Security Consideration Asp.net MVC4

Bible Links of Asp.net MVC 4
http://msdn.microsoft.com/en-us/library/gg416514(v=vs.108).aspx

****Security Specific Applicable to MVC4
1. Safegaurd Controller and Action

• AllowAnonymous
• Authorize
• RequireHttpsAttribute

If you want to apply Authorize attribute to all actions of the controller then use this

[Authorize]
public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
    filters.Add(new HandleErrorAttribute());
    filters.Add(new System.Web.Mvc.AuthorizeAttribute());
}

Secure using Https: RequireHttpsAttribute

public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
    filters.Add(new HandleErrorAttribute());
    filters.Add(new System.Web.Mvc.AuthorizeAttribute());
    filters.Add(new RequireHttpsAttribute());
}

http://blogs.msdn.com/b/rickandy/archive/2012/03/23/securing-your-asp-net-mvc-4-app-and-the-new-allowanonymous-attribute.aspx

2. MVC Cross Site Request Forgery- Html.AntiForgeryToken() and ValidateAntiForgeryToken

• CSRF
• Html.AntiForgeryToken()
• ValidateAntiForgeryToken
• Salt base Html.AntiForgeryToken("SaltValue")

Using Salt with AntiForgeryToken() : To support multiple form independent from each other. A kind of isolation on AntiForgeryTokem()
Two way handshaking-ValidateAntiForgeryToken at action -controller level
http://blog.stevensanderson.com/2008/09/01/prevent-cross-site-request-forgery-csrf-using-aspnet-mvcs-antiforgerytoken-helper/

3 Preventing Javascript Injection Attack/cross-site scripting, or XSS attacks ASP.NET

HTML Encode
<%=Html.Encode(feedback.Message)%>

one can inject such javascript code in feedback text area . We can prevent this using Html.Encode
http://www.asp.net/mvc/tutorials/older-versions/security/preventing-javascript-injection-attacks-vb
AntiXss library
@Encoder.JavaScriptEncode
Javascript encoding Helper class
@Ajax.JavaScriptStringEncode
http://weblogs.asp.net/jongalloway//preventing-javascript-encoding-xss-attacks-in-asp-net-mvc

Most Common Heard Security Terminology.

Some Security Break Terminology

• Script Kiddie- Creates malware code from copying others set of malware.
• Spoofing
• Social Engineering
• Trojon Horse
• Virus
• Zero Day Exploit
• Threat/Vulnerability
• RootKit
• Reverse Engineering
• Router/Hub/Switch
• Phishing
• Leetspeek: http://en.wikipedia.org/wiki/Leet Leet (or "1337"), also known as eleet or leetspeak.The term leet is derived from the word elite.
• Intrusion Detection System
• Information Disclosure
• Policy violation
• Hijacking/hacker
• Firewall
• Ethical or white hat hacker
• Escalation of privilege
• Cracker/Cracking
• Daemon
• Pirated
• Access Control List
• Attack
• Backdoor Enteries.

RootKit: Malicious software gain admin access, maintain same privilege access to the system , installed and behave the same way as normal system.

Zero Day Exploit: A known error, fault that developer fail to fix as there is zero day to do so. Hence the software is release until the hacker exploits it.

Worms, Virus, Trojan and bots:  Types of Malware-Malicious code
Trojan are tricks users to installed malware using social engineering. Most common is email, internet and user interaction such as popup window.

Bots- Are termed from Robot-Automated malware.

http://www.cisco.com/web/about/security/intelligence/virus-worm-diffs.html


 

Few Quick Walkthrough on How to work with Selenium

Download Selenium tool for Firefox IDE.
http://docs.seleniumhq.org/download/

Once you install Selenium it will appear as small SE icon in web browser. Check the image.
One can record the web flow scenario as per test case and generate code out of it. These code can be used for custom automation test for regression test or integrated or product test.

