• Search for:
    14Jul, 2023
    API Penetration Testing Checklist

    API security is an undervalued but crucial aspect of information security. Cyber attacks often target APIs and web applications. To remain secure, organisations must test their systems to find and eliminate any weaknesses.

    Organisations can achieve this with API penetration tests. An ethical hacker (or ‘penetration tester’) will examine your applications using the same techniques that a cyber criminal would use. This gives you a real-world insight into the way someone might compromise your systems.

    Web application and API tests look specifically at security vulnerabilities introduced during the development or implementation of software or websites. There is no single checklist of how exactly the test should be conducted, but there are general guidelines.

    Benefits of API penetration testing

    The primary purpose of an API penetration test is to protect your organisation from data breaches. This is crucial given the increased risk of cyber attacks in recent years. According to a UK government report, 39% of surveyed organisations said they suffered a security breach in the past year.

    By conducting an API penetration test, you will gain a real-world overview of one of the biggest security threats that organisations face. The tester will use their experience to provide guidance on specific risks and advise you on how to address them.

    But penetration tests aren’t only about closing security vulnerabilities. Mitigating the risk of security incidents has several other benefits.

    For instance, you protect brand loyalty and corporate image by reducing the likelihood of a costly and potentially embarrassing incident.

    Penetration testing also helps you demonstrate to clients and potential partners that you take cyber security seriously. This gives you a competitive advantage and could help you land higher-value contracts.

    Most notably, penetration testing is a requirement for several laws and regulations. Article 32 of the GDPR mandates organisations to regularly conduct tests and evaluations.

    This is to assess the effectiveness of the technical and organisational measures employed to protect personal data.

    Likewise, if your organisation is subject to the PCI DSS (Payment Card Industry Data Security Standard), you must conduct external penetration tests at least once per year and after any significant changes are made to your systems.

    API penetration testing checklist

    IT Governance has its own proprietary checklist when conducting API and web application penetration tests.

    The system is modelled on the OSSTMM (Open Source Security Testing Methodology Manual) and the OWASP (Open Web Application Security Project) methodologies.

    A high-level overview of our process is outlined below, with a brief description of what is assessed during each section.

    1. Authentication

    The penetration tester ensures that appropriate mechanisms are in place to confirm a user’s identity. They then review how the authentication process works, using that information to circumvent the authentication mechanism.

    2. Authorisation

    The tester verifies that access to resources is provided only to those permitted to use them.

    Once roles and privileges are understood, the tester tries to bypass the authorization schema. They search for path-traversal vulnerabilities and ways to increase the privileges given to the tester’s user role.

    3. Session management

    The tester ensures that effective session management configurations are implemented. This broadly covers anything from how user authentication is performed to what happens when logging out.

    4. Input validation and sanitisation

    The tester checks that the application appropriately validates and sanitises all input from the user or the environment before using it.

    This includes checking common input validation vulnerabilities such as cross-site scripting and SQL injection, as well as other checks such as file uploads, antivirus detection and file download weaknesses.

    5. Server configuration

    The tester analyses the deployed configuration of the server that hosts the web application. They then verify that the application server has gone through an appropriate hardening process.

    6. Encryption

    The tester assesses encryption security around the transmission of communication. This includes checking for common weaknesses in SSL/TLS configurations and verifying that all sensitive data is being securely transferred.

    7. Information leakage

    The tester reviews the application configuration to ensure that information is not being leaked.

    This is assessed by reviewing configurations and examining how the application communicates to discover any information disclosure that could cause a security risk.

    8. Application workflow

    The tester determines whether the application processes and workflows can be bypassed.

    Tests are conducted to ensure that application workflows cannot be bypassed by either tampering with the parameters or forcefully browsing. This ensures the integrity of the data.

    9. Application logic

    The tester analyses how the application uses, stores, and maintains data. They do this by checking the underlying technology and any mitigating controls that may affect the risk to the application.

    10. Report

    The tester documents their findings. Their reports contain an executive summary, which provides a high-level, non-technical summary of any identified vulnerabilities, alongside a summary of the organisation’s business risks and an overall risk rating.

    It also contains a comprehensive review of testing details, such as the scope of the assessment, descriptions of the vulnerabilities identified and their impact, plus proofs of concept that support the findings.

    Finally, the report provides the tester’s commentary, where they discuss the issues identified and how the vulnerabilities could be linked within an attack chain. This is supplemented with remediation advice and supporting references.

