; PG1.StrokeWeight = 2; //Add points to polygon PG1.Points.Add(GP1); PG1.Points.Add(GP2); PG1.Points.Add(GP3); PG1.Points.Add(GP4); PG1.Points.Add(GP5); PG1.Points.Add(GP6); PG1.Points.Add(GP7);

• Add the polygon to the Google Maps control:
Collapse

GoogleMapForASPNet1.GoogleMapObject.Polygons.Add(PG1);

I have explained all sorts of circumstances in which you may want to use the Google Maps control. If you have any questions, feel free to ask.

Working with SSL at Development Time is easier with IISExpress?

how IIS Express and Visual Studio SP1 (as well as WebMatrix) can make working with SSL (Secure Sockets Layer) a heck of a lot easier?

If you've used Cassini before (that's the little built in Visual Web Developer Server) you've likely noticed that I doesn't support SSL. This makes working with real world sites a little challenging. If you want your Login pages and Account Management pages to use secure sockets, you'd typically have to do all your work with the full version of IIS, either installed on your own machine or using a shared server.

Here's a few ways to enable SSL. The first is new in Visual Studio 2010 SP1 and will allow you to use SSL on local host over ports 44300 and higher. This means you'll be able to test and develop how your site will work over SSL, but not over port 443 proper. I'll show you that in the final step.

If you watch the Mix video, you'll see towards the end where Damian Edwards educates me on this new SSL feature in VS2010SP1. I didn't know that VS2010SP1 (WebMatrix does also) installs some self-signed certificates and includes and option for turning on their use. However, as I pointed out in the video, that's only for high "strange" ports like 44300+, so my more complex example still has value if you want standard port numbers.

The Easy Way - Local SSL with IIS Express and VS2010 or WebMatrix

If you have IIS Express and VS2010SP1, you can do this now and follow along. Make a new ASP.NET Site in Visual Studio.

Right click on the Project in Solution and select Use IIS Express. You can also set IIS Express as the default from the Tools | Options | Projects and Solutions | Web Projects.

Next, click Yes, and VS will "make a new site" on IIS Express. What does that mean?

Click yes and let's find out.

Remember that IIS Express is really IIS. It's just "local personal not-a-service" IIS. That means that IISExpress puts its config files in C:\Users\YOU\Documents\IISExpress\config rather than in some machine-wide location.

My project is called "MvcApplication18" so I can open up my ApplicationHost.config and look for "MvcApplication18." You can too. There's my site, right there, in IISExpress's applicationHost.config:

1 2 3 4 5 6 7 8

<site name="MvcApplication18" id="39"> <application path="/" applicationPool="Clr4IntegratedAppPool"> <virtualDirectory path="/" physicalPath="c:\users\scottha\documents\visual studio 2010\Projects\MvcApplication18\MvcApplication18" /> application> <bindings> <binding protocol="http" bindingInformation="*:15408:localhost" /> bindings> site>

Note the binding section. I can see that my site will show up on http://localhost:15408.

Go back to Visual Studio, click on your project and press F4 to bring up the properties dialog. You can also press Ctrl-W, then P, or select View | Property Window.

Since I'm using IIS Express and I have VS2010 SP1 installed, I have a new option, "SSL Enabled." If I click it, a new "SSL URL" shows up with a new port number chosen from that pool of ports I mentioned before.

Go back over to your ApplicationHost.config if you want to see what really happened.

1 2 3 4 5 6 7 8

<site name="MvcApplication18" id="39"> <application path="/" applicationPool="Clr4IntegratedAppPool"> <virtualDirectory path="/" physicalPath="c:\users\scottha\documents\visual studio 2010\Projects\MvcApplication18\MvcApplication18" /> application> <bindings> <binding protocol="http" bindingInformation="*:15408:localhost" /> <binding protocol="https" bindingInformation="*:44302:localhost" /> bindings>

See that new binding? That was created for us when we clicked SSL Enabled = True.

Run your site. Visit it with and without SSL. Don't forget the port number! You're now running under SSL locally, but you're reminded you are a bad person because this certificate is not trusted. Still, create an app, check a box and you've got local SSL.

Ok, how can we get this running in a slightly better way? I want:

• A friendly machine name, not localhost.
• People to be able to talk to my instance of IIS Express from the outside.
• Actual SSL over port 443.
• My ASP.NET application to switch between SSL and not automatically when I'm logging in.
• My self-signed certificate to be trusted so I don't get warnings.
• To use PowerShell at some point for no reason at all because that's bad-ass.

Here we go.