 

Sample Generated Code file.

namespace SeleniumTests

 

 

{

 

[TestFixture]

public class Code

 

 

{

 

private IWebDriver driver;

private StringBuilder verificationErrors;

private string baseURL;

private bool acceptNextAlert = true;

[SetUp]

public void SetupTest()

 

 

{

 

driver = new FirefoxDriver();

baseURL = "https://www.google.se/";

verificationErrors = new StringBuilder();

 

 

}

 

[TearDown]

public void TeardownTest()

 

 

{

 

try

 

 

{

driver.Quit();

}

 

catch (Exception)

 

 

{

 

// Ignore errors if unable to close the browser

 

 

}

 

Assert.AreEqual("", verificationErrors.ToString());

 

 

}

 

[Test]

public void TheCodeTest()

 

 

{

 

driver.Navigate().GoToUrl(baseURL + "/?gfe_rd=cr&ei=D7CzU9buL-bJ8gfYr4HQDw&gws_rd=ssl#q=Fifa+world+cup");

driver.FindElement(By.Id("gbqfb")).Click();

 

 

} 

Nunit Framework Adapter VS2013

If you're working with Nunit framework and you want to get this inside Team foundation server /VS2013 then follow these steps


Benefits:
1. Test Explorer console appears as given below
2. TFS ALM -application life cycle management. More to come.

To add it is a Nuget package, you must have an active solution, then follow these steps:

1. From Tools menu, use Library Package Manager, select Manage NuGet packages for solution
2. In the left panel, select Online
3. Locate (search for) NUnit Test Adapter in the center panel and highlight it
4. You will find two packages, one without framework and one with framework. See notes below for which to choose.
5. Click 'Install'
6. In the "Select Projects" dialog, you need to select at least one project to add the adapter to, see notes below.

http://nunit.org/index.php?p=vsTestAdapter&r=2.6.2

 

Http Cookies Unsung Hero

Introduction

Cookie is something which User Agent aka web browser get in terms of http header response. Once it receives cookies then web browser send this cookies as part of http header request to server. This cookies contains some user identifiers via which server can validate the requests and process it and send back the response. "Cookies contains user information hence it is kind of security violation. "

Cookies definition:

Http Header Response

HTTP/1.1 200 OK

Set-Cookie: firstname=santosh$lastname=Poojari ; domain=somewebsite.com; path=/

***Symantics

Set-Cookies: Name $ Value pair ; Domain ; Path

***Size of cookies- 4kb

Usually in asp.net we can store user identifier as GUID.

HTTP/1.1 200 OK

Set-Cookie: GUID=00a2000b7f6a4946a8adf593373e53347c;

domain=.msn.com; path=/

 

How Session and cookies work-

For the first time , server will set cookies with unique identifier say with GUID. When next time request is initiated, web browser sent this GUID to web server where web server will map this unique identifier with data structure and generate session object for logged in users. Say we have session object with Unique identifier then it will stored user details in session for given cookie user identifier. For subsequent requests server will get data from session rather than actual data structure.

Types of Cookies:

1. Cookie Less Session:

 

In this sites gives URL to users with unique identifier. This identifier is used to identify user details at web server end. This is also called Fat URL as url may grow in size due to this identifiers. This is generally used when cookies is disabled in web browsers.

 

2. Session Cookies-

 

User close the browser and cookies is lost.It is single user cookies. No expire attribute represents session cookies whereas one can explicitly add discard cookies in the header.

 

 

HTTP/1.1 200 OK

Set-Cookie: GUID=00a2000b7f6a4946a8adf593373e53347c;

domain=.msn.com; path=/ ; discard

OR

HTTP/1.1 200 OK

Set-Cookie: GUID=00a2000b7f6a4946a8adf593373e53347c;

domain=.msn.com; path=/ ;

 

3. Persistent cookies-

This  cookies stored in file system and is alive even when client system reboots.

Set-Cookie: name=value; expires=Monday, 09-July-2018  GMT

 

 Combat Hijacking:-

1.       Choose unique identifier in encrypted format it can be GUID with Http only or asp.net session idenfier120 bits. Doing this we ensure hacker won’t be able to guess the user identifier

Set-Cookie: ASP.NET_SessionId=en5yl2yopwkdamv2ur5c3z45;

path=/; HttpOnly

By making HttpOnly , user agent scripting code aka JavaScript will not be able to read and write cookies.

