Need to quote database table names

[justinclift]

An interesting SQL error is showing on the dev1 webUI console:

2017/04/10 12:26:34 Error when preparing statement for database: near "-": syntax error (SELECT * FROM chat-histories LIMIT ?) (SQL logic error or missing database)

At a first guess, without proper investigation yet, the bug is probably just a matter of adding quotes to the table name clauses. Shouldn't be too hard to check, fix, verify.

[justinclift]

Yep, just tested it here with a hyphenated table name in a dummy database. Same error.

[justinclift]

Fixed. There's not many places (so far) we run SQLite queries, so it was pretty easy. 😄

[justinclift]

As @MKleusberg pointed out, we should handle the case where there is a quote character (") in the SQLite table name. Otherwise we're open to potentially being remotely exploited.

We don't (presently) allow quote characters, which should save us from having that particular problem. But adding the check anyway would be good practise, just to be on the safe side. Defence in depth and all... 😄

[MKleusberg]

Cool, that fixes this for now. But yeah, it's still a good idea to fix this at the root of the problem. And besides, from my experience with DB4S I can say that for every possible character there probably is a database using it in some table or column name 😉 So I'm pretty sure sooner or later somebody is going to open an issue with a request for supporting quote characters in table names.

[justinclift]

Interestingly, the console on the dev1 box is showing a SQL error when it tried to parse your injection test database.

In theory it should have caught it earlier, but didn't. I'll investigate that properly tomorrow to find out why. 😄

In the meantime, I've made your database private just to be on the safe side.

... we'll probably need to start adding unit tests soon too. Not looking forward to that really. 😉

[justinclift]

Wasn't comfortable leaving such a bug live overnight, so looked into it. We were missing a validation check for when the table name is pulled automatically out of the database. Just added one (tested), and pushed to dev1.

The real solution will be to correctly handle quote characters in table names though. 😄

[justinclift]

This might be useful for later investigation too:

    https://github.com/dvyukov/go-fuzz

Thanks to @gedw99 for pointing it out. 😄

[MKleusberg]

One more useful tool:
http://sqlmap.org/

[justinclift]

Yep, that does look nifty. 😄

[justinclift]

Heh Heh Heh, all kinds of interesting things showing up in the log with sqlmap.org as the identifier.

Guess what I'm investigating tomorrow? 😁

[justinclift]

Looking at this now. The log is showing this (repeated twice though):