The Hard Ninja Way - Local SSL over 443 with IIS Express and the Gracious Manatee that is The Command Line

These steps may seem a little scary, but it's useful to know that they are happening (or have happened) already to make the Easy Way work for you. I'll show you how to do it yourself, then I'll show you an undocumented way to make part of The Hard Way even easier. It's important to know what's happening though and why when you start running random commands from an Administrator Command Prompt, right?

1. Getting IIS Express to serve externally over Port 80

My machine is called HANSELMAN-W500, so I'll use that name. You could update your hosts file and use a friendly name. To start, use your computer name. if you don't know the name of your computer, you're silly. Go to the command prompt and type "HOSTNAME" to find out.

First, we need to tell HTTP.SYS at the kernel level that it's OK to let everyone talk to this URL by making an "Url Reservation." From an administrative command prompt:

netsh http add urlacl url=http://hanselman-w500:80/ user=everyone

Next, as I want to be able to talk to IIS Express from outside (folks on my network, etc. Not just localhost) then I need to allow IIS Express through the Windows Firewall. I can do that graphically from Windows, or type:

netsh firewall add portopening TCP 80 IISExpressWeb enable ALL

Finally, I need to make sure that my project will use Port 80. I can do that one of two ways. I can either edit the applicationHost.config manually and add the binding (my recommended way):

1 2 3 4 5 6 7 8 9 10

<site name="MvcApplication18" id="39"> <application path="/" applicationPool="Clr4IntegratedAppPool"> <virtualDirectory path="/" physicalPath="c:\users\scottha\documents\visual studio 2010\Projects\MvcApplication18\MvcApplication18" /> application> <bindings> <binding protocol="http" bindingInformation="*:15408:localhost" /> <binding protocol="https" bindingInformation="*:44302:localhost" /> <binding protocol="http" bindingInformation="*:80:hanselman-w500" /> bindings> site>

Or, I can do that from the command line too! Although it's a little scary. I can confirm my changes in ApplicationHost.config though if I mess up.

"c:\Program Files (x86)\IIS Express\appcmd.exe" set site /site.name:MvcApplication18 /+bindings.[protocol='http',bindingInformation='*:80:hanselman-w500']

Notice that I'm using the appcmd.exe that came with IIS Express. I don't want to mess up my actual IIS installation if I have one.

2. Making an SSL Cert, hooking it up to IIS Express and making it Trusted

Let's make a SSL certificate of our own. Note the CN=. I'm making it my Computer Name, but you could make it nerddinner.com or whatever makes you happy. It should line up with whatever name you've been using so far.

makecert -r -pe -n "CN=HANSELMAN-W500" -b 01/01/2000 -e 01/01/2036 -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12

Now, a tricky part. Go find this certificate in the Certificate Manager. Run MMC.exe, go File | Add/Remove Snap In, then select Certificates. Pick the Computer Account. (This is why you can't just run certmgr.msc) and add it.

It'll likely be the certificate with an expiration data of 1/1/2036 under Personal Certificates. Double click on your certificate. Go to Details, and scroll down to Thumbprint. Copy that into the clipboard, as that identifies our new certificate.

Remove all the spaces from that Thumbprint hash. You can remove those spaces with Notepad if you're Phil Haack, or in PowerShell if you're awesome:

C:\>"41 d8 50 95 11 0e 1d f6 8c 89 84 97 55 25 a8 60 59 35 23 0a" -replace " "
41d85095110e1df68c8984975525a8605935230a

Take the hash and plug it in to the end of THIS command:

netsh http add sslcert ipport=0.0.0.0:443 appid={214124cd-d05b-4309-9af9-9caa44b2b74a} certhash=YOURCERTHASHHERE

The AppId doesn't really matter, its just a GUID. This tells HTTP.SYS that we're using that certificate. Leave the Certificate Manager MMC running.

Now, tell HTTP.SYS that we're cool with port 443 also (we told it that 80 was cool a minute ago, remember?):

netsh http add urlacl url=https://hanselman-w500:443/ user=Everyone

Return to your applicationHost.config and add the 443 binding for your site:

1 2 3 4 5 6 7 8 9 10 11

<site name="MvcApplication18" id="39"> <application path="/" applicationPool="Clr4IntegratedAppPool"> <virtualDirectory path="/" physicalPath="c:\users\scottha\documents\visual studio 2010\Projects\MvcApplication18\MvcApplication18" /> application> <bindings> <binding protocol="http" bindingInformation="*:15408:localhost" /> <binding protocol="https" bindingInformation="*:44302:localhost" /> <binding protocol="http" bindingInformation="*:80:hanselman-w500" /> <binding protocol="https" bindingInformation="*:443:hanselman-w500" /> bindings> site>

If I say "Show All Sites" from the IIS Express tray icon, I'll see my site(s) and the URLs they are bound to.