2.       Additional security layer, specifying domain in set-Cookie will ensure communication requests and response w.r.t to domain. So there is no possibility of privacy bridge in case someone tries to read cookies from cross domain.  There is also path attribute in the set cookies, with this provision we can even ensure request is inline and specific to site path and resource only. Hence it helps better management and categorization of cookies.

 

Do’s And Don’t

1.       Never cache response header if cookies are set. As it cache will interfere with cookies. Design checklist. Best Practice w.r.t cookies.

2.       Cookies should never stores sensitive information. There are tools via which these cookies can be intercepted and can be used.

3.       Cookies are prone to XSS attack. Ensure HTTP only , domain and if path can be assigned to SET-Cookie

4.       There are greater chances of Third party cookies which can be set by third party URL. It may happen you send requests to www. Server2.com and this server will send the script  tag with embed URL (back links) to the User. Hence it is thus more vulnerable to third party cookies. Be precise to the request sends to the server. Need thorough security assessment and review.

Web Test Automation Sample with powershell

Selenium -Web browser Automation

Reference :http://docs.seleniumhq.org/

Purpose- Automation UI Test -Useful for regression test and unit test.

Download Selenium Webdriver c#

 

http://www.nuget.org/packages/Selenium.WebDriver

1. Open Powershell- Run ISE as Administration
2. Add below code and f5.
3. Source Code- * Give path of the WebDriver.dll

 

Foreign Key Constraint vs Nhibernate

If you have worked extensively on nhibernate then you will understand the caveat it carries at time of implementation. One of the case is with foreign key constraint for one to many relationship in which it fails to insert rows for child as it always sends foreign key column value zero and when it tries to apply this it into constraint-data integrity conflicts.

Most of the solution suggests:-
1. Apply Inverse =true
2. Apply Cascade all

So on..

But all this solution doesn't work.

When one remove foreign key constraint it works absolutely fine. What it does under the hood?

1. It first insert the parent table enteries.
2. It then insert the child table enteries but keep the foreign key column value as zero
it tries to apply select scope_identity but it return null.
3. Then there are two update on parent and child table where it just update foreign key column with actual values.

The above step is tricky to understand but can be evident in sql profiler log.

Workaround- You can keep the foreign key but can disabled constraint( Disabled Constraint does not mean removing constraint) It still satisfy DDL best practice.


 

Part 3 Http Unrevealed- Connections

Parallel Connection-

Initially it is like one user agent-web browser can establish two connection with host webserver. Just imagine we have two files that needs to be requested therefore browser makes two requests and establish two connection to download the files.

IE6 used to have this 2 connection setup.

* Approach 1:

We keep files in different server in that case user agent can opens parallel connections to host server. In that sense, we states two connections is directly proportional to host and not IP addresses of the host. So we conclude two connection is dependent on host but independent of IP address.

* Approach 2:

With case of IE8 where it applies heuristics logics and it establish 6 concurrent connections w.r.t host.

 

Persistent Connections:-

 Connection: keep-alive
 

This is a state where we keep the socket opened or maintain persistent connection even it server one request response transaction for given user agent. It persist the connection between user agent and host and consume same socket opened for communication. With this there is no overhead on memory consumption, cpu utilization, less network congestion, less latency, more throughput and improves response time of given request.

The only demerits about this type of connection is falling prey of security vulnerability. Longer period of open connections can pose threat to security compromise. Some webserver close connections when idle even we can configure
user agent or webserver to close connection when idle for certain threshold limit.

HTTP/1.1 200 OK
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Connection: close

This close header indicates that connection will be closed as soon request is served with response and hence no subsequent request on same socket is available.

Pipelined Connections-

It opens up multiple connections and queue the requests into efficient packets. But this is not widely used.

Part 4: Http Unrevealed - Outside of Http

Outside of Http:
Proxy Server-

 

Is very much visible to end users. It takes users http request and take response back from server to the user.

Benefits of Proxy Server-1. In order to prevent users accessing restricted sites we can use proxy server to capture all http traffic at proxy server and thus setup strategy that will not send these requests to destination server. In this way we can ensure no one use the sites that is restricted.

2.Proxy server in fact can be used to inspect /probe the confidential message flow from system to server. In a way we can remove referrer headers that referenced organization resources such as images, files etc.

