13 May 2009 | 70,810 views

Pangolin – Automatic SQL Injection Tool

Check Your Web Security with Acunetix

Pangolin is an automatic SQL injection penetration testing tool developed by NOSEC. Its goal is to detect and take advantage of SQL injection vulnerabilities on web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user’s specific DBMS tables/columns, run his own SQL statement, read specific files on the file system and more.

Database Support

  • Access: Informations (Database Path; Root Path; Drivers); Data
  • MSSql: Informations; Data; FileReader; RegReader; FileWriter; Cmd; DirTree
  • MySql: Informations; Data; FileReader; FileWriter;
  • Oracle: Inforatmions (Version; IP; Database; Accounts ……); Data; and any others;
  • Informix: Informatons; Data
  • DB2: Informatons; Data; and more;
  • Sybase: Informatons; Data; and more;
  • PostgreSQL: Informatons; Data; FileReader;
  • Sqlite: Informatons; Data

At present, most of the functions are directed at MSSQL and MySql coupled with Oracle and Access. Other small and medium-sized companies are using DB2, Informix, Sybase, PostgreSQL, as well as Sqlite which isn’t so common.

You can download Pangolin here:

pangolin_free_edition_2.1.2.924.rar (Download Page)

Or read more here.



Recent in Database Hacking:
- Navy Sys Admin Hacks Into Databases From Aircraft Carrier
- aidSQL – PHP Application For SQL Injection Detection & Exploitation
- 1 Million Accounts Leaked From Banks, Government Agencies & Consultancy Firms

Related Posts:
- The Mole v0.3 Released For Download – Automatic SQL Injection Exploitation Tool
- The Mole – Automatic SQL Injection SQLi Exploitation Tool
- sqlmap 0.9 Released – Automatic Blind SQL Injection Tool

Most Read in Database Hacking:
- Pangolin – Automatic SQL Injection Tool - 70,810 views
- bsqlbf 1.1 – Blind SQL Injection Tool - 53,724 views
- Absinthe Blind SQL Injection Tool/Software - 38,905 views

Advertise on Darknet

7 Responses to “Pangolin – Automatic SQL Injection Tool”

  1. natron 13 May 2009 at 4:37 pm Permalink

    Beware, for certain types of SQLi, Pangolin’s creators get a copy of all the data retrieved:

    “…After decoding we found that the results of the injection is sent to a nosec.org web server, and then Pangolin perform a GET to retrieve the data. WTH?”

    http://laramies.blogspot.com/2009/05/pangolin-and-your-data.html

    I understand why they did this, but it should be pointed out to the end users so they understand what’s occurring. That they don’t is very shady.

    n

  2. Anony 13 May 2009 at 5:56 pm Permalink

    I would never even consider downloading the tool cause of that. Thanks for pointing it out natron.

  3. Navin 13 May 2009 at 6:32 pm Permalink

    +1 @anony

    Thanks natron!!

  4. Darknet 14 May 2009 at 8:12 am Permalink

    Thanks for the info guys, honestly I was always skeptical about posting Pangolin, but I thought it’d had developed a long way. Always found it a little suspicious.

    I can understand the rational for passing thru their HTTP server for that function, but doing it without disclosure is lame.

    I don’t think I’ll be posting any more of it’s updated versions here.

    I hope people read these comments.

  5. User 14 May 2009 at 2:36 pm Permalink

    Thanks for the comments… Yes, some folks read the comments, and thank god I did… :-)

  6. makk 17 May 2009 at 8:31 am Permalink

    thanx buddy

  7. pangolin 27 May 2009 at 6:57 am Permalink

    I have check it, look at what it send : http://www.nosec.org/product/upgrade.php, it is upgrade checking, do you think so?

    Just visit here : http://www.nosec.org/en/node/73