    Resource : https://www.itgovernance.co.uk/blog/api-penetration-testing-checklist

    23May, 2023
    SQL injection

    In this section, we’ll explain what SQL injection (SQLi) is, describe some common examples, explain how to find and exploit various kinds of SQL injection vulnerabilities, and summarize how to prevent SQL injection.

    What is SQL injection (SQLi)?

    SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any other data that the application itself is able to access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application’s content or behavior.

    In some situations, an attacker can escalate a SQL injection attack to compromise the underlying server or other back-end infrastructure, or perform a denial-of-service attack.

    SQL injection

    In this section, we’ll explain what SQL injection (SQLi) is, describe some common examples, explain how to find and exploit various kinds of SQL injection vulnerabilities, and summarize how to prevent SQL injection.

    What is the impact of a successful SQL injection attack?

    A successful SQL injection attack can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization’s systems, leading to a long-term compromise that can go unnoticed for an extended period.

    SQL injection examples

    There are a wide variety of SQL injection vulnerabilities, attacks, and techniques, which arise in different situations. Some common SQL injection examples include:

    Blind SQL injection vulnerabilities

    Many instances of SQL injection are blind vulnerabilities. This means that the application does not return the results of the SQL query or the details of any database errors within its responses. Blind vulnerabilities can still be exploited to access unauthorized data, but the techniques involved are generally more complicated and difficult to perform.

    Depending on the nature of the vulnerability and the database involved, the following techniques can be used to exploit blind SQL injection vulnerabilities:

    • You can change the logic of the query to trigger a detectable difference in the application’s response depending on the truth of a single condition. This might involve injecting a new condition into some Boolean logic, or conditionally triggering an error such as a divide-by-zero.
    • You can conditionally trigger a time delay in the processing of the query, allowing you to infer the truth of the condition based on the time that the application takes to respond.
    • You can trigger an out-of-band network interaction, using OAST techniques. This technique is extremely powerful and works in situations where the other techniques do not. Often, you can directly exfiltrate data via the out-of-band channel, for example by placing the data into a DNS lookup for a domain that you control.

    SQL injection

    In this section, we’ll explain what SQL injection (SQLi) is, describe some common examples, explain how to find and exploit various kinds of SQL injection vulnerabilities, and summarize how to prevent SQL injection.

    SQL injection

    Labs

    If you’re already familiar with the basic concepts behind SQLi vulnerabilities and just want to practice exploiting them on some realistic, deliberately vulnerable targets, you can access all of the labs in this topic from the link below.View all SQL injection labs

    What is SQL injection (SQLi)?

    SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any other data that the application itself is able to access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application’s content or behavior.

    In some situations, an attacker can escalate a SQL injection attack to compromise the underlying server or other back-end infrastructure, or perform a denial-of-service attack.

    https://youtube.com/watch?v=wX6tszfgYp4%3Forigin%3Dhttps%3A

    What is the impact of a successful SQL injection attack?

    A successful SQL injection attack can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization’s systems, leading to a long-term compromise that can go unnoticed for an extended period.

    SQL injection examples

    There are a wide variety of SQL injection vulnerabilities, attacks, and techniques, which arise in different situations. Some common SQL injection examples include:

    Retrieving hidden data

    Consider a shopping application that displays products in different categories. When the user clicks on the Gifts category, their browser requests the URL:https://insecure-website.com/products?category=Gifts

    This causes the application to make a SQL query to retrieve details of the relevant products from the database:SELECT * FROM products WHERE category = 'Gifts' AND released = 1

    This SQL query asks the database to return:

    • all details (*)
    • from the products table
    • where the category is Gifts
    • and released is 1.

    The restriction released = 1 is being used to hide products that are not released. For unreleased products, presumably released = 0.

    The application doesn’t implement any defenses against SQL injection attacks, so an attacker can construct an attack like:https://insecure-website.com/products?category=Gifts'--

    This results in the SQL query:SELECT * FROM products WHERE category = 'Gifts'--' AND released = 1

    The key thing here is that the double-dash sequence -- is a comment indicator in SQL, and means that the rest of the query is interpreted as a comment. This effectively removes the remainder of the query, so it no longer includes AND released = 1. This means that all products are displayed, including unreleased products.