3. Proxy server can acts as access control to create http log that act as audit trail for http request that is send.

 

Type of Proxy

Forward Proxy Server-

This server sits close to client. This proxy help secure confidential information and can help filter traffic send from the client to destinations server.

 

Reverse Proxy-

is a proxy server that sits close to the server.This server can take off the load from destination webserver or any server for that matter. Take a case of compression of file or data using gzip which can delegated to this proxy server making destination server concentrate on processing of data or request.

 

Load Balanaced Proxy server-

All http request reaches this load balanced proxy server which will send requests to given server based on load as per round robin manner.

SSL Acceleration server-

This server will encrypt and decrypt http messages. This provides very secured level of isolation and can act as a centralized source to provide insulation to attack such as cross site scripting (XSS) or sql

injection for that reason.

 

Caching proxies-

Can act as centralized repository of cached data in distributed environment.

Caching -

HTTP response can have a value for Cache-Control of public, private, or no-cache
There is also a no-store value, meaning the message might contain sensitive information and should not be persisted, but should be removed from memory as soon as possible.

 

Public Cache- This is cache is applicable to whole system and is available for all users. Say for e.g we have logo, header and footer which will be consistent for all users.

Private Cache- This cache is specific to users , we can use Response.Cache for this kind of caching.

 

EtagThere are other ways to even identify given resource has been changed from last cache value is Etag. Etag is hashed values. Every time resource value or resources data changes it generated new hash value. Using this identifier we can even check the cache nature of the data.

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 06 Jan 2012 18:08:20 GMT
ETag: "8e5bcd-59f-4b5dfef104d00"
Content-Type: text/xml

Part 2 : Http Unrevealed

In part 1 , I almost listed most of the intrinsic feature of Http. In part 2, the focus is more on how http interact with other layer protocol and ensure connectivity and communication.

Courtesy Succinctly Http: By Scott Allen



1. Http :it allows two Web Browser and Web Server( IIS or Apache) to communicate over a network.
2.TCP- Transmission Control Protocol

Browser extract host name and port . Opens TCP socket. Once ports is data is written into the socket.
TCP ensures data is transmitted to server and notify error if any. TCP also controls the flow of data, it has mechanism where it controls the rate at which that data being transfered thus ensuring enough time for receiver to process the data. Flow control is two way handshaking that TCP very well follows. Hence TCP is reliable protocol with flow control and error detection
mechanism.

3.IP: Internet protocol:-
IP ensures data moves across switches, routes, gateways , repeaters and other devices that help flow of data. IP even breaks down the larger piece of information into packets-fragment called data datagrams. This is indeed optimizes performance over network segment.

4. Data Link Layer- Ethernet .Eventually this IP datagram travels through  a optic fiber cable, wifi n/w or a satellite link.

Tool
www.wireshark.org

 Wireshark is network analyzer for IP and TCP- network traffic.

Part 1 Http Unrevealed

Part 1 Hypertext Transfer Protocol
Whatever we see in www is possible through http protocol.

Few know-how to be familiar with HTTP.

Resource Locators: URL Uniform Resource locator.

URL path
://:/?#
http://somthing.com - host name
http://somthing.com/author/santosh

URL with keyword such as author is help rank your website for given search keywords in URL.It improves your Search Engine Optimization.

By default URL with out port points to port 80. Other than port 80, one needs to mention or host url with port number.

#sign represents fragment. The fragment locate a specific HTML element in a html page by control ids. For example bookmark in given page.

URL EncodingUnsafe characters such space and ^ carat are replaced with %
%20 is the encoding for a space character ( 20 is hexadecimal value = US-ASCII space character).
%5 represents ^

Resources and Media

Web page can request different resource format for display for end users they can be executable applications ,mages, XML , Json,video,HTML audio etc.
When a host server responds to an HTTP request, it returns a resource and also specifies the content type. This content type is called Media type. Media type is represented by Multipurpose Internet Mail Extensions (MIME) standards.
Client request content type html then it will send text/html
Similarly
"image/jpeg"
"image/gif"
"image/png"

File Extension in URL

File extensions not always output requested file extension as given example http://something.com/main.jpg
How it works:-
1. Client first look at response header content type tag send by host server.
2. If content type not available it will parse first 200 bytes of response to identify content type.
3. If client fails to identify content type and first 200 bytes of response then it look into URL file extension to guess content type.