2017/04/11 16:43:08 Invalid database version number: strconv.ParseInt: parsing "1(.,(.'.\"))": invalid syntax
2017/04/11 16:43:08 Invalid database version number: strconv.ParseInt: parsing "1'dcGLlt<'\">DmOBum": invalid syntax
2017/04/11 16:43:09 Invalid database version number: strconv.ParseInt: parsing "1) AND 3514=3816 AND (1142=1142": invalid syntax
2017/04/11 16:43:09 Invalid database version number: strconv.ParseInt: parsing "1) AND 2132=2132 AND (6585=6585": invalid syntax
2017/04/11 16:43:09 Invalid database version number: strconv.ParseInt: parsing "1 AND 8803=8279": invalid syntax
2017/04/11 16:43:10 Invalid database version number: strconv.ParseInt: parsing "1 AND 2132=2132": invalid syntax
2017/04/11 16:43:10 Invalid database version number: strconv.ParseInt: parsing "1 AND 3866=3273-- OLZf": invalid syntax
2017/04/11 16:43:10 Invalid database version number: strconv.ParseInt: parsing "1 AND 2132=2132-- WluS": invalid syntax
2017/04/11 16:43:11 Invalid database version number: strconv.ParseInt: parsing "1') AND 5586=5644 AND ('pADX'='pADX": invalid syntax
2017/04/11 16:43:11 Invalid database version number: strconv.ParseInt: parsing "1') AND 2132=2132 AND ('Hchn'='Hchn": invalid syntax
2017/04/11 16:43:11 Invalid database version number: strconv.ParseInt: parsing "1' AND 9791=9954 AND 'xQMG'='xQMG": invalid syntax
2017/04/11 16:43:12 Invalid database version number: strconv.ParseInt: parsing "1' AND 2132=2132 AND 'fXhv'='fXhv": invalid syntax
2017/04/11 16:43:12 Invalid database version number: strconv.ParseInt: parsing "1%' AND 3302=7307 AND '%'='": invalid syntax
2017/04/11 16:43:12 Invalid database version number: strconv.ParseInt: parsing "1%' AND 2132=2132 AND '%'='": invalid syntax
2017/04/11 16:43:13 Invalid database version number: strconv.ParseInt: parsing "(SELECT (CASE WHEN (4757=3483) THEN 4757 ELSE 4757*(SELECT 4757 FROM INFORMATION_SCHEMA.PLUGINS) END))": invalid syntax
2017/04/11 16:43:13 Invalid database version number: strconv.ParseInt: parsing "(SELECT (CASE WHEN (4815=4815) THEN 4815 ELSE 4815*(SELECT 4815 FROM INFORMATION_SCHEMA.PLUGINS) END))": invalid syntax
2017/04/11 16:43:13 Invalid database version number: strconv.ParseInt: parsing "1) AND (SELECT 6811 FROM(SELECT COUNT(*),CONCAT(0x716a716a71,(SELECT (ELT(6811=6811,1))),0x71717a7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND (9663=9663": invalid syntax
2017/04/11 16:43:14 Invalid database version number: strconv.ParseInt: parsing "1 AND (SELECT 6811 FROM(SELECT COUNT(*),CONCAT(0x716a716a71,(SELECT (ELT(6811=6811,1))),0x71717a7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)": invalid syntax
2017/04/11 16:43:14 Invalid database version number: strconv.ParseInt: parsing "1 AND (SELECT 6811 FROM(SELECT COUNT(*),CONCAT(0x716a716a71,(SELECT (ELT(6811=6811,1))),0x71717a7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- OaZZ": invalid syntax
2017/04/11 16:43:14 Invalid database version number: strconv.ParseInt: parsing "1') AND (SELECT 6811 FROM(SELECT COUNT(*),CONCAT(0x716a716a71,(SELECT (ELT(6811=6811,1))),0x71717a7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND ('ZPZS'='ZPZS": invalid syntax
2017/04/11 16:43:15 Invalid database version number: strconv.ParseInt: parsing "1' AND (SELECT 6811 FROM(SELECT COUNT(*),CONCAT(0x716a716a71,(SELECT (ELT(6811=6811,1))),0x71717a7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'gMjd'='gMjd": invalid syntax
2017/04/11 16:43:15 Invalid database version number: strconv.ParseInt: parsing "1%' AND (SELECT 6811 FROM(SELECT COUNT(*),CONCAT(0x716a716a71,(SELECT (ELT(6811=6811,1))),0x71717a7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND '%'='": invalid syntax