    Going further, an attacker can cause the application to display all the products in any category, including categories that they don’t know about:https://insecure-website.com/products?category=Gifts'+OR+1=1--

    This results in the SQL query:SELECT * FROM products WHERE category = 'Gifts' OR 1=1--' AND released = 1

    The modified query will return all items where either the category is Gifts, or 1 is equal to 1. Since 1=1 is always true, the query will return all items.

    Warning

    Take care when injecting the condition OR 1=1 into a SQL query. Although this may be harmless in the initial context you’re injecting into, it’s common for applications to use data from a single request in multiple different queries. If your condition reaches an UPDATE or DELETE statement, for example, this can result in an accidental loss of data.

    LAB

    APPRENTICESQL injection vulnerability in WHERE clause allowing retrieval of hidden data

    Subverting application logic

    Consider an application that lets users log in with a username and password. If a user submits the username wiener and the password bluecheese, the application checks the credentials by performing the following SQL query:SELECT * FROM users WHERE username = 'wiener' AND password = 'bluecheese'

    If the query returns the details of a user, then the login is successful. Otherwise, it is rejected.

    Here, an attacker can log in as any user without a password simply by using the SQL comment sequence -- to remove the password check from the WHERE clause of the query. For example, submitting the username administrator'-- and a blank password results in the following query:SELECT * FROM users WHERE username = 'administrator'--' AND password = ''

    This query returns the user whose username is administrator and successfully logs the attacker in as that user.

    LAB

    APPRENTICESQL injection vulnerability allowing login bypass

    Retrieving data from other database tables

    In cases where the results of a SQL query are returned within the application’s responses, an attacker can leverage a SQL injection vulnerability to retrieve data from other tables within the database. This is done using the UNION keyword, which lets you execute an additional SELECT query and append the results to the original query.

    For example, if an application executes the following query containing the user input “Gifts”:SELECT name, description FROM products WHERE category = 'Gifts'

    then an attacker can submit the input:' UNION SELECT username, password FROM users--

    This will cause the application to return all usernames and passwords along with the names and descriptions of products.

    Read more

    SQL injection UNION attacks

    Examining the database

    Following initial identification of a SQL injection vulnerability, it is generally useful to obtain some information about the database itself. This information can often pave the way for further exploitation.

    You can query the version details for the database. The way that this is done depends on the database type, so you can infer the database type from whichever technique works. For example, on Oracle you can execute:SELECT * FROM v$version

    You can also determine what database tables exist, and which columns they contain. For example, on most databases you can execute the following query to list the tables:SELECT * FROM information_schema.tables

    Read more

    Examining the database in SQL injection attacksSQL injection cheat sheet

    Blind SQL injection vulnerabilities

    Many instances of SQL injection are blind vulnerabilities. This means that the application does not return the results of the SQL query or the details of any database errors within its responses. Blind vulnerabilities can still be exploited to access unauthorized data, but the techniques involved are generally more complicated and difficult to perform.

    Depending on the nature of the vulnerability and the database involved, the following techniques can be used to exploit blind SQL injection vulnerabilities:

    • You can change the logic of the query to trigger a detectable difference in the application’s response depending on the truth of a single condition. This might involve injecting a new condition into some Boolean logic, or conditionally triggering an error such as a divide-by-zero.
    • You can conditionally trigger a time delay in the processing of the query, allowing you to infer the truth of the condition based on the time that the application takes to respond.
    • You can trigger an out-of-band network interaction, using OAST techniques. This technique is extremely powerful and works in situations where the other techniques do not. Often, you can directly exfiltrate data via the out-of-band channel, for example by placing the data into a DNS lookup for a domain that you control.

    Read more

    Blind SQL injection

    How to detect SQL injection vulnerabilities

    The majority of SQL injection vulnerabilities can be found quickly and reliably using Burp Suite’s web vulnerability scanner.

    SQL injection can be detected manually by using a systematic set of tests against every entry point in the application. This typically involves:

    • Submitting the single quote character ' and looking for errors or other anomalies.
    • Submitting some SQL-specific syntax that evaluates to the base (original) value of the entry point, and to a different value, and looking for systematic differences in the resulting application responses.
    • Submitting Boolean conditions such as OR 1=1 and OR 1=2, and looking for differences in the application’s responses.
    • Submitting payloads designed to trigger time delays when executed within a SQL query, and looking for differences in the time taken to respond.
    • Submitting OAST payloads designed to trigger an out-of-band network interaction when executed within a SQL query, and monitoring for any resulting interactions.

