commixproject/commix

★ 5,733PythonAudience · developerComplexity · 3/5LicenseSetup · easy

Mindmap

mindmap
  root((commix))
    Detection
      Scan target URL
      Identify injection points
      Filter bypass techniques
    Exploitation
      Run system commands
      Demonstrate impact
      Automated payloads
    Setup
      Clone repo
      Run Python script
      No build step
    Use Cases
      Penetration testing
      Bug bounty work
      Authorized audits
    Reporting
      OWASP resources
      Wiki documentation
      Usage examples

mindmap root((commix)) Detection Scan target URL Identify injection points Filter bypass techniques Exploitation Run system commands Demonstrate impact Automated payloads Setup Clone repo Run Python script No build step Use Cases Penetration testing Bug bounty work Authorized audits Reporting OWASP resources Wiki documentation Usage examples

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Test a web application for command injection vulnerabilities during an authorized penetration testing engagement

USE CASE 2

Automate command injection detection and exploitation for bug bounty submissions

USE CASE 3

Verify whether a specific URL parameter passes user input unsafely to the operating system

USE CASE 4

Bypass input filters that block basic command injection attempts to fully assess exposure

Tech stack

PythonCommand Line

Getting it running

Difficulty · easy Time to first run · 5min

Clone the repository and run the Python script directly. No build or install step required. Supports Python 2.6, 2.7, and 3.x. Only use against targets you have explicit permission to test.

Released under GPLv3. Free to use and modify, but any distributed derivative must also be open source under the same license.

In plain English

Commix is a Python tool for penetration testers that automates the process of finding and exploiting command injection vulnerabilities in web applications. A command injection vulnerability is a type of security flaw where a web application passes user-supplied input to the operating system in an unsafe way, allowing an attacker to run arbitrary system commands on the server. Commix is designed to detect whether a given target is vulnerable to this class of problem and, if so, to demonstrate the impact by running those commands automatically. The name is a contraction of command injection exploiter. The tool was written by security researcher Anastasios Stasinopoulos and is released under the GPLv3 open source license. It supports Python versions 2.6, 2.7, and 3.x, and can be installed simply by cloning the repository and running the script directly with no build step required. Commix is intended for authorized security testing, bug bounty work, and penetration testing engagements where a tester has permission to probe a target application. It is included in security-focused Linux distributions and is listed in OWASP-related resources as a relevant testing tool. The wiki on its GitHub page covers available options, usage examples, and techniques for bypassing input filters that would otherwise block detection attempts. The tool is available in several translated README versions covering Persian, Greek, Indonesian, and Turkish.

Copy-paste prompts

Prompt 1

I am doing an authorized penetration test. Using commix, how do I scan a target URL for command injection vulnerabilities and capture the output of a system command if the target is vulnerable?

Prompt 2

How do I use commix to bypass input sanitization filters when testing a web application for command injection? Show me the relevant flags and an example command.

Prompt 3

I want to use commix during a bug bounty engagement. Walk me through cloning the repo, running it against a test URL, and interpreting the results to write a vulnerability report.

Prompt 4

Using commix, how can I test a POST request parameter rather than a GET URL parameter for command injection? Provide a sample command with placeholder values.

Prompt 5

What commix options should I use to test a web application that uses a web application firewall, and how do I tune the tool to reduce false negatives?

Open on GitHub → Explain another repo

← commixproject on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.