2017/04/11 16:43:15 Invalid database version number: strconv.ParseInt: parsing "1) AND 9669=CAST((CHR(113)||CHR(106)||CHR(113)||CHR(106)||CHR(113))||(SELECT (CASE WHEN (9669=9669) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(113)||CHR(122)||CHR(122)||CHR(113)) AS NUMERIC) AND (5377=5377": invalid syntax
2017/04/11 16:43:16 Invalid database version number: strconv.ParseInt: parsing "1 AND 9669=CAST((CHR(113)||CHR(106)||CHR(113)||CHR(106)||CHR(113))||(SELECT (CASE WHEN (9669=9669) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(113)||CHR(122)||CHR(122)||CHR(113)) AS NUMERIC)": invalid syntax
2017/04/11 16:43:16 Invalid database version number: strconv.ParseInt: parsing "1 AND 9669=CAST((CHR(113)||CHR(106)||CHR(113)||CHR(106)||CHR(113))||(SELECT (CASE WHEN (9669=9669) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(113)||CHR(122)||CHR(122)||CHR(113)) AS NUMERIC)-- mwXq": invalid syntax
2017/04/11 16:43:16 Invalid database version number: strconv.ParseInt: parsing "1') AND 9669=CAST((CHR(113)||CHR(106)||CHR(113)||CHR(106)||CHR(113))||(SELECT (CASE WHEN (9669=9669) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(113)||CHR(122)||CHR(122)||CHR(113)) AS NUMERIC) AND ('jMzv'='jMzv": invalid syntax
2017/04/11 16:43:17 Invalid database version number: strconv.ParseInt: parsing "1' AND 9669=CAST((CHR(113)||CHR(106)||CHR(113)||CHR(106)||CHR(113))||(SELECT (CASE WHEN (9669=9669) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(113)||CHR(122)||CHR(122)||CHR(113)) AS NUMERIC) AND 'oXpr'='oXpr": invalid syntax
2017/04/11 16:43:17 Invalid database version number: strconv.ParseInt: parsing "1%' AND 9669=CAST((CHR(113)||CHR(106)||CHR(113)||CHR(106)||CHR(113))||(SELECT (CASE WHEN (9669=9669) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(113)||CHR(122)||CHR(122)||CHR(113)) AS NUMERIC) AND '%'='": invalid syntax
2017/04/11 16:43:18 Invalid database version number: strconv.ParseInt: parsing "1) AND 3805 IN (SELECT (CHAR(113)+CHAR(106)+CHAR(113)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (3805=3805) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(122)+CHAR(113))) AND (5185=5185": invalid syntax
2017/04/11 16:43:18 Invalid database version number: strconv.ParseInt: parsing "1 AND 3805 IN (SELECT (CHAR(113)+CHAR(106)+CHAR(113)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (3805=3805) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(122)+CHAR(113)))": invalid syntax
2017/04/11 16:43:18 Invalid database version number: strconv.ParseInt: parsing "1 AND 3805 IN (SELECT (CHAR(113)+CHAR(106)+CHAR(113)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (3805=3805) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(122)+CHAR(113)))-- TsdY": invalid syntax
2017/04/11 16:43:19 Invalid database version number: strconv.ParseInt: parsing "1') AND 3805 IN (SELECT (CHAR(113)+CHAR(106)+CHAR(113)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (3805=3805) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(122)+CHAR(113))) AND ('tVEC'='tVEC": invalid syntax
2017/04/11 16:43:19 Invalid database version number: strconv.ParseInt: parsing "1' AND 3805 IN (SELECT (CHAR(113)+CHAR(106)+CHAR(113)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (3805=3805) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(122)+CHAR(113))) AND 'WPFu'='WPFu": invalid syntax
2017/04/11 16:43:19 Invalid database version number: strconv.ParseInt: parsing "1%' AND 3805 IN (SELECT (CHAR(113)+CHAR(106)+CHAR(113)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (3805=3805) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(122)+CHAR(113))) AND '%'='": invalid syntax