    SQL injection in different parts of the query

    Most SQL injection vulnerabilities arise within the WHERE clause of a SELECT query. This type of SQL injection is generally well-understood by experienced testers.

    But SQL injection vulnerabilities can in principle occur at any location within the query, and within different query types. The most common other locations where SQL injection arises are:

    • In UPDATE statements, within the updated values or the WHERE clause.
    • In INSERT statements, within the inserted values.
    • In SELECT statements, within the table or column name.
    • In SELECT statements, within the ORDER BY clause.

    SQL injection in different contexts

    In all of the labs so far, you’ve used the query string to inject your malicious SQL payload. However, it’s important to note that you can perform SQL injection attacks using any controllable input that is processed as a SQL query by the application. For example, some websites take input in JSON or XML format and use this to query the database.

    These different formats may even provide alternative ways for you to obfuscate attacks that are otherwise blocked due to WAFs and other defense mechanisms. Weak implementations often just look for common SQL injection keywords within the request, so you may be able to bypass these filters by simply encoding or escaping characters in the prohibited keywords. For example, the following XML-based SQL injection uses an XML escape sequence to encode the S character in SELECT:

    Second-order SQL injection

    First-order SQL injection arises where the application takes user input from an HTTP request and, in the course of processing that request, incorporates the input into a SQL query in an unsafe way.

    In second-order SQL injection (also known as stored SQL injection), the application takes user input from an HTTP request and stores it for future use. This is usually done by placing the input into a database, but no vulnerability arises at the point where the data is stored. Later, when handling a different HTTP request, the application retrieves the stored data and incorporates it into a SQL query in an unsafe way.

    Second-order SQL injection often arises in situations where developers are aware of SQL injection vulnerabilities, and so safely handle the initial placement of the input into the database. When the data is later processed, it is deemed to be safe, since it was previously placed into the database safely. At this point, the data is handled in an unsafe way, because the developer wrongly deems it to be trusted.

    Database-specific factors

    Some core features of the SQL language are implemented in the same way across popular database platforms, and so many ways of detecting and exploiting SQL injection vulnerabilities work identically on different types of database.

    However, there are also many differences between common databases. These mean that some techniques for detecting and exploiting SQL injection work differently on different platforms. For example:

    • Syntax for string concatenation.
    • Comments.
    • Batched (or stacked) queries.
    • Platform-specific APIs.
    • Error messages.

    How to prevent SQL injection

    Most instances of SQL injection can be prevented by using parameterized queries (also known as prepared statements) instead of string concatenation within the query.

    The following code is vulnerable to SQL injection because the user input is concatenated directly into the query:String query = "SELECT * FROM products WHERE category = '"+ input + "'"; Statement statement = connection.createStatement(); ResultSet resultSet = statement.executeQuery(query);

    This code can be easily rewritten in a way that prevents the user input from interfering with the query structure:PreparedStatement statement = connection.prepareStatement("SELECT * FROM products WHERE category = ?"); statement.setString(1, input); ResultSet resultSet = statement.executeQuery();

    Parameterized queries can be used for any situation where untrusted input appears as data within the query, including the WHERE clause and values in an INSERT or UPDATE statement. They can’t be used to handle untrusted input in other parts of the query, such as table or column names, or the ORDER BY clause. Application functionality that places untrusted data into those parts of the query will need to take a different approach, such as white-listing permitted input values, or using different logic to deliver the required behavior.

    For a parameterized query to be effective in preventing SQL injection, the string that is used in the query must always be a hard-coded constant, and must never contain any variable data from any origin. Do not be tempted to decide case-by-case whether an item of data is trusted, and continue using string concatenation within the query for cases that are considered safe. It is all too easy to make mistakes about the possible origin of data, or for changes in other code to violate assumptions about what data is tainted.

    Resourse : https://portswigger.net/web-security/sql-injection

    3May, 2023
    Researchers Uncover New BGP Flaws in Popular Internet Routing Protocol Software

    Cybersecurity researchers have uncovered weaknesses in a software implementation of the Border Gateway Protocol (BGP) that could be weaponized to achieve a denial-of-service (DoS) condition on vulnerable BGP peers.

    The three vulnerabilities reside in version 8.4 of FRRouting, a popular open source internet routing protocol suite for Linux and Unix platforms. It’s currently used by several vendors like NVIDIA Cumulus, DENT, and SONiC, posing supply chain risks.

