Pangolin is an automatic SQL injection
penetration testing tool developed by NOSEC. Its goal is to detect and
take advantage of SQL injection vulnerabilities on web applications.
Once it detects one or more SQL injections on the target host, the user
can choose among a variety of options to perform an extensive back-end
database management system fingerprint, retrieve DBMS session user and
database, enumerate users, password hashes, privileges, databases,
dump entire or user’s specific DBMS tables/columns, run his own SQL
statement, read specific files on the file system and more.
Database Support
Access: Informations (Database Path; Root Path; Drivers); Data
MSSql: Informations; Data; FileReader; RegReader; FileWriter; Cmd; DirTree
MySql: Informations; Data; FileReader; FileWriter;
Oracle: Inforatmions (Version; IP; Database; Accounts ……); Data; and any others;
Informix: Informatons; Data
DB2: Informatons; Data; and more;
Sybase: Informatons; Data; and more;
PostgreSQL: Informatons; Data; FileReader;
Sqlite: Informatons; Data
At present, most of the functions are directed at MSSQL and MySql coupled with Oracle and Access. Other small and medium-sized companies are using DB2, Informix, Sybase, PostgreSQL, as well as Sqlite which isn’t so common.
download Pangolin here
0 comentários:
Postar um comentário