Pangolin is an automatic SQL injection penetration testing tool developed by NOSEC. Its goal is to detect and take advantage of SQL injection vulnerabilities on web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user’s specific DBMS tables/columns, run his own SQL statement, read specific files on the file system and more.
- Access: Informations (Database Path; Root Path; Drivers); Data
- MSSql: Informations; Data; FileReader; RegReader; FileWriter; Cmd; DirTree
- MySql: Informations; Data; FileReader; FileWriter;
- Oracle: Inforatmions (Version; IP; Database; Accounts ……); Data; and any others;
- Informix: Informatons; Data
- DB2: Informatons; Data; and more;
- Sybase: Informatons; Data; and more;
- PostgreSQL: Informatons; Data; FileReader;
- Sqlite: Informatons; Data
At present, most of the functions are directed at MSSQL and MySql coupled with Oracle and Access. Other small and medium-sized companies are using DB2, Informix, Sybase, PostgreSQL, as well as Sqlite which isn’t so common.
You can download Pangolin here:
Or read more here.
- OAT – Oracle Auditing Tools For Database Security
- ODAT (Oracle Database Attacking Tool) – Test Oracle Database Security
- Navy Sys Admin Hacks Into Databases From Aircraft Carrier
- The Mole v0.3 Released For Download – Automatic SQL Injection Exploitation Tool
- The Mole – Automatic SQL Injection SQLi Exploitation Tool
- sqlmap 0.9 Released – Automatic Blind SQL Injection Tool
Most Read in Database Hacking:
- Pangolin – Automatic SQL Injection Tool - 74,375 views
- bsqlbf 1.1 – Blind SQL Injection Tool - 53,986 views
- SQLBrute – SQL Injection Brute Force Tool - 39,191 views