2017/04/11 16:43:20 Invalid database version number: strconv.ParseInt: parsing "1) AND 6774=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(106)||CHR(113)||CHR(106)||CHR(113)||(SELECT (CASE WHEN (6774=6774) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(113)||CHR(122)||CHR(122)||CHR(113)||CHR(62))) FROM DUAL) AND (2273=2273": invalid syntax
2017/04/11 16:43:20 Invalid database version number: strconv.ParseInt: parsing "1 AND 6774=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(106)||CHR(113)||CHR(106)||CHR(113)||(SELECT (CASE WHEN (6774=6774) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(113)||CHR(122)||CHR(122)||CHR(113)||CHR(62))) FROM DUAL)": invalid syntax
2017/04/11 16:43:20 Invalid database version number: strconv.ParseInt: parsing "1 AND 6774=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(106)||CHR(113)||CHR(106)||CHR(113)||(SELECT (CASE WHEN (6774=6774) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(113)||CHR(122)||CHR(122)||CHR(113)||CHR(62))) FROM DUAL)-- IWws": invalid syntax
2017/04/11 16:43:21 Invalid database version number: strconv.ParseInt: parsing "1') AND 6774=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(106)||CHR(113)||CHR(106)||CHR(113)||(SELECT (CASE WHEN (6774=6774) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(113)||CHR(122)||CHR(122)||CHR(113)||CHR(62))) FROM DUAL) AND ('jFHz'='jFHz": invalid syntax
2017/04/11 16:43:21 Invalid database version number: strconv.ParseInt: parsing "1' AND 6774=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(106)||CHR(113)||CHR(106)||CHR(113)||(SELECT (CASE WHEN (6774=6774) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(113)||CHR(122)||CHR(122)||CHR(113)||CHR(62))) FROM DUAL) AND 'QkmT'='QkmT": invalid syntax
2017/04/11 16:43:21 Invalid database version number: strconv.ParseInt: parsing "1%' AND 6774=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(106)||CHR(113)||CHR(106)||CHR(113)||(SELECT (CASE WHEN (6774=6774) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(113)||CHR(122)||CHR(122)||CHR(113)||CHR(62))) FROM DUAL) AND '%'='": invalid syntax
2017/04/11 16:43:22 Invalid database version number: strconv.ParseInt: parsing "(SELECT 9041 FROM(SELECT COUNT(*),CONCAT(0x716a716a71,(SELECT (ELT(9041=9041,1))),0x71717a7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)": invalid syntax
2017/04/11 16:43:22 Invalid database version number: strconv.ParseInt: parsing "(SELECT CONCAT(0x716a716a71,(SELECT (ELT(3928=3928,1))),0x71717a7a71))": invalid syntax
2017/04/11 16:43:22 Invalid database version number: strconv.ParseInt: parsing "(SELECT (CHR(113)||CHR(106)||CHR(113)||CHR(106)||CHR(113))||(SELECT (CASE WHEN (2636=2636) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(113)||CHR(122)||CHR(122)||CHR(113)))": invalid syntax
2017/04/11 16:43:23 Invalid database version number: strconv.ParseInt: parsing "(SELECT CHAR(113)+CHAR(106)+CHAR(113)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (4565=4565) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(122)+CHAR(113))": invalid syntax
2017/04/11 16:43:23 Invalid database version number: strconv.ParseInt: parsing "1);SELECT PG_SLEEP(5)--": invalid syntax
2017/04/11 16:43:23 Invalid database version number: strconv.ParseInt: parsing "1;SELECT PG_SLEEP(5)--": invalid syntax
2017/04/11 16:43:24 Invalid database version number: strconv.ParseInt: parsing "1');SELECT PG_SLEEP(5)--": invalid syntax
2017/04/11 16:43:24 Invalid database version number: strconv.ParseInt: parsing "1';SELECT PG_SLEEP(5)--": invalid syntax
2017/04/11 16:43:24 Invalid database version number: strconv.ParseInt: parsing "1%';SELECT PG_SLEEP(5)--": invalid syntax
2017/04/11 16:43:25 Invalid database version number: strconv.ParseInt: parsing "1);WAITFOR DELAY '0:0:5'--": invalid syntax
