Commix is an automated penetration testing tool that detects and exploits command injection vulnerabilities in web applications.
The tool addresses the challenge of identifying and leveraging command injection flaws across diverse injection points and application backends. It automates the process through five distinct injection techniques: classic, dynamic code evaluation, time-based, file-based, and out-of-band methods. The approach works by testing parameters across multiple surfaces including GET and POST parameters, HTTP headers, cookies, JSON and XML request bodies, and CGI targets via the Shellshock module. Once a vulnerability is found, the tool can establish interactive shells on the target system, supporting both reverse TCP and bind TCP connections, and enables file operations and system enumeration.
Commix suits penetration testers and security researchers conducting authorized assessments of web applications. It is particularly valuable for those needing to test multiple injection vectors systematically rather than manually probing each one. The tool's support for multiple backends including PHP, Python, Perl, Ruby, CGI, and experimental support for ASP.NET and JSP makes it applicable across diverse technology stacks. Its filter and WAF evasion capabilities through combinable tamper scripts, along with resumable scans stored in session files, make it practical for complex or interrupted testing scenarios. The flexible targeting options allow testing from single URLs to bulk files or piped input, accommodating various workflow preferences.
The project maintains responsive engagement with its community, with maintainers typically addressing new issues and pull requests within a day. Work in the issue tracker centers on bug reports, investigations, and user support requests, indicating active maintenance focused on stability and user assistance.