Now I can visit the site, but again I get a certificate error.

Go back to the CertMgr MMC, and drag your self-signed SSL Certificate from Personal into Trusted Root Certificates.

Suddenly my local SSD site is legit! Very cool.

3. Getting ASP.NET to force SSL with an URL Rewrite Rule

One of the things Cassini (Visual Studio Web Developer Server) can't do is UrlRewriting. I want my app to force SSL when I hit /account/logon or /account/register. I'll add this to the first node of system.webServer in my app's web.config:

1 2 3 4 5 6 7 8 9 10 11

<rewrite> <rules> <rule name="Redirect to HTTPS" stopProcessing="true"> <match url="^account/logon$|^account/register$" /> <conditions> <add input="{HTTPS}" pattern="^OFF$" /> conditions> <action type="Redirect" url="https://{HTTP_HOST}/{R:0}" redirectType="Permanent" /> rule> rules> rewrite>

I could also use the RequireHttps attribute on my controllers if I like.

Appendix Z: A totally undocumented way to make part of this easier that you use at your own risk

There's a command line helper deep inside of the IIS Express directory that I never mentioned to you. We never spoke! I don't know you. Who is this? Stop calling! ;)

C:\Program Files (x86)\IIS Express>IisExpressAdminCmd.exe
Usage: iisexpressadmincmd.exe  
Supported commands:
    setupFriendlyHostnameUrl -url:
    deleteFriendlyHostnameUrl -url:
    setupUrl -url:
    deleteUrl -url:
    setupSslUrl -url: -CertHash:
    setupSslUrl -url: -UseSelfSigned
    deleteSslUrl -url:

Examples:
1) Configure "http.sys" and "hosts" file for friendly hostname "contoso":
iisexpressadmincmd setupFriendlyHostnameUrl -url:http://contoso:80/
2) Remove "http.sys" configuration and "hosts" file entry for the friendly
hostname "contoso":
iisexpressadmincmd deleteFriendlyHostnameUrl -url:http://contoso:80/

From the command line with this utility, I can quickly setup my hosts file and my HTTP.SYS Url ACLs with one command:

C:\Program Files (x86)\IIS Express>IisExpressAdminCmd.exe setupFriendlyHostnameU
rl -url:http://daddyisawesome:80/
Command 'setupFriendlyHostnameUrl' completed.

And remove them:

C:\Program Files (x86)\IIS Express>IisExpressAdminCmd.exe deleteFriendlyHostname
Url -url:http://daddyisawesome:80/
Command 'deleteFriendlyHostnameUrl' completed.

At this point you just need to update the IISExpress applicationHost.config with the correct binding. You can also use IISExpressAdminCmd setupSslUrl with SSL ports that are already reserved. However, I really think The Hard Way is best because you can really see what's going on, and you have more control.

Make It Stop!

How do I undo it all? Delete the Certificate in CertMgr, and from an Administration Console:

netsh http delete sslcert ipport=0.0.0.0:443
netsh http delete urlacl url=http://hanselman-w500:80/
netsh http delete urlacl url=https://hanselman-w500:443/

If you have existing SSLCerts registered with HTTP.sys, the adjust these commands.

Enjoy! Thanks!

Difference between DataGrid and GridView

In .Net 2.0, we are using GridView. Since DataGrid and GridView are same we have some extra facilities and features in GridView than DataGrid.

By using GridView we can render it on Mobile Devices also, but DataGrid only use for web pages. Another key difference between DataGrid and GridView controls lies in the adaptive user interface.

In DataGrid paging, sorting, inserting, updating and deleting are implementing by coding. But in GridView automatically generates those things without user writing the code.
Sorting: In DataGrid code requires handling the SortCommand event and rebind grid required. In case of GridView no additional code required.
Paging: In DataGrid requires code to handle the PageIndexChanged event and rebind grid required. In case of GridView no additional code required. It also supports customized appearance.
Data binding: Like GridView DataGrid cannot bind with new datasource control in ASP.NET 2.0.
Updating data: DataGrid requires extensive code to update operation on data. GridView requires little code. Code like exceptions handling for database part.
Events: GridView supports events fired before and after database updates. In DataGrid fewer events supported as compared to GridView.

In DataGrid no image template column, whereas GridView have image template column
The GridView control is the successor to the DataGrid control. Like the DataGrid control, the GridView control was designed to display data in an HTML table. When bound to a data source, the DataGrid and GridView controls each display a row from a DataSource as a row in an output table.