2017/04/11 16:43:25 Invalid database version number: strconv.ParseInt: parsing "1;WAITFOR DELAY '0:0:5'--": invalid syntax
2017/04/11 16:43:25 Invalid database version number: strconv.ParseInt: parsing "1');WAITFOR DELAY '0:0:5'--": invalid syntax
2017/04/11 16:43:26 Invalid database version number: strconv.ParseInt: parsing "1';WAITFOR DELAY '0:0:5'--": invalid syntax
2017/04/11 16:43:26 Invalid database version number: strconv.ParseInt: parsing "1%';WAITFOR DELAY '0:0:5'--": invalid syntax
2017/04/11 16:43:27 Invalid database version number: strconv.ParseInt: parsing "1);SELECT DBMS_PIPE.RECEIVE_MESSAGE(CHR(109)||CHR(85)||CHR(104)||CHR(82),5) FROM DUAL--": invalid syntax
2017/04/11 16:43:27 Invalid database version number: strconv.ParseInt: parsing "1;SELECT DBMS_PIPE.RECEIVE_MESSAGE(CHR(109)||CHR(85)||CHR(104)||CHR(82),5) FROM DUAL--": invalid syntax
2017/04/11 16:43:27 Invalid database version number: strconv.ParseInt: parsing "1');SELECT DBMS_PIPE.RECEIVE_MESSAGE(CHR(109)||CHR(85)||CHR(104)||CHR(82),5) FROM DUAL--": invalid syntax
2017/04/11 16:43:28 Invalid database version number: strconv.ParseInt: parsing "1';SELECT DBMS_PIPE.RECEIVE_MESSAGE(CHR(109)||CHR(85)||CHR(104)||CHR(82),5) FROM DUAL--": invalid syntax
2017/04/11 16:43:28 Invalid database version number: strconv.ParseInt: parsing "1%';SELECT DBMS_PIPE.RECEIVE_MESSAGE(CHR(109)||CHR(85)||CHR(104)||CHR(82),5) FROM DUAL--": invalid syntax
2017/04/11 16:43:28 Invalid database version number: strconv.ParseInt: parsing "1) AND SLEEP(5) AND (8373=8373": invalid syntax
2017/04/11 16:43:29 Invalid database version number: strconv.ParseInt: parsing "1 AND SLEEP(5)": invalid syntax
2017/04/11 16:43:29 Invalid database version number: strconv.ParseInt: parsing "1 AND SLEEP(5)-- ZgUS": invalid syntax
2017/04/11 16:43:29 Invalid database version number: strconv.ParseInt: parsing "1') AND SLEEP(5) AND ('Ixir'='Ixir": invalid syntax
2017/04/11 16:43:30 Invalid database version number: strconv.ParseInt: parsing "1' AND SLEEP(5) AND 'eOWf'='eOWf": invalid syntax
2017/04/11 16:43:30 Invalid database version number: strconv.ParseInt: parsing "1%' AND SLEEP(5) AND '%'='": invalid syntax
2017/04/11 16:43:30 Invalid database version number: strconv.ParseInt: parsing "1) AND 8181=(SELECT 8181 FROM PG_SLEEP(5)) AND (1694=1694": invalid syntax
2017/04/11 16:43:31 Invalid database version number: strconv.ParseInt: parsing "1 AND 8181=(SELECT 8181 FROM PG_SLEEP(5))": invalid syntax
2017/04/11 16:43:31 Invalid database version number: strconv.ParseInt: parsing "1 AND 8181=(SELECT 8181 FROM PG_SLEEP(5))-- HFBn": invalid syntax
2017/04/11 16:43:31 Invalid database version number: strconv.ParseInt: parsing "1') AND 8181=(SELECT 8181 FROM PG_SLEEP(5)) AND ('fGgO'='fGgO": invalid syntax
2017/04/11 16:43:32 Invalid database version number: strconv.ParseInt: parsing "1' AND 8181=(SELECT 8181 FROM PG_SLEEP(5)) AND 'isie'='isie": invalid syntax
2017/04/11 16:43:32 Invalid database version number: strconv.ParseInt: parsing "1%' AND 8181=(SELECT 8181 FROM PG_SLEEP(5)) AND '%'='": invalid syntax
2017/04/11 16:43:32 Invalid database version number: strconv.ParseInt: parsing "1) WAITFOR DELAY '0:0:5' AND (1354=1354": invalid syntax
2017/04/11 16:43:33 Invalid database version number: strconv.ParseInt: parsing "1 WAITFOR DELAY '0:0:5'": invalid syntax
2017/04/11 16:43:33 Invalid database version number: strconv.ParseInt: parsing "1 WAITFOR DELAY '0:0:5'-- xgOm": invalid syntax
2017/04/11 16:43:33 Invalid database version number: strconv.ParseInt: parsing "1') WAITFOR DELAY '0:0:5' AND ('FVZQ'='FVZQ": invalid syntax
2017/04/11 16:43:34 Invalid database version number: strconv.ParseInt: parsing "1' WAITFOR DELAY '0:0:5' AND 'ESwj'='ESwj": invalid syntax