    The discovery is the result of an analysis of seven different implementations of BGP carried out by Forescout Vedere Labs: FRRouting, BIRD, OpenBGPd, Mikrotik RouterOS, Juniper JunOS, Cisco IOS, and Arista EOS.

    BGP is a gateway protocol that’s designed to exchange routing and reachability information between autonomous systems. It’s used to find the most efficient routes for delivering internet traffic.

    The list of three flaws is as follows –

    • CVE-2022-40302 (CVSS score: 6.5) – Out-of-bounds read when processing a malformed BGP OPEN message with an Extended Optional Parameters Length option.
    • CVE-2022-40318 (CVSS score: 6.5) – Out-of-bounds read when processing a malformed BGP OPEN message with an Extended Optional Parameters Length option.
    • CVE-2022-43681 (CVSS score: 6.5) – Out-of-bounds read when processing a malformed BGP OPEN message that abruptly ends with the option length octet.

    The issues “could be exploited by attackers to achieve a DoS condition on vulnerable BGP peers, thus dropping all BGP sessions and routing tables and rendering the peer unresponsive,” the company said in a report shared with The Hacker News.

    “The DoS condition may be prolonged indefinitely by repeatedly sending malformed packets. The main root cause is the same vulnerable code pattern copied into several functions related to different stages of parsing OPEN messages.”

    A threat actor could spoof a valid IP address of a trusted BGP peer or exploit other flaws and misconfigurations to compromise a legitimate peer and then issue a specially-crafted unsolicited BGP OPEN message.

    This is achieved by taking advantage of the fact that “FRRouting begins to process OPEN messages (e.g., decapsulating optional parameters) before it gets a chance to verify the BGP Identifier and ASN fields of the originating router.”

    Forescout has also made available a Python-based open source BGP Fuzzer tool that allows organizations to test the security of the BGP suites used internally as well as find new flaws in BGP implementations.

    “Modern BGP implementations still have low-hanging fruits that can be abused by attackers,” Forescout said. “To mitigate the risk of vulnerable BGP implementations, […] the best recommendation is to patch network infrastructure devices as often as possible.”

    The findings come weeks after ESET found that secondhand routers previously used in business networking environments harbored sensitive data, including corporate credentials, VPN details, cryptographic keys, and other vital customer information.

    “In the wrong hands, the data gleaned from the devices – including customer data, router-to-router authentication keys, application lists, and much more – is enough to launch a cyberattack,” the Slovak cybersecurity firm said.

    Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.

    Resource: https://thehackernews.com/2023/05/researchers-uncover-new-bgp-flaws-in.html

    13Apr, 2023
    SAP releases security updates for two critical-severity flaws

    Enterprise software vendor SAP has released its April 2023 security updates for several of its products, which includes fixes for two critical-severity vulnerabilities that impact the SAP Diagnostics Agent and the SAP BusinessObjects Business Intelligence Platform.

    In total, SAP has released 24 notes, 19 of which concern new issues of varying importance, and five are updates to previous bulletins.

    The three most critical issues fixed this time are:

    • CVE-2023-27267: Insufficient input validation and missing authentication issue impacting the OSCommand Bridge of SAP Diagnostics Agent, version 720, enabling an attacker to execute scripts on connected agents and fully compromise the system. (CVSS v3.1 score: 9.0)
    • CVE-2023-28765: Information disclosure vulnerability impacting SAP BusinessObjects Business Intelligence Platform (Promotion Management), versions 420 and 430, allowing an attacker with basic privileges to gain access to the lcmbiar file and decrypt it. This would enable the attacker to access the platform’s users’ passwords and take over their accounts to perform additional malicious actions. (CVSS v3.1 score: 9.8)
    • CVE-2023-29186: Directory traversal flaw impacting SAP NetWeaver versions 707, 737, 747, and 757, allowing an attacker to upload and overwrite files on the vulnerable SAP server. (CVSS v3.1 score: 8.7)

    The remaining 11 security flaws disclosed in SAP’s latest security bulletin concern low to medium-severity vulnerabilities.

    While such issues are generally not considered a priority for patching, they are still leveraged in attacks, especially as part of complex attack chains, so they should be taken care of nonetheless.

    Speedy patching important

    Hackers are always on the look for critical-severity flaws in widely deployed products like those of SAP, which are commonplace in large corporate networks.

