SQL injection is a common web application security risk that allows attackers to trick interpreters into executing unintended commands or accessing unauthorized data. Pangolin is an automatic SQL injection penetration testing tool that detects and exploits SQL injection vulnerabilities to retrieve database information, test websites, and protect against attacks. It can enumerate users, retrieve password hashes and privileges, dump tables, and more to identify vulnerabilities before attackers exploit them.

1. Pangolin
Amazing SQL Injection world
White Paper

2. Pangolin
Amazing SQL Injection world
How dangerous SQL Injection is?
Injection was listed in OWASP top 10 Web Application Security Risks for 2008, 2009
and 2010. Injection flaws, particularly SQL injection, are common in web applications.
Injection occurs when user-supplied data is sent to an interpreter as part of a
command or query. The attacker's hostile data tricks the interpreter into executing
unintended commands or changing data.
The OWASP Top 10 Web Application Security Risks for 2010 are:
 A1:
Ÿ Injection
 A2:
Ÿ Cross-Site Scripting (XSS)
 A3:
Ÿ Broken Authentication and Session Management
 A4:
Ÿ Insecure Direct Object References
 A5:
Ÿ Cross-Site Request Forgery (CSRF)
 A6:
Ÿ Security Misconfiguration
 A7:
Ÿ Insecure Cryptographic Storage
 A8:
Ÿ Failure to Restrict URL Access
 A9:
Ÿ Insufficient Transport Layer Protection
 A10:
Ÿ Unvalidated Redirects and Forwards
What Pangolin can do?
White Paper
Pangolin is an automatic SQL injection penetration testing (Pen-testing) tool for
Website manager or IT Security analyst. Its goal is to detect and take advantage of SQL
injection vulnerabilities on web applications. Once it detects one or more SQL
injections on the target host, the user can choose among a variety of options to
perform an extensive back-end database management system fingerprint, retrieve
DBMS session user and database, enumerate users, password hashes, privileges,
databases, dump entire or users specific DBMS tables/columns, run his own SQL
statement, read specific files on the file system and more.
á pull database info through vulnerability if SQL injection was exist.
Pangolin
1
Copyright © 2011 NOSEC www.nosec-inc.com

3. Pangolin
Amazing SQL Injection world
Pangolin is recommended by many web security experts
all over the world
Pangolin is a professional SQL Injection test tools widely used by Cyber Security
Experts. Pangolin also listed here:
 OWASP
Ÿ  DARKNET
Ÿ
 Red
Ÿ Database Security  TECHIMO
Ÿ
 HACKTIMES
Ÿ  WAKOOPA
Ÿ
 SECURITY DATABASE
Ÿ  PENTESTIT
Ÿ
Protects your financial and intellectual property
Once your website been tested by Pangolin. Website administrator will know what
should do to protect databases from SQL injection attacks.
It proactively prevents the theft from happening and continuously protects the
valuable assets stored in your databases.
Protects your reputation
á pull data through vulnerability if SQL injection was exist.
Pangolin White Paper
Hackers can gain access to your web server and database console through
vulnerability if SQL injection was exist. Once in control, they can use your
servers to many types of databases
Test do whatever they want – such as sending spam and/or attacking
other destinations p l i c a tyours servers. If cthis s , D B 2 , I n fo r myouM i c ro s o on a Q L S e r v e r
Yo u r w e b a p from i o n u s i n g A c e s happens and i x , end up f t S
blacklist as , a resultoof o f t illegal activity, e r may0findM i c r o s o f t S Q L S e r v e r
2 0 0 0 M i c r s this S Q L S e r v you 2 0 5 , that your legitimate
incoming and outgoing traffic is rejected. You'll lose sales, valuable channels
2008,MySQL,Oracle,PostgreSQL,Sqlite3,Sybase?
of communication with of them.
Pangolin supports all your customers, and end up involved in lengthy,
frustrating negotiations to get off the blacklists. Pangolin can tell you all SQL
inject possibility.
Protects your reputation
Hackers can gain access to your web server and database console through
vulnerability if SQL injection was exist. Once in control, they can use your servers to do
whatever they want – such as sending spam and/or attacking other destinations from
your servers. If this happens and you end up on a blacklist as a result of this illegal
activity, you may find that your legitimate incoming and outgoing traffic is rejected.
You'll lose sales, valuable channels of communication with your customers, and end
up involved in lengthy, frustrating negotiations to get off the blacklists. Pangolin can
tell you all SQL inject possibility.
2
Copyright © 2011 NOSEC www.nosec-inc.com

4. Pangolin
Amazing SQL Injection world
About NOSEC
NOSEC, Web Application Security Expert, provides products and service to
over 100 organizations. Protect Web Application from malware; prevent the
loss of confidential information. JSky delivers best-in-class security solutions
that allow organizations to work in new, more efficient and innovative ways
and that keep employees productive anytime, anywhere.
NOSEC has its roots in Web Application and continues to develop its core
strength in discovering and classifying content across all its product
offerings. NOSEC helps organizations secure essential information by
providing service and products for internal and external Web Application
even in the Web 2.0 world.
NOSEC keeps maximize business opportunities while minimizing the
unintended consequences of connectedness.
White Paper
Copyright © 2009 NOSEC Technologies Co., Ltd
All Rights Reserved
NOSEC, the NOSEC logo, JSky, iiScan are trademarks of NOSEC Technologies
Co., Ltd in China, other countries or both. Other company, product and
service names may be trademarks or service marks of others.
Disclaimer: The customer is responsible for ensuring compliance with
legal requirements. It is the customer's sole responsibility to obtain advice of
competent legal counsel as to the identification and interpretation of any
relevant laws and regulatory requirements that may affect the customer's
business and any actions the reader may have to take to comply with such
laws. NOSEC does not provide legal advice or represent or warrant that its
services or products will ensure that the customer is in compliance with any
law or regulation.
3
Copyright © 2011 NOSEC www.nosec-inc.com