X-COM
commix
Automated command-injection detection and exploitation tool that turns a vulnerable parameter into a semi-interactive shell.
OVERVIEW
commix (github.com/commixproject/commix, from 'commands injection exploiter') is a Python tool dedicated to one class of vulnerability: OS command injection. Pointed at a URL, request file, or raw HTTP request with an injection point marked, it cycles through classic, blind (time-based), and file-based techniques to work out whether a parameter reaches a shell, and if so, which injection operator and technique actually work.
Once it confirms injection, it goes beyond detection into exploitation: it can drop into a pseudo-terminal shell, read or write files, or set up a reverse/bind connection, which makes it as much a post-detection exploitation tool as a scanner — closer in spirit to sqlmap for command injection than to a passive checker.
USE CASES
Practical use cases
- 01
Testing a suspected parameter (query string, POST body, header, cookie) for classic, blind, or file-based command injection.
- 02
Confirming a command-injection finding and demonstrating impact via a pseudo-terminal shell during an authorized engagement.
- 03
Automating injection-technique enumeration against an API or web form that shells out to the OS internally.
- 04
Chaining a confirmed command injection into a reverse shell to pivot further into the target network.
QUICK START
Once a parameter looks like it might reach a shell command, to systematically test injection techniques and, if confirmed, drop into a shell.
- Confirm the target parameter and injection is inside the authorized scope, and that a shell command being triggered is an acceptable test.
- Install commix (pip install commix, or clone the repo and run commix.py directly).
- Point it at the vulnerable URL, marking the injection point if it isn't the last parameter.
- Let it cycle through detection techniques; if one confirms, choose whether to drop into the offered pseudo-terminal shell.
- Record exactly which technique and payload worked, plus any commands actually executed, for the report.
commix -u "http://target.example.com/page.php?id=1" --batchBEFORE YOU RUN IT
What to check before running it
A confirmed command injection executes real commands on the target host — agree on which commands (or none beyond a harmless proof-of-concept like a sleep or echo) are acceptable before running it.
The pseudo-terminal shell it offers is a live interactive session on the target; treat it with the same care as any other shell access and log everything run through it.
Blind/time-based techniques can be slow and produce false positives under network jitter — confirm timing-based findings with a second, independent method.