    SAP is the largest ERP vendor in the world, having 24% of the global market share with 425,000 customers in 180 countries. Over 90% of the Forbes Global 2000 uses its ERP, SCM, PLM, and CRM products.

    In February 2022, the US Cybersecurity and Infrastructure Security Agency (CISA) urged admins to patch a set of severe vulnerabilities impacting SAP business apps to prevent data theft, ransomware attacks, and disruption of mission-critical processes and operations.

    In April 2021, threat actors were observed attacking fixed flaws in unpatched SAP systems to gain access to corporate networks.

    Hence, it is crucially important for SAP system administrators to apply the available security patches as soon as possible.

    Resource : https://www.bleepingcomputer.com/news/security/sap-releases-security-updates-for-two-critical-severity-flaws/

    29Mar, 2023
    Top 15 VS Code Extensions to Enhance Your Development Experience

    VS (Visual Studio) Code is one of the most popular standalone source code editors that you can run on macOS, Windows, and Linux. Although it’s just a rich source code editor, you can take its functionality to the next level by using different Visual Studio Code extensions.

    But choosing the best extensions for VS code can be a daunting task, as there are tons of them available in the Visual Studio Marketplace.

    That’s where this guide comes into place. It contains the top 15 Visual Studio Code extensions to make it easy for you to choose the best ones that suit your unique coding needs.

    Best Visual Studio Extensions: Our detailed list

    If you’re a developer, you’d already know how plugins and extensions can help you streamline your development workflow. If you’re looking for the best visual studio code extensions for web development or for general programming purposes, check out the following list.

    Antlers Toolbox

    Features:Syntax highlighting and code suggestions with autocomplete functionality
    Category:Programming Languages, Snippets, and Formatters
    Free version:Yes

    Antlers Toolbox is one of the best VS Code extensions for developing Statamic websites in Antlers templating language. It offers rich language support to make the development process easy.

    With features such as syntax highlighting, code suggestions, auto-completions, automated formatting, and runtime error reporting, it’s an indispensable extension for web developers working with Antlers.

    Key Features:

    • Parser-driving semantic highlighter
    • Basic syntax highlighter
    • Suggestions for modifier signature
    • Contextual auto-suggestions based on different variables like templates, fields, and collections
    • Advanced Antlers formatting
    • Supports core Statamic 3 modifiers, tags, and more

    StackFlex

    Features:Innovative extension to transform copy-paste into save-use
    Category:Other
    Free version:Yes

    StackFlex is a Visual Studio Code extension designed to help developers save and manage their frequently used code snippets.

    You can use it to save and access code snippets from within VS Code, and sync them across all your devices. The browser extension also allows you to save snippets from various websites with just a click of a button.

    Key features:

    • Save and manage code snippets directly within VS Code
    • Sync your snippets across all your devices
    • Save snippets from various websites using the browser extension
    • Use custom names and extensions for your saved snippets
    • Search for saved snippets using keywords and tags

    .NET nanoFramework

    Features:Enables VS Code to deploy, build, and flash C# code for .NET nanoFramework on different devices
    Category:Programming Languages
    Free version:Yes

    The .NET nanoFramework extension for VS Code allows developers to deploy, build, and flash their C# code for the .NET nanoFramework.

    It supports ESP32 and STM32 MCU devices running Visual Studio Code on different operating systems, including Windows, Linux, and macOS.

    In short, this NET nanoFramework is a powerful extension for embedded developers to write managed code applications for embedded devices.

    Key features:

    • Compatible with ESP32 and STM32 MCU devices
    • Supports Windows, Linux, and Mac
    • Provides an easy-to-use user interface for managing nanoFramework projects

    gramex-yaml-snippets

    Features:Features snippets for Gramex
    Category:Snippets
    Free version:Yes

    gramex-yaml-snippets is another powerful Visual Studio Code extension that provides YAML code snippets for Gramex.

    With this extension, you can easily configure sessions, logs, FormHandler, caching assets, and emails. It also supports various authentication methods such as auth_simple, auth_google, and auth_db.

    This extension is useful for developers who are using Gramex to build web applications and want to streamline their configuration process. It can save time and reduce errors by providing auto-complete suggestions for commonly used configuration options.