2017/04/11 16:43:34 Invalid database version number: strconv.ParseInt: parsing "1%' WAITFOR DELAY '0:0:5' AND '%'='": invalid syntax
2017/04/11 16:43:34 Invalid database version number: strconv.ParseInt: parsing "1) AND 7085=DBMS_PIPE.RECEIVE_MESSAGE(CHR(99)||CHR(82)||CHR(87)||CHR(110),5) AND (9266=9266": invalid syntax
2017/04/11 16:43:35 Invalid database version number: strconv.ParseInt: parsing "1 AND 7085=DBMS_PIPE.RECEIVE_MESSAGE(CHR(99)||CHR(82)||CHR(87)||CHR(110),5)": invalid syntax
2017/04/11 16:43:35 Invalid database version number: strconv.ParseInt: parsing "1 AND 7085=DBMS_PIPE.RECEIVE_MESSAGE(CHR(99)||CHR(82)||CHR(87)||CHR(110),5)-- UZKG": invalid syntax
2017/04/11 16:43:35 Invalid database version number: strconv.ParseInt: parsing "1') AND 7085=DBMS_PIPE.RECEIVE_MESSAGE(CHR(99)||CHR(82)||CHR(87)||CHR(110),5) AND ('WdIc'='WdIc": invalid syntax
2017/04/11 16:43:36 Invalid database version number: strconv.ParseInt: parsing "1' AND 7085=DBMS_PIPE.RECEIVE_MESSAGE(CHR(99)||CHR(82)||CHR(87)||CHR(110),5) AND 'wAFJ'='wAFJ": invalid syntax
2017/04/11 16:43:36 Invalid database version number: strconv.ParseInt: parsing "1%' AND 7085=DBMS_PIPE.RECEIVE_MESSAGE(CHR(99)||CHR(82)||CHR(87)||CHR(110),5) AND '%'='": invalid syntax
2017/04/11 16:43:37 Invalid database version number: strconv.ParseInt: parsing "1) ORDER BY 1-- UrJb": invalid syntax
2017/04/11 16:43:37 Invalid database version number: strconv.ParseInt: parsing "1) UNION ALL SELECT NULL-- Osvd": invalid syntax
2017/04/11 16:43:37 Invalid database version number: strconv.ParseInt: parsing "1) UNION ALL SELECT NULL,NULL-- IlmN": invalid syntax
2017/04/11 16:43:38 Invalid database version number: strconv.ParseInt: parsing "1) UNION ALL SELECT NULL,NULL,NULL-- UhfB": invalid syntax
2017/04/11 16:43:38 Invalid database version number: strconv.ParseInt: parsing "1) UNION ALL SELECT NULL,NULL,NULL,NULL-- qvgC": invalid syntax
2017/04/11 16:43:38 Invalid database version number: strconv.ParseInt: parsing "1) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL-- lEIB": invalid syntax
2017/04/11 16:43:39 Invalid database version number: strconv.ParseInt: parsing "1) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL-- RZXV": invalid syntax
2017/04/11 16:43:39 Invalid database version number: strconv.ParseInt: parsing "1) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL-- uTwU": invalid syntax
2017/04/11 16:43:39 Invalid database version number: strconv.ParseInt: parsing "1) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- ACWR": invalid syntax
2017/04/11 16:43:40 Invalid database version number: strconv.ParseInt: parsing "1) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- kixr": invalid syntax
2017/04/11 16:43:40 Invalid database version number: strconv.ParseInt: parsing "1) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- esjJ": invalid syntax
2017/04/11 16:43:41 Invalid database version number: strconv.ParseInt: parsing "1 ORDER BY 1-- QoYS": invalid syntax
2017/04/11 16:43:41 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL-- YPCG": invalid syntax
2017/04/11 16:43:41 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL-- Hhgv": invalid syntax
2017/04/11 16:43:42 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL,NULL-- fKmK": invalid syntax
2017/04/11 16:43:42 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL,NULL,NULL-- uELk": invalid syntax
2017/04/11 16:43:42 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL-- jiGX": invalid syntax
2017/04/11 16:43:43 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL-- ajjK": invalid syntax
2017/04/11 16:43:43 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL-- nFsk": invalid syntax
