Home

Commix (short for [comm]and [i]njection e[x]ploiter) is an open source penetration testing tool, written by Anastasios Stasinopoulos (@ancst), that automates the detection and exploitation of command injection vulnerabilities.

Command injection is easy to introduce and easy to miss: an application passes user input into a shell, and a single unescaped separator turns a parameter into arbitrary code execution. What makes it hard to test by hand is that the evidence is rarely in the response. The command may run and print nothing, its output may be swallowed by the page, or the only thing that changes is how long the reply takes. Commix exists to close that gap - it proves execution through whichever channel the target actually leaves open, then gives you a shell through it.

This wiki is the user's manual: what commix supports, what every option does, and how to drive it against real targets.

Where to start

If you want to	Read
Understand every option and switch, with examples	Usage
See how detection and exploitation actually work	Techniques
Follow worked examples against vulnerable applications	Usage examples
Get an interactive, reverse or bind shell	Getting shells
Evade input filters and WAFs	Filters bypass examples
Practise safely on deliberately vulnerable targets	Command injection testbeds
Extend commix with your own module	Module development
Install it or keep it current	Download and update

Important

This project is in active development. Expect breaking changes between revisions. Review the changelog before updating.

Commix is primarily built to be used as a standalone CLI tool, and it executes operating system commands on the targets it tests. Running commix as a service may pose security risks. It is recommended to use it with caution, and only against systems you own or have explicit authorisation to test.

What commix does

• Five injection techniques - results-based (classic), boolean-based (blind), time-based (blind), file-based (blind, with a tempfile-based variant for write-restricted targets), and out-of-band (OAST) over HTTP/S and DNS. The first four are selected with --technique, or by the type they report with --type; out-of-band is the separate --oob switch, so it can serve the modules too.
• Code injection - --eval tests the string a target evaluates as code, in PHP, Python, Ruby, JavaScript or PowerShell, over the same five techniques.
• Broad injection surface - GET/POST parameters, HTTP headers, cookies, and JSON/XML request bodies, plus the shellshock module for CGI targets.
• Interactive shells and post-exploitation - an os_shell on the target, built-in reverse_tcp and bind_tcp modes, file download/upload over the established shell, and enumeration of the current user, hostname, privileges, system information, users and password hashes. Every finding can be re-proved with --proof, which runs an experiment of its own and writes the transcript beside the run's output.
• Filter and WAF evasion - Multiple combinable tamper scripts, applied in a deterministic order.
• Flexible targeting - a single URL, a crawl, HTML forms, a sitemap, an OpenAPI (Swagger) description, a proxy log, a bulk file, a raw HTTP request file, or piped stdin.
• Resumable scans and machine-readable output - results are stored per target in a session file, and can be exported as JSON, as a CSV covering every target tested, or as a HAR log of the run's HTTP traffic. The options a run was given can be saved as a profile and reused.
• Wide back-end support - PHP, Python, Perl, Ruby, ASP.NET, JSP and CGI, and works against both Unix-like and Windows targets - see Windows and Unix-like targets at a glance for how the payloads differ.

Links

• Source code: https://github.com/commixproject/commix
• Issues tracker: https://github.com/commixproject/commix/issues
• Project site: https://commixproject.com