    Key features:

    • Auto-complete YAML configuration for Gramex endpoints
    • Provides configuration for caching assets, email service, Custom logs, sessions, and more
    • Supports various authentication methods

    Tabnine

    Features:AI-powered code assistant supports all popular programming languages
    Category:Programming Languages and Snippets
    Free version:Yes

    Tabnine is one of the top Visual Studio Code extensions that can help you code faster and more accurately. It’s an AI-powered code completion assistant that’s trained on open-source code and helps you improve your productivity by automating repetitive code writing.

    Tabnine is a great extension for developers who want to save time and increase their productivity by automating repetitive code writing. It can be used by both junior and professional developers working alone or in a team.

    Key features:

    • Trained on open-source code for accurate suggestions
    • AI-powered code completion that suggests the next lines of code
    • Available for multiple programming languages
    • Provide suggestions that are consistent with your team’s best practices

    Prettier

    Features:Comprehensive code formatter
    Category:Formatters
    Free version:Yes

    If you are looking for something that can help you format your code properly, then Prettier is one of the best extensions for VS Code to use.

    It’s a code formatting extension that automatically enforces consistent code styling by parsing your code and reprinting it with its own rules.

    Key features:

    • Automatically formats code to enforce consistent styling
    • Supports many languages
    • Helps you keep your code in a uniform style
    • Easy installation process

    GitLens – Git supercharged

    Features:All-around tool to streamline Git functionality
    Category:SCM Providers
    Free version:Yes

    GitLens is a powerful VS Code extension that enhances the functionality of Git by providing a rich set of features to visualize and understand the code.

    It helps you gain insights into the who, why, and when aspects related to code changes, making it easier to understand the evolution of the codebase. It’s particularly useful for teams working on large, complex projects where code changes can be difficult to track and understand.

    Key features:

    • Provides detailed and interactive visualization of Git repositories
    • Displays blame annotations for each line of code to identify when and by whom it was last changed
    • Shows commit details and code changes right in the editor margin
    • Allows you to quickly navigate through the Git history of a file, line, or code block

    Colorize

    Features:Helps you visualize CSS colors
    Category:Other
    Free version:Yes

    Colorize is a useful extension for developers who work with XML, Stylus, PostCSS, Less, Sass, and CSS.

    It generates colored backgrounds around colors in your CSS file, allowing you to see them in action on the page. This is especially useful for any developer who wants to save time and improve productivity by visualizing the colors they’re using in their code.

    Key features:

    • Instantly visualize CSS colors
    • Generate colored backgrounds for CSS variables
    • Live update of color backgrounds as you make changes in your CSS file

    Code Issue Manager: document & fix issues in your codebase

    Features:Highlight issues in code to improve the codebase health
    Category:Other
    Free version:Yes

    Code Issue Manager by Stepsize is an extension that helps engineering teams document and solve problems that exist in their codebase.

    It elevates your engineering culture to adopt best coding practices and improves the health of your codebase.

    Key features:

    • Track issues across multiple code pieces
    • Document code without adding comments
    • Convert To-Do lists into actionable issues
    • Sync issues with the issue tracker manually or automatically
    • Collaborate on issues within the editor
    • Support for various issue trackers, including Asana, DevOps, Azure, Linear, GitHub, and Jira

    Better Comments

    Features:Code comment manager/organizer
    Category:Formatters
    Free version:Yes

    Better Comments is another excellent VS Code extension that makes comments in your code more colorful and exciting.

    With its customizable settings, you can highlight important notes, reminders, and to-dos. Additionally, the extension also supports a wide range of programming languages and allows you to create your own comment styles.

    Key features:

    • Categorize your annotations into alerts, queries, TODOs, and highlights
    • Style commented-out code to indicate it shouldn’t be there
    • Customize the appearance of your comments with colors and tags
    • Compatible with a variety of programming languages

    CodeSnap

    Features:Takes screenshots of source code in Visual Studio Code
    Category:Other
    Free version:Yes

    CodeSnap is a free VS Code extension designed to make sharing code snippets more visually appealing and easier to understand. It allows you to take screenshots of your source code while keeping the indentation and syntax highlighting intact.

    It also provides a variety of customization options, so you can tailor your code snapshots to your specific preferences.

    Key features:

    • Quickly take and save screenshots of the code
    • Copy code screenshots to your clipboard for easy sharing
    • Customize your code screenshots with a variety of settings, including font size and line numbers
    • Highlight specific lines of code in your screenshots to draw attention to key details

    Peacock

    Features:Changes the color of VS Code Environment
    Category:Other
    Free version:Yes

    Peacock is a great Visual Studio Code extension that allows you to customize the color of your workspace or environment. This can be helpful when you are working with multiple instances of VS Code and want to easily identify the instance you are currently using.

