How to decode a base64 string in VB.NET

Sometimes, we receive an e-mail that we can’t really open directly, but we have the base64 source.

I may receive an attached EML file, that is, an outlook express email attached with another e-mail.

I have all the original source of this file, but I do not have Outlook Express installed.

So, I created a really simple decoder and it work fine.  You just have to look at the boundary of your email.  Find the beginning of attachment by searching for “filename=” and you’ll have the filename of the attached file.

Then, copy the following code, all the “binary string” code, and only this, without the leading MIME informations, to a text file.  In my sample, I called it “c:base64.txt”.  Then, I saw that the filename is a pdf.  I choose “c:base64.pdf” as my output.

This is the code you can use to decode a base64 attachment.

   Dim bytes() As Byte
   Dim reader As New System.IO.StreamReader("c:base64.txt")
   Dim str As String = reader.ReadToEnd
   reader.Close()
   reader.Dispose()
   bytes = System.Convert.FromBase64String(str)
   Dim writer As New System.IO.BinaryWriter(IO.File.Open("c:base64.pdf", IO.FileMode.Create))
   writer.Write(bytes)
   writer.Close()
That’s all!

How to get response headers on all jquery ajax requests

REST / Ajax querie are part of our day as a web developer.

Recently, we had to handle response headers (when communicating with Basecamp3 API).

The default jqXHR object is not very helpful to give us a beautiful list of all response headers.

There are 2 functions available:

  • getResponseHeader(key…) that returns the value of that key, but you need to know which one you need.
  • getAllResponseHeaders, that returns a “string” of all headers, in key-value pair, but all stuck in 1 big string.

Solution

So, we create something that is, on every call, parsing that string and set it in a easy-to-use object embedded to the jqXHR.

$.ajaxPrefilter(function (options, originalOptions, jqXHR) {
  jqXHR.done(function (results, responseText, jqXHR) {
    getResponseHeaders(jqXHR);
  })
}

function getResponseHeaders(jqXHR){
  jqXHR.responseHeaders = {};
  var headers = jqXHR.getAllResponseHeaders();
  headers = headers.split("\n");
  headers.forEach(function (header) {
    header = header.split(": ");
    var key = header.shift();
    if (key.length == 0) return
    // chrome60+ force lowercase, other browsers can be different
    key = key.toLowerCase(); 
    jqXHR.responseHeaders[key] = header.join(": ");
  });
}

Now, you can get, jqXHR.responseHeaders.etag value directly. (lowercase)

Because the “.done” set in ajaxPreFilter is set before the one of the caller, we can fill the responseHeaders property on all call.  And, when the caller gets its .done event executed, that third parameter, jqXHR, contains the responseHeaders already filled.

Warning

You will be able to retrieve these headers, if you do same-domain query.  For cross-domain queries, the server needs to return that header: Access-Control-Expose-Headers (more details)

How to do video capture on windows 10 without third party

I’ll show how to do a video capture in windows 10, without installing any third party app.  It’s all integrated freely in the OS.

How already know how to take a static snapshot of your app without any third party, by sending an image to clipboard like this:

  • Print Screen Key: All your visible screens, of all monitors.
  • Alt + Print Screen Key: Copy Current app to Clipboard
  • WARNING: Alt + Shift + Print Screen = Active the “high contrast” !!!

But now, you want to do a video capture of your app.

When you search the internet for that, found lots of browser plugins and extensions, or complete apps like SnagIt or Greenshot.

Windows 10 integrates features for gamers.  One of them is the “Game Bar“.  It’s used to record your game and share it with friends on the Xbox app.

But, you can use it for other apps that are not games, like your Web Browser or even Notepad.

Instructions

Open the app you need to record, and hit Win + G key.

The bar will initialize, asking you if the app is a game.  Just click the box, and the record bar will appear.

If you use it for the first time in that app, you will need to confirm that the app is a game, even if it’s not.

Then, the record bar will appear.

Click the Record button, and now start clicking or typing in your app.

While recording, the bar is shown smaller on the right of that application.

When you have finished, click stop.

The recorded files can be accessed by the Xbox Windows10 app, or you can go to the “My Video\Captures” folder, that can be hit directly by using Win+R key, and pasting:

shell:My Video\Captures + Enter.

(that’s another hidden Windows trick) (more details…)

These captures uses the .mp4 extension, are well compressed to offer a good quality with a small file size.

This is how the final result looks like:

The small record bar is not visible in the video, even if you see by following the mouse that I click on the “stop” button at the end.

 

Disable ssl3 for more security

SSL3 is over.  Some servers keep it active because they need to serve pages to IE6/XP users.  But, these days are over, as most of the updated to, at least IE8, and they have all the last updates allowing to connect using TLS 1.1 or 1.2.

SSL3 can also be enabled by default on older Windows Servers, like 2008 R2, even if you installed all Windows Updates.

Now, it’s time to disable SSL3 completely.

If your SSL3 is active, you may get one of these warnings from Qualys SSL Test:

  • This server is vulnerable to the POODLE attack. If possible, disable SSL 3 to mitigate. Grade capped to C.
  • This server uses SSL 3, which is obsolete and insecure. Grade capped to B.

It’s easy to disable it from a Windows registry, as described here.

Solution

Create a file, called DisableSSL3.reg, and copy that content on it:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
"Enabled"=dword:00000000

Save it, double-click on it, and accept.

Finally, reboot, and all SSL3 server services are disabled on your Windows server.

How to get “A” Rating on Qualys SSL Labs Test

That blog is hosted on an Amazon EC2 Instance, running Windows 2012 R2 Server.  And our SSL certificated is provided by Let’s Encrypt.

Starting from that default configuration, we ran the SSL test, and we got a B note.  We wanted to get the “A” Rating, and these are the 2 major warning we had to solve.