2017/04/11 16:43:43 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- iSfz": invalid syntax
2017/04/11 16:43:44 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- sSQI": invalid syntax
2017/04/11 16:43:44 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- cpta": invalid syntax
2017/04/11 16:43:45 Invalid database version number: strconv.ParseInt: parsing "1 ORDER BY 1-- IpoS": invalid syntax
2017/04/11 16:43:45 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL-- vZxe": invalid syntax
2017/04/11 16:43:45 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL-- tqTI": invalid syntax
2017/04/11 16:43:46 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL,NULL-- SNep": invalid syntax
2017/04/11 16:43:46 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL,NULL,NULL-- mazb": invalid syntax
2017/04/11 16:43:46 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL-- mIjy": invalid syntax
2017/04/11 16:43:47 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL-- GRJl": invalid syntax
2017/04/11 16:43:47 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL-- RBFU": invalid syntax
2017/04/11 16:43:47 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- orST": invalid syntax
2017/04/11 16:43:48 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- MCRq": invalid syntax
2017/04/11 16:43:48 Invalid database version number: strconv.ParseInt: parsing "1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- WfIn": invalid syntax
2017/04/11 16:43:49 Invalid database version number: strconv.ParseInt: parsing "1') ORDER BY 1-- BtOq": invalid syntax
2017/04/11 16:43:49 Invalid database version number: strconv.ParseInt: parsing "1') UNION ALL SELECT NULL-- hNpM": invalid syntax
2017/04/11 16:43:49 Invalid database version number: strconv.ParseInt: parsing "1') UNION ALL SELECT NULL,NULL-- WoUH": invalid syntax
2017/04/11 16:43:50 Invalid database version number: strconv.ParseInt: parsing "1') UNION ALL SELECT NULL,NULL,NULL-- xjBN": invalid syntax
2017/04/11 16:43:50 Invalid database version number: strconv.ParseInt: parsing "1') UNION ALL SELECT NULL,NULL,NULL,NULL-- vmZE": invalid syntax
2017/04/11 16:43:50 Invalid database version number: strconv.ParseInt: parsing "1') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL-- QnKu": invalid syntax
2017/04/11 16:43:51 Invalid database version number: strconv.ParseInt: parsing "1') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL-- nnAJ": invalid syntax
2017/04/11 16:43:51 Invalid database version number: strconv.ParseInt: parsing "1') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL-- MGvW": invalid syntax
2017/04/11 16:43:51 Invalid database version number: strconv.ParseInt: parsing "1') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- opUm": invalid syntax
2017/04/11 16:43:52 Invalid database version number: strconv.ParseInt: parsing "1') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- QHdv": invalid syntax
2017/04/11 16:43:52 Invalid database version number: strconv.ParseInt: parsing "1') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- cNne": invalid syntax
2017/04/11 16:43:52 Invalid database version number: strconv.ParseInt: parsing "1' ORDER BY 1-- QjbB": invalid syntax
2017/04/11 16:43:53 Invalid database version number: strconv.ParseInt: parsing "1' UNION ALL SELECT NULL-- TyxB": invalid syntax
2017/04/11 16:43:53 Invalid database version number: strconv.ParseInt: parsing "1' UNION ALL SELECT NULL,NULL-- rYXq": invalid syntax
2017/04/11 16:43:53 Invalid database version number: strconv.ParseInt: parsing "1' UNION ALL SELECT NULL,NULL,NULL-- mxpB": invalid syntax
2017/04/11 16:43:54 Invalid database version number: strconv.ParseInt: parsing "1' UNION ALL SELECT NULL,NULL,NULL,NULL-- srab": invalid syntax