Content Type Negotiation

Client can tell host server what content type it want at time of response. For example some resource of book url may suggest the client may display book content in some specific language and can be downloaded in specific format.In such scenarioncontent type negotiation plays a essential role.
Accept keyword in Response header suggests this.

Accept-Language: fr-FR

Http Request Method

Method	Description
GET	Safe Method:Retrieve a resource
PUT	Store a resource
DELETE	Remove a resource
POST	Update a resource
HEAD	Retrieve the headers for a resource

HTTP Response Request

A full HTTP request might look like the following.
Request
GET http://something.com/ HTTP/1.1
Host: something.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) Chrome/16.0.912.75 Safari/535.7
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.google.com/url?&q=odetocode
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.0

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Sat, 14 Jan 2012 04:00:08 GMT

Connection: close

Content-Length: 17151
Http Status Code Classification

Range	Category
100–199	Informational
200–299	Successful
300–399	Redirection
400–499	Client Error
500–599	Server Error

With the help of  Fiddler Tool we can read and analyze the http response and request.

Iterator Enumerator with Yield Return.

MSDN :-
 

public System.Collections.IEnumerable SampleIterator(int start, int end)
{
    for (int i = start; i <= end; i++)
    {
        yield return i;
    }
}

We can fetch the results from SampleIterator:-

ListClass test = new ListClass();

foreach (int n in test.SampleIterator(1, 10))
{
    System.Console.Write(n + " ");
}
// Output: 1 2 3 4 5 6 7 8 9 10

IEnumerable and IEnumerator

 

 class Test : IEnumerable, IEnumerator
 {
        IEnumerator IEnumerable.GetEnumerator()
        {
            throw new NotImplementedException();
        }

        public object Current
        {
            get { throw new NotImplementedException(); }
        }

        public bool MoveNext()
        {
            throw new NotImplementedException();
        }
        public void Reset()
        {
            throw new NotImplementedException();
        }
 }

IEnumerable has GetEnumerator() Method with IEnumerator return type. Whereas IEnumerator has one property Current (position) and two method MoveNext() and Reset().

Important Facts:- When you write a foreach loop in C#, the compiler generates code that uses an Enumerator.

 

foreach (small x in Big)
{
   ...
}

it's functionally equivalent to writing:

IEnumerator x= Big.GetEnumerator();
while (x.MoveNext())
{
   y= (Big)x.Current
   ...
}

Code Analysis :Avoid Calling Virtual Method in Constructor.

 

 

The above code is referenced from Bill Wagner post. The intent is the base constructor get called first and which indeed called Vfunc of derived class as in runtime the derived class had to be initialized.

AggregateException in Unit testing Task Parallel Library Asyc Call

Some Background Exception Handling (Task Parallel Library)

If a task is the parent of attached child tasks, or if you are waiting on multiple tasks, then multiple exceptions could be thrown. To propagate all the exceptions back to the calling thread, the Task infrastructure wraps them in an AggregateException instance

http://msdn.microsoft.com/en-us/library/dd997415(v=vs.110).aspx

Problem Statement:

Most of the time when we create a unit testing on Async Method- TPL it executes the unit test completely but ends up throwing AggregateException. This is due to the fact that it completes the one set of flow completely within a thread and comes out without executing all thread in parallel. If you see there is no UI and hence while testing the TPL must understand that unit testing is just to check the conditions of expected output with actual given a input as required whereas TPL works in different context. So ideally we must create test on non TPL methods in such case create separate methods to test on.

http://stackoverflow.com/questions/7617494/unit-test-expected-to-throw-an-exception-when-calling-an-asynchronous-operation

http://blog.stephencleary.com/2012/02/async-unit-tests-part-1-wrong-way.html

•An asynchronous method call will either produce a result immediately if one is available and continue execution in the current method or it will produce a result at a later time and immediately return control to the caller of the current method.
•The code that comes after an awaited method – the continuation – is what will be executed when the awaited method returns with a result.
http://www.jayway.com/2012/10/07/asyncawait-in-c-a-disaster-waiting-to-happen/

Workaround:

Brute force method not recommended but can be used if just unit test case conditions with failed and pass data.
[TestClass]
public class TestAsyncClassTest {
    [TestMethod]
    [ExpectedException(typeof(AggregateException))]
    public void SomeAsyncTest() {
    }
}

Data Driven Excel data source Unit Testing Using VS 2013

 

Introduction:- We're using excel as data source for data driven unit testing.