  • “This server supports weak Diffie-Hellman (DH) key exchange parameters”
  • “This server accepts RC4 cipher, but only with older protocols”

Solution

We were able to fix these issues with some simple registry tweaks that we describe in these articles

Then, after we ran these steps, we now have our A Grade!

Now, if you want an even better grade, you can continue to solve these little warnings that the SSLLabs test can give you.

How to solve RC4 warning on Qualys SSLLabs Test

In a previous article, I talked about how you can solve the Diffie-Hellman warning on Qualys SSLLabs test, by applying a registry configuration.

Now, we’ll talk about another common warning that most AWS EC2 customer can get.  By default, we got that security issue from SSLLabs:

This server accepts RC4 cipher, but only with older protocols. Grade capped to B.

Solution

Microsoft proposes a solution for disabling the 3 weak RC4 cipher suites in that article.
You need to create 1 new registry entry.  Create an empty text file called rc4fix.reg, and paste that content to it:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
"Enabled"=dword:00000000

Then, double-click on it to apply these settings, an reboot.

Finally, run your SSL test again, that warning disappeared.

How to solve Diffie-Hellman warning on Qualys SSLLabs Test

In a previous article, I talked about how you can get a better note on Qualys SSLLabs test, by configuring CAA DNS entry.

Today, we’ll talk about another warning most of us must resolve to get the “A” Rating.

On our AWS EC2 Windows 2012 R2 server, by default, we got that security issue from SSLLabs:

This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B.

Solution

That is caused by the Diffie-Hellman protocol accepted at 1024 bits.  The fix proposed by Microsoft (article) is to still accept that protocole, but only at 2048+ bits.

You need to create 1 new registry entry.  Create an empty file called df.reg, and paste that content to it:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman]
"ServerMinKeyBitLength"=dword:00000800

Then, double-click on it to apply these settings, an reboot.

Run your SSL test again, that warning disappeared.

How to fix DNS CAA issue on SSL Labs Test

You ran the SSL Labs Analyzer on your domain name, and you got a DNS CAA Issue.  You want to solve it, because your goal is to get the A+ Rating from Qualys.

How to fix that?

You need to add a CAA Entry in your DNS.

What is a CAA DNS entry?

That entry tells which certificate authority delivered your SSL certificate.  If someone hack your ssl certificates with certs not in your liste of “known” providers, it will be an indication that your site may have been modified by someone else.

The blog you currently read is hosted on AWS EC2 infrastructure.  The DNS is sold and managed by AWS Route 53 services, and we got our SSL certificates free from Letsencrypt.

So, I’ll explain you how enable your CAA DNS setting based on these prerequisites.  The procedure is the same for any other SSL seller and DNS service.

Step-by-step configuration

  • In your Route 53 console:
    • select your domain name
    • Click “Create Record Set”
      • Leave name empty
      • Choose type: CAA
      • Enter value, in my case it was:
        [0 issue “letsencrypt.org”] (without brackets)

In addition, you can use that generator: https://sslmate.com/caa/ to obtain your value.
From that generator, just enter your domain name.
Next, click “Auto Generate Policy”.
The tool will look at your current SSL certificate.  Then, it will give you the desired value you should type in your CAA DNS entry.

Finally, wait a little for DNS propagation, and run the test again, and you will get a nice green status on your CAA test!

You can also test your CAA with that tool:
https://caatest.co.uk/

Make your api faster with ThreadPool in ASP.NET

One easy way to make a server-side call faster, in your API, is to add some async procedures.  Sometimes, you want to call an external api (e.g. mailchimp…) or just send an e-mail, write a log, etc.

When your API client don’t need interaction from these calls, you can process them asynchronously.

The easiest way to add an async call is from the System.Threading.ThreadPool workspace.

As they say on their documentation, “The thread pool enables you to use threads more efficiently by providing your application with a pool of worker threads that are managed by the system.

And, it’s very easy to use.  This is a very simple example, in VB.NET:

Threading.ThreadPool.QueueUserWorkItem(
   sub
      ' Enter your async procedure here, 
      ' with callback and error handling if needed
   end sub)

That’s all!
That anonymous sub can access your caller parameters and other variables declared outside.

Stingray Windows Desktop App

You like stingray music. But when you work on your PC, you want to listen to it from a real Windows Desktop App, independent from your browser, instead of using your phone.

Actually, that product doesn’t exists.  But, they offer a Web Player, available at
https://webplayer.stingray.com

If you’re using Google Chrome, you can use “pin tab”, to make it locked on the left side of your tabs, in a mini-size tab.  But, if you close chrome, the music stops playing.

Fortunately, there’s a workaround that will almost do what you want.

You can use a quite unknown feature from chrome, to convert any web site to a look-alike windows application, that run outside of the regular browser context.

These are the steps to achieve that.

First, open your regular chrome browser, and open the Stingray web player URL.

Then, click Options (3 dots) / More Tools / Add To Desktop.

Next, you can type any name you want for the app, then click Add.

You can now see that new icon in your desktop, that looks like a standard application.  Double-click on it to launch it.

As you can see, the web site is opening inside a non-browser-like window.  You only see the title of the page, and there’s no browser address bar, or navigation buttons.  Only the web app is visible.

Also, on your Windows Taskbar, you can see the Stingray app besides the Chrome app.  Even if it’s the chrome.exe engine that run that app, it’s independent from the browser.
So, you can open only stingray, or only the browser, or both.  And you can now close or restart your browser without losing your currently playing music!

One final step, right click the stingray icon on the taskbar, and choose “Pin to taskbar”, to make it easier to start or navigate to directly.

That’s all! Have a nice listening to Stingray Music with your new Desktop App.