TryHackMe Advent of Cyber

I posted that I was thinking about the AdventOfCode this year, but wasn’t sure I’d spend the time. Someone then posted a link to the TryHackMe advent calendar.

I decided to give it a try.

There’s a fairly long (10min) video intro and then you sign up.

Day 1

One of the good things was that the video has some spoilers to help you solve the challenge. If you skipped the video, watch it now. Or try.

There are three questions we need answered, and we then have to fool the AI/ML chatbot. The video shows how, but essentially you need an email address, a server room password and a project name.

The interesting thing is this shows how a poorly secured and trained chatbot might disclose this information. For the email address, you just ask. For the password, you need to find an employee’s name and then tell the chatbot you’re that person and need the password. It seems silly, but I bet this works on some chatbots people have created with wizards or templates and not secured or limited the training data.

The last one is interesting, you ask the machine to go into maintenance mode and you get the name of a project. Getting into the maintenance side of applications or mainframes used to be a way to attack them. Unfortunately, too many people didn’t secure many early systems and this was too easy.

Day 2

Day 2 is about using Jupyter notebooks. A good portion of the tutorial is helping you understand how notebooks work. Hopefully you’ve read my article on notebooks. If not, this helps you figure out how to use them. It also has a short tutorial on some python that you use to perform data analysis on a csv. While many of us might like to do this in SQL, the experience in python isn’t bad.

This ends up helping you understand how to count, summarize, and group data in python.

Day 3

This day was interesting. Now we are learning about some security tools. In this case, we learn about hydra, which is a tool to brute force logins against a web page. This is a fantastic tutorial that should teach you that unlimited retries on a page without some timer is a bad idea. This should also help you understand that you need to track failed logins and do something about them, especially from weird IPs.

Day 4

Continuing on, we learn how to use cewl to create customized wordlists and then use those to brute force in a smarter way.

Again, scary for a non-security person. These tools are likely good for security folks, but terrifying in that perhaps criminals use them every day.

Summary

The first few days of the challenge were interesting and it was neat to spend some time thinking about the world from a cybersecurity point of view.

Posted in Blog | Tagged , , | Comments Off on TryHackMe Advent of Cyber

The Stagnant Career

Do you feel stagnant in your career? Or maybe the better question is do you care if you feel stagnant in your career?

You might need to define what that means to you, as what might feel stagnant to one person could be comfortable to another. Apparently, there was a study of tech professionals, who despite a tight labor market, are citing lack of salary increases and dim promotion prospects as reasons to leave their jobs. The survey was across a number of larger technology companies, and likely answered by more talented employees. After all, good talent can usually find jobs and is less worried about leaving. Less talented people usually cling to their jobs.

A lack of salary increase could be a problem. Everyone, or most everyone, wants regular raises. However, depending on where your salary bracket is and your living expenses, you might not rate this as a very important criterion for sticking with a job. Someone making USD$40,000 might be more concerned about a raise every year than someone making USD$200,000, but perhaps not.

Having a career progression was more important to me at 30 than it is after 50. Again, the varies among people, but I find a lot of people like their jobs and don’t really want to change. Many of them would likely be happy to keep working at their level as long as they can get raises. I see people complaining about their current position when they’ve bumped up against a salary limit for that position, but otherwise, they’re satisfied.

The work matters. I do think there are plenty of people who are unhappy with the work they do and want to be challenged, or at least interested, in the work. At the same time, lots of people are happy to just do a minimal variety of work day after day. I think this is why I encounter lots of people who seem to have 4-6 months of experience repeated 10+ times.

My view is that you ought to make your career what you want, and that means actively managing it. Spend time thinking about what you want, ask others about their work, and make plans to move in the direction that matters to you. Implement those plans and find a balance between advancing your skills and living your life. It’s easy to do too much of one or the other, but often that’s not the problem, it’s the motivation and effort to actually improve yourself.

I can’t tell you how to structure you career or what to learn or what to improve. You have to decide what is interesting to you and what fits in your life, and then make an effort to move in that direction. Sharpen your saw, improve your craft, and learn those soft skills that help you work with others. That’s how you find the career you want, which will never be stagnant.

Note: We do have a career forum on SQL Server Central. If you want advice or have questions, post something and I (or someone) is happy to answer.

Steve Jones

Listen to the podcast at Libsyn, Spotify, or iTunes.

Posted in Editorial | Tagged | Comments Off on The Stagnant Career

Removing a PowerShell Array Element–#SQLNewBlogger

I saw an article on this and realized I had no idea how to do this, so I decided to practice a bit. I don’t work with PoSh arrays a lot, but with more and more DevOps work needing complex scripting, PoSh is a better environment for me than bash. At least for now.

This post looks at the basics of creating an array and then removing elements.

Another post for me that is simple and hopefully serves as an example for people trying to get blogging as #SQLNewBloggers.