Both the DataGrid and GridView controls are derived from the WebControl class. Although it has a similar object model to that of the DataGrid control, the GridView control also has a number of new features and advantages over the DataGrid control, which include:

Richer design-time capabilities.

Improved data source binding capabilities.

Automatic handling of sorting, paging, updates, and deletes.

Additional column types and design-time column operations.

A Customized pager user interface (UI) with the PagerTemplate property.

Differences between the GridView control and the DataGrid control include:

Different custom-paging support.

Different event models.

How to Hack Facebook Password?

Hello friends today i will explain you how to hack the Facebook password or accounts remotely using keylogger. Its a 100% working hack and you can easily hack anyone's Facebook account or password using this hack. In this tutorial i will explain you how to hack Facebook and other passwords of any user using 100% FUD keylogger. The keylogger in this tutorial we will discuss is L33ts keylogger and its 100% FUD(fully undetectable).

Hacking Facebook account is very easy and just requires not more than 10 minutes of work. Don't worry i will also tell you how to protect your facebook account or passwords from such hacks and hackers. But for this you must know how hackers hack your facebook account. So first i teach you how to hack facebook account remotely and then i will tell how to protect yourself from this.

NOTE: This tutorial is for Educational purposes only i.e. to make you aware how hackers hack your Facebook accounts. Please don't misuse it. I and Isoftdl is not responsible for any damage caused by you.
So guys lets start hacking Facebook account or passwords....

Steps to hack Facebook account using Keylogger:

1. Creating the Keylogger Server to hack Facebook passwords.

2. Extracting the Icon from installer.

3. Bind the keylogger server with any software setup.

4. How to spread your keylogger or send it to your friends to hack their Facebook accounts or passwords.

Step 1. Creating the Keylogger Server

1. Download the keylogger.

Download

2. Extract the file, Now you will get two folders:

a. First one contains Keylogger and Binder

b. Second Contains resource hacker tool.( to extract the icons from installers).

3. Now open the Keylogger. It contains two files one for gmail email and other for password. For this create one test account on Gmail and enter it's details in this.

4. After entering email and password. Set the time interval usually set 3 mins i.e. after how much time you want to receive logs from the user.

5. Now click on send verification mail. This mail is to test that your keylogger is working correctly or not.

6. After you click this you will receive a confirmation mail on test account which will confirm that keylogger is working.

7. Now click on generate to set the mutex (any secret key to make your keylogger FUD) and then click on compile server.

8. Now save the file to desktop or any other location of your choice. Now your server is ready but it can be easily detected.

Step 2.: Extracting the Icon file from any installer(resource hacker)

1. Open the Resource hacker folder and open the reshacker file.

2. Now go to its menu and open any setup file. Suppose we want to attach our keylogger to Ccleaner setup file. So open the Ccleaner setup with resource hacker.

3. Now in menu there is one action button click on it and then click save all resources.

4. Now save all the resources to desktop or any other location of your choice.

5. It consists of two files one is icon file and other is res file . We only need icon file, so you can delete the other file i.e res file.

6. Now we have Icon of installer file(as discussed above Ccleaner setup Icon).

Step 3: Bind the Keylogger server with any software

1. Now Go to keylogger folder and open the Binder.

2. Now Click on + button given below to add files.

3. Now add the keylogger server and the set up of software (i.e. in our case it's Ccleaner setup).

4. Now in menu of Binder, Go to Settings. There select the icon that we have generated in the previous step and set the location of output file as shown in figure.

5. Now again go to File's menu in Binder and click on Bind files.

6. Now your Binded keylogger is ready. Now you have to spread it or send it to the victim that is your friend.

Step4 : How to Spread Keylogger or send it to victim or friend

1. Now you have one Software setup file with keylogger attached with it.(In our case we have Ccleaner setup with keylogger attached with it.

2. Now Spread your keylogger through forums. You might be a member of various forums use them to spread your keylogger in form of software posts. You can use various software's to spread them that users frequently download.

3. Spread it through pendrives or USB hard drives. Suppose a friend asked you for a software give it the software that has keylogger attached with it.

Note: you can also attach keylogger with images also. But that can be detectable by antivirus. So avoid such type of hacking.

So isn't that so easy to hack anyone's Facebook account in just few minutes.

How to protect yourself from these hacks?

Prevention is always better than cure so always follow these steps:

1. Don't use cracked softwares and don't download them from unauthorized websites.

2. Always keep your antivirus and anti-spyware up to date.

3. Always scan the files before transferring them to your USB.

4. Do not allow other users to use your PC i.e password protect it.