    It offers a range of features and settings to help you make your coding experience truly unique.

    Key features:

    • Customize the color of your workspace or environment
    • Quickly distinguish each instance of VS Code with your preferred colors
    • Unique color settings for VS Code

    Markdown Preview Github Styling

    Features:Changes the built-in markdown preview of VS Code to match GitHub styling
    Category:Other
    Free version:Yes

    Markdown Preview Github Styling enhances the functionality of the built-in markdown preview feature of the VS Code editor. It can change this preview so that it matches GitHub styling.

    This extension is ideal for developers who work extensively with markdown documents and want to see live updates of their work in a side-by-side preview panel.

    Key features:

    • Preview your markdown documents rendered on GitHub
    • Extends the built-in markdown preview feature of Visual Studio Code
    • Supports both light and dark GitHub themes
    • Customize styling using your own CSS

    LambdaTest

    Features:Cross-browser cloud-based testing platform
    Category:Testing
    Free version:Yes

    LambdaTest is a cloud-based testing platform that enables organizations to redefine their testing strategies.

    It allows you to perform live-interactive cross-browser testing of your public and locally hosted web applications and websites directly within the VS Code editor.

    Key features:

    • Performs cross-browser real-time testing
    • Supports more than 3,000 operating systems, real devices, and browsers
    • Trigger testing within the VS Code Editor
    • Perform mobile web testing on iOS simulators and Android emulators
    • Geolocation testing across various browsers
    • Mark any UI observation as a bug
    • Inbuilt issue tracker

    Bookmarks

    Features:Bookmarks specific code areas
    Category:Other
    Free version:Yes

    Bookmarks is a VS Code extension that allows you to mark specific areas of your code with bookmarks. This functionality makes it easier to navigate and jump back and forth between different parts of your code.

    You can add and remove bookmarks, add labels, and even select regions of code between bookmarked areas. The extension also includes a dedicated sidebar where you can view all of your bookmarks at a glance.

    Key features:

    • Add and remove bookmarks in your code
    • Add labels to bookmarks for easier identification
    • Select regions of code between bookmarked areas
    • Dedicated sidebar for viewing all bookmarked areas
    • Technical support available for any questions or issues
    • Supports virtual workspaces

    Best Visual Studio Code Extensions: Final recommendations

    We have highlighted the best Visual Studio Code extensions in this article that can help you become a better coder. Here’s a quick overview of these extensions to help you narrow down your search.

    • Antlers Toolbox – a Visual Studio Code extension that provides rich language to build Statamic websites in Antlers templating language.
    • StackFlex – an extension that allows you to save code snippets locally from different websites, and sync with VS Code to use them in your projects in the future.
    • .NET nanoFramework – a tool that enables you to build, deploy, and flash C# code for .NET nanoFramework on ESP32 or STM32 MCU devices, regardless of the platform.
    • gramex-yaml-snippets – a VS Code extension that provides YAML snippets for Gramex, which is a web app development framework.
    • Tabnine – an AI-powered code completion extension that suggests and completes entire lines of code.
    • Prettier – a code formatter that automatically formats code to a standardized style, whenever you save it.
    • GitLens – Git supercharged – a powerful extension that enhances Git capabilities by providing rich information about code authors, commit history, and even code changes from within the VS Code editor.
    • Colorize – a syntax highlighting extension that colorizes source code in a variety of programming languages.
    • Code Issue Manager – a tool to document and solve issues in a codebase using custom-defined rules.
    • Better Comments – a VS Code extension that enhances code comments by adding color coding and various annotation styles.
    • CodeSnap – a Visual Studio Code extension to create screenshots of your code effortlessly.
    • Peacock – an extension that allows you to change the color of the VS Code environment or workspace.
    • Markdown Preview Github Styling – a markdown preview extension that supports light and dark GitHub themes and lets you preview your markdown as it would be rendered on GitHub.
    • LambdaTest – a cross-browser cloud-based testing platform that allows for live-interactive testing of public and locally hosted web applications and websites.
    • Bookmarks – a VS Code extension that allows you to bookmark specific areas of your code for easy navigation.

    Resource : https://cybernews.com/resources/top-vs-code-extensions-to-enhance-your-development-experience/