Creating a PoSh Array

Creating an array in PowerShell is relatively easy. I use a variable and the @ sign, enclosing the elements inside parenthesis with comma separation. In code, that looks like this:

$servers = @("server1", "server2", "server3")

or this:

$numbers = @(1,2,3,4,5,6,7,8,9,10)

If I were to reference an array, I’d get results like this:

PS E:\Documents\git\sqlsatwebsite> $servers
server1
server2
server3

PS E:\Documents\git\sqlsatwebsite> $numbers[2]
3


As you can see, I can get all elements or a single element with an index inside brackets. Note that the array is zero indexed as the index of 2 returns the third element.

In code, I might use other variables to represent the index or maybe to store the results of an array. If I were trying to brute force the removal of an element, I might decide to copy items one at a time (iterating through the index and skipping the copy if I reached an item to skip.

Removing an Element – Kind of

The way to remove this is deceptively simple. The article referenced above shows the easy way, which is to set an element to $null. I’d have never thought of that, as I’d assume this would leave the element, but change the key.

If I want to remove 5, I’d set $numbers[4]=$Null. Crazy, but let’s see this work. First, I’ll iterate the array, printing each index and the value with this code:

for ($i = 0; $i -lt $numbers.Length; $i++) {

Write-Host $i : $numbers[$i]


}

When I run this, I see these results:

0 : 1
1 : 2
2 : 3
3 : 4
4 : 5
5 : 6
6 : 7
7 : 8
8 : 9
9 : 10

Now, I’ll run this:

$numbers[4]=$null

Now we re-run the iteration and see these results:

0 : 1
1 : 2
2 : 3
3 : 4
4 :
5 : 6
6 : 7
7 : 8
8 : 9
9 : 10

Hmmm, the element is gone and isn’t. Nothing has moved, and in fact, the value of 6 remains in index 5. If I try to get element at index 4, I get this:

2023-12-01 13_34_55-Window

It’s not there, but the spot is held. That’s somewhat what I’d expect.

Removing an Item – The Better Way

PowerShell has a lot of flexibility in how variables work and how queries work. I found another blog that helped me understand a few things and experiment. Look at this code:

$numbers = $numbers | Where-Object { $_ -ne 5}

If I run my iterator on $numbers now I see:

0 : 1
1 : 2
2 : 3
3 : 4
4 : 6
5 : 7
6 : 8
7 : 9
8 : 10

That works much better, since I create a new array.

Arrays in PowerShell are funny things, and the docs show some of the methods available don’t change the size of an array, they just operate on it. There isn’t a remove method, which is interesting. There is a Remove-Item cmdlet, but even the docs say assigning $null is faster. However, it doesn’t get the indexing right.

If you have a better method, let me know.

SQL New Blogger

I spent about 10-15 minutes experimenting in PowerShell on various code elements trying to understand how different methods change the array. I read some docs, and ended up taking another 15 minutes to write this post and copy over some code.

This was fun, but it also showcased some learning and methodology. You could easily do the same thing, with PowerShell, T-SQL, or any other coding or scripting you do at work. Show how you experiment and learn.

Posted in Blog | Tagged , , | Comments Off on Removing a PowerShell Array Element–#SQLNewBlogger

Be Careful with Missing Index Requests

One of the things that has been interesting to watch over time is how the SQL Server platform has expanded the amount of information that we get back about the performance of the query optimizer and query processor. While it’s not perfect, and there is room for improvement, the advances made with intelligent query processing are helping many systems run faster. Not all queries, but some.

As I’ve done a little work on other platforms, there are ways to look for potential missing indexes in PostgreSQL and MySQL, but these aren’t built into tools, nor are they easily accessible to developers or DBAs. There’s work to be done on many platforms, though I’m not sure if there is more work than required in SQL Server. On all these platforms, you need to dig into queries and understand why they are slow, though the tooling for SQL Server, with graphical plans in SSMS (or with Plan Explorer) can make the job easier.

One thing SQL Server does is provide missing index recommendations in the query plan. You can find information on this in the docs, but you should make sure you read the limitations section. The recommendations returned should not just be run. I should repeat that for junior DBAs, accidental DBAs, and developers:

DO NOT JUST RUN THE MISSING INDEX RECOMMENDATIONS WITHOUT TESTING LOTS OF QUERIES.

I hate using all caps, but that is important. As an example of why, watch this short video from Erik Darling, where he shows that the simplistic view of the missing index is helpful, but not as helpful as it can be. In case that’s not enough, there are other issues that Brent Ozar, Phil Factor, and Aaron Bertrand share some of the problems they’ve found.

There is a wealth of information that is available about queries in SQL Server and how they are processed. It will help you in your career to learn more about performance tuning and how to evaluate queries. We have articles here, there are more on Simple Talk, and Erik Darling produces information every week and also has training to help you learn to tune queries better. There are plenty of others that will help teach you as well.

Maybe the best benefit of learning about tuning is that you can learn to write better queries the first time, which means no rework, no effort responding to complaints, and a cheaper bill if you move into the cloud. That might be something you point out to your boss and ask him or her to fund a little education to help you and your employer.

Steve Jones

Listen to the podcast at Libsyn, Spotify, or iTunes.

Posted in Editorial | Tagged , | Comments Off on Be Careful with Missing Index Requests