Pangolin – Automatic SQL Injection Tool


Pangolin is an automatic SQL injection penetration testing tool developed by NOSEC. Its goal is to detect and take advantage of SQL injection vulnerabilities on web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user’s specific DBMS tables/columns, run his own SQL statement, read specific files on the file system and more.

Database Support

  • Access: Informations (Database Path; Root Path; Drivers); Data
  • MSSql: Informations; Data; FileReader; RegReader; FileWriter; Cmd; DirTree
  • MySql: Informations; Data; FileReader; FileWriter;
  • Oracle: Inforatmions (Version; IP; Database; Accounts ……); Data; and any others;
  • Informix: Informatons; Data
  • DB2: Informatons; Data; and more;
  • Sybase: Informatons; Data; and more;
  • PostgreSQL: Informatons; Data; FileReader;
  • Sqlite: Informatons; Data

At present, most of the functions are directed at MSSQL and MySql coupled with Oracle and Access. Other small and medium-sized companies are using DB2, Informix, Sybase, PostgreSQL, as well as Sqlite which isn’t so common.

You can download Pangolin here:

pangolin_free_edition_2.1.2.924.rar (Download Page)

Or read more here.

Posted in: Database Hacking, Hacking Tools, Web Hacking

, , , , , , , , , ,


Latest Posts:


ZigDiggity - ZigBee Hacking Toolkit ZigDiggity – ZigBee Hacking Toolkit
ZigDiggity a ZigBee Hacking Toolkit is a Python-based IoT (Internet of Things) penetration testing framework targeting the ZigBee smart home protocol.
RandIP - Network Mapper To Find Servers RandIP – Network Mapper To Find Servers
RandIP is a nim-based network mapper application that generates random IP addresses and uses sockets to test whether the connection is valid or not with additional tests for Telnet and SSH.
Nipe - Make Tor Default Gateway For Network Nipe – Make Tor Default Gateway For Network
Nipe is a Perl script to make Tor default gateway for network, this script enables you to directly route all your traffic from your computer to the Tor network.
Mosca - Manual Static Analysis Tool To Find Bugs Mosca – Manual Static Analysis Tool To Find Bugs
Mosca is a manual static analysis tool written in C designed to find bugs in the code before it is compiled, much like a grep unix command.
Slurp - Amazon AWS S3 Bucket Enumerator Slurp – Amazon AWS S3 Bucket Enumerator
Slurp is a blackbox/whitebox S3 bucket enumerator written in Go that can use a permutations list to scan externally or an AWS API to scan internally.
US Government Cyber Security Still Inadequate US Government Cyber Security Still Inadequate
Surprise, surprise, surprise - an internal audit of the US Government cyber security situation has uncovered widespread weaknesses, legacy systems and poor adoption of cyber controls and tooling.


7 Responses to Pangolin – Automatic SQL Injection Tool

  1. natron May 13, 2009 at 4:37 pm #

    Beware, for certain types of SQLi, Pangolin’s creators get a copy of all the data retrieved:

    “…After decoding we found that the results of the injection is sent to a nosec.org web server, and then Pangolin perform a GET to retrieve the data. WTH?”

    http://laramies.blogspot.com/2009/05/pangolin-and-your-data.html

    I understand why they did this, but it should be pointed out to the end users so they understand what’s occurring. That they don’t is very shady.

    n

  2. Anony May 13, 2009 at 5:56 pm #

    I would never even consider downloading the tool cause of that. Thanks for pointing it out natron.

  3. Navin May 13, 2009 at 6:32 pm #

    +1 @anony

    Thanks natron!!

  4. Darknet May 14, 2009 at 8:12 am #

    Thanks for the info guys, honestly I was always skeptical about posting Pangolin, but I thought it’d had developed a long way. Always found it a little suspicious.

    I can understand the rational for passing thru their HTTP server for that function, but doing it without disclosure is lame.

    I don’t think I’ll be posting any more of it’s updated versions here.

    I hope people read these comments.

  5. User May 14, 2009 at 2:36 pm #

    Thanks for the comments… Yes, some folks read the comments, and thank god I did… :-)

  6. makk May 17, 2009 at 8:31 am #

    thanx buddy

  7. pangolin May 27, 2009 at 6:57 am #

    I have check it, look at what it send : http://www.nosec.org/product/upgrade.php, it is upgrade checking, do you think so?

    Just visit here : http://www.nosec.org/en/node/73