Pangolin is an automatic SQL injection penetration testing tool developed by NOSEC. Its goal is to detect and take advantage of SQL injection vulnerabilities on web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user’s specific DBMS tables/columns, run his own SQL statement, read specific files on the file system and more.
Database Support
- Access: Informations (Database Path; Root Path; Drivers); Data
- MSSql: Informations; Data; FileReader; RegReader; FileWriter; Cmd; DirTree
- MySql: Informations; Data; FileReader; FileWriter;
- Oracle: Inforatmions (Version; IP; Database; Accounts ……); Data; and any others;
- Informix: Informatons; Data
- DB2: Informatons; Data; and more;
- Sybase: Informatons; Data; and more;
- PostgreSQL: Informatons; Data; FileReader;
- Sqlite: Informatons; Data
At present, most of the functions are directed at MSSQL and MySql coupled with Oracle and Access. Other small and medium-sized companies are using DB2, Informix, Sybase, PostgreSQL, as well as Sqlite which isn’t so common.
You can download Pangolin here:
pangolin_free_edition_2.1.2.924.rar (Download Page)
Or read more here.
Subscribe to Darknet RSS Feed Stored in: Database Hacking, Hacking Tools, Web Hacking
Related Posts:
- sqlmap 0.5 – Automated SQL Injection Tool
- sqlmap 0.7 Released – Automatic SQL Injection Tool
- MultiInjector v0.3 Released – Automatic SQL Injection and Defacement Tool
- Pixy – New & Free Open-source XSS and SQL Injection Scanner for PHP Programs
- MultiInjector – Automated Stealth SQL Injection Tool
- sqlmap 0.6.1 released – Automatic SQL Injection Tool
| 12,697 views |
Beware, for certain types of SQLi, Pangolin’s creators get a copy of all the data retrieved:
“…After decoding we found that the results of the injection is sent to a nosec.org web server, and then Pangolin perform a GET to retrieve the data. WTH?”
http://laramies.blogspot.com/2009/05/pangolin-and-your-data.html
I understand why they did this, but it should be pointed out to the end users so they understand what’s occurring. That they don’t is very shady.
n
I would never even consider downloading the tool cause of that. Thanks for pointing it out natron.
+1 @anony
Thanks natron!!
Thanks for the info guys, honestly I was always skeptical about posting Pangolin, but I thought it’d had developed a long way. Always found it a little suspicious.
I can understand the rational for passing thru their HTTP server for that function, but doing it without disclosure is lame.
I don’t think I’ll be posting any more of it’s updated versions here.
I hope people read these comments.
Thanks for the comments… Yes, some folks read the comments, and thank god I did…
thanx buddy
I have check it, look at what it send : http://www.nosec.org/product/upgrade.php, it is upgrade checking, do you think so?
Just visit here : http://www.nosec.org/en/node/73