1. Create Unit test Project using option given above.


2. Add following code , this is demo code for reference.


Test Data:

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Trobleshooting Issues:

Probable Error: "Excel microsoft.ace.oledb.12.0 provider is not registered"

Download and install

2007 Office System Driver: Data Connectivity Components

http://www.microsoft.com/en-us/download/confirmation.aspx?id=23734

 

 

 

 

 

 

 

 

 

 

 

Column Store Index in Sql Server 2012

The data in dataware house keep growing day by day , data  processing in data mart sometimes becomes unmanageable. The larger point is performance and to keep things at its bench mark we need proactive setup therefore Column Store Index is one of the important facility we can use in table to speed of query performance.

http://www.mssqltips.com/sqlservertip/2586/sql-server-2012-column-store-index-example/

Courtesy above blog post

 

Limitations of SQL Server ColumnStore Indexes

There are several limitations of using SQL Server ColumnStore indexes over Row Store indexes including:

• A table with a ColumnStore Index cannot be updated
• ColumnStore index creation takes more time (1.5 times almost) than creating a B-tree index (on same set of columns) because the data is compressed
• A table can have only one ColumnStore Index and hence you should consider including all columns or at least all those frequently used columns of the table in the index
• A ColumnStore Index can only be non cluster and non unique index; you cannot specify ASC/DESC or INCLUDE clauses
• Not all data types (binary, varbinary, image, text, ntext, varchar(max), nvarchar(max), etc.) are supported
• The definition of a ColumnStore Index cannot be changed with the ALTER INDEX command, you need to drop and create the index or disable it then rebuild it
• You can create a ColumnStore index on a table which has compression enabled, but you cannot specify the compression setting for the column store index
• A ColumnStore Index cannot be created on view
• A ColumnStore Index cannot be created on table which uses features like Replication, Change Tracking, Change Data Capture and Filestream

• CREATE NONCLUSTERED COLUMNSTORE INDEX  
  ON 
  (
   Col1,
   Col2,
   ....
   ....
   Coln
  )
  GO

CA2214 : Do not call overridable methods in constructors Workaround

When you seriously take .net code analysis you may either try to suppress them or try to fix it. There is one such code analysis review if have override or virtual method call in constructor.

 
http://stackoverflow.com/questions/17018569/accessing-an-implemented-abstract-property-in-the-constructor-causes-ca2214-do

http://blogs.msdn.com/b/ericlippert/archive/2008/02/18/why-do-initializers-run-in-the-opposite-order-as-constructors-part-two.aspx

http://blog.duncanworthy.me/swdev/csdotnet/constructor-gotchas-part1/

http://stackoverflow.com/questions/119506/virtual-member-call-in-a-constructor


When an object written in C# is constructed, what happens is that the initializers run in order from the most derived class to the base class, and then constructors run in order from the base class to the most derived class
Problem - Constructor has call to override method.

 

 Workaround :- Add Sealed

 

Powershell Scripting: Automated scripting of database DDL

Make use of Sql server Management Object using Microsoft.sqlserver. This can be added as reference in powershell script as given below. If you are DBA and want to read schema for that matter any automation. You can check the commands within SMO object.

References:

https://www.simple-talk.com/sql/database-administration/automated-script-generation-with-powershell-and-smo/

http://www.sqlservercentral.com/Forums/Topic1167710-1550-1.aspx#bm1168100

http://www.sqlhammer.com/blog/t-sql-command-line-options-part-5-sqlps/

http://stackoverflow.com/questions/483568/how-can-i-automate-the-generate-scripts-task-in-sql-server-management-studio-2

http://www.sqlhammer.com/blog/t-sql-command-line-options-part-4-sqlpsx/

Tips # OneNote Copy Text From Image

How to extract text from image-Use One Note

1. Copy Image to onenote
2. Right click on image select Copy text from Image
3. Paste it.