2017/04/11 16:43:54 Invalid database version number: strconv.ParseInt: parsing "1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL-- peTK": invalid syntax
2017/04/11 16:43:55 Invalid database version number: strconv.ParseInt: parsing "1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL-- GFMy": invalid syntax
2017/04/11 16:43:55 Invalid database version number: strconv.ParseInt: parsing "1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL-- HGti": invalid syntax
2017/04/11 16:43:55 Invalid database version number: strconv.ParseInt: parsing "1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- VwVW": invalid syntax
2017/04/11 16:43:56 Invalid database version number: strconv.ParseInt: parsing "1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- synQ": invalid syntax
2017/04/11 16:43:56 Invalid database version number: strconv.ParseInt: parsing "1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- uRhJ": invalid syntax
2017/04/11 16:43:56 Invalid database version number: strconv.ParseInt: parsing "1%' ORDER BY 1-- oqek": invalid syntax
2017/04/11 16:43:57 Invalid database version number: strconv.ParseInt: parsing "1%' UNION ALL SELECT NULL-- KfMS": invalid syntax
2017/04/11 16:43:57 Invalid database version number: strconv.ParseInt: parsing "1%' UNION ALL SELECT NULL,NULL-- FuaR": invalid syntax
2017/04/11 16:43:57 Invalid database version number: strconv.ParseInt: parsing "1%' UNION ALL SELECT NULL,NULL,NULL-- HZLL": invalid syntax
2017/04/11 16:43:58 Invalid database version number: strconv.ParseInt: parsing "1%' UNION ALL SELECT NULL,NULL,NULL,NULL-- LxpD": invalid syntax
2017/04/11 16:43:58 Invalid database version number: strconv.ParseInt: parsing "1%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL-- aaGS": invalid syntax
2017/04/11 16:43:58 Invalid database version number: strconv.ParseInt: parsing "1%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL-- iBpk": invalid syntax
2017/04/11 16:43:59 Invalid database version number: strconv.ParseInt: parsing "1%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL-- uLkS": invalid syntax
2017/04/11 16:43:59 Invalid database version number: strconv.ParseInt: parsing "1%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- FGKV": invalid syntax
2017/04/11 16:44:00 Invalid database version number: strconv.ParseInt: parsing "1%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- mydv": invalid syntax
2017/04/11 16:44:00 Invalid database version number: strconv.ParseInt: parsing "1%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- qAeu": invalid syntax

They all start with "Invalid database version number: strconv.ParseInt", which comes from the log statement here:

if err != nil {
	log.Printf("Invalid database version number: %v\n", err)
	return 0, errors.New("Invalid database version number")
}

That means the invalid input is being caught, logged, discarded, and the value "0" is being used instead. So, that's good news. I'll kill the log message for now though, as it's just dumping into the console and not really providing info other than "we got invalid data".

At some future point, we'd probably want to use it for automatic attack handling instead. eg detect someone sending invalid data more than X times in (say) 10 seconds, which adds a firewall rule or similar to the cluster so further requests are blackholed for a period of time.

That approach probably wouldn't catch distributed attacks, but it would likely help against script kiddie and similar attacks.

I'll also try running sqlmap against my local dev version a bit today, to see if other stuff is getting through and not being logged.