Home

Commix (short for [comm]and [i]njection e[x]ploiter) is an open source penetration testing tool, written by Anastasios Stasinopoulos (@ancst), that automates the detection and exploitation of command injection vulnerabilities.

Command injection is easy to introduce and easy to miss: an application passes user input into a shell, and a single unescaped separator turns a parameter into arbitrary code execution. What makes it hard to test by hand is that the evidence is rarely in the response. The command may run and print nothing, its output may be swallowed by the page, or the only thing that changes is how long the reply takes. Commix exists to close that gap - it proves execution through whichever channel the target actually leaves open, then gives you a shell through it.

This wiki is the user's manual: what commix supports, what every option does, and how to drive it against real targets.

Where to start

If you want to	Read
Understand every option and switch, with examples	Usage
See how detection and exploitation actually work	Techniques
Follow worked examples against vulnerable applications	Usage examples
Get an interactive, reverse or bind shell	Getting shells
Evade input filters and WAFs	Filters bypass examples
Practise safely on deliberately vulnerable targets	Command injection testbeds
Extend commix with your own module	Module development
Install it or keep it current	Download and update

Important

This project is in active development. Expect breaking changes between revisions. Review the changelog before updating.

Commix is primarily built to be used as a standalone CLI tool, and it executes operating system commands on the targets it tests. Running commix as a service may pose security risks. It is recommended to use it with caution, and only against systems you own or have explicit authorisation to test.

What commix does

• Four injection techniques - results-based (classic), time-based (blind), file-based (blind, with a tempfile-based variant for write-restricted targets), and out-of-band (OAST) over HTTP/S and DNS. Selected with --technique, or by the type they report with --type.
• Code injection - --eval tests the string a target evaluates as code, in PHP or Python, over the same four techniques.
• Broad injection surface - GET/POST parameters, HTTP headers, cookies, and JSON/XML request bodies, plus the shellshock module for CGI targets.
• Interactive shells - an os_shell on the target, built-in reverse_tcp and bind_tcp modes, and file download/upload over the established shell.
• Enumeration and file access - current user, hostname, privileges, system information, users and password hashes; read from and write to files on the target host.
• Filter and WAF evasion - Multiple combinable tamper scripts, applied in a deterministic order.
• Flexible targeting - a single URL, a crawl, HTML forms, a sitemap, a proxy log, a bulk file, a raw HTTP request file, or piped stdin.
• Resumable scans - results are stored per target in a session file, and can be exported to JSON.
• Wide back-end support - PHP, Python, Perl, Ruby, ASP.NET, JSP and CGI, and works against both Unix-like and Windows targets - see Windows and Unix-like targets at a glance for how the payloads differ.

Links

• Source code: https://github.com/commixproject/commix
• Issues tracker: https://github.com/commixproject/commix/issues
• Project site: https://commixproject.com