Commix

Commix (short for [comm]and [i]njection e[x]ploiter) is designed for web developers, penetration testers, and security researchers to test web applications for command injection vulnerabilities. It automates the detection and exploitation of command injection bugs, errors, or flaws in vulnerable parameters or strings. Written in Python, it provides a simple environment to identify and exploit these security issues efficiently.

The tool supports various injection techniques including classic, time-based, blind, and results-based methods. It can test parameters in URLs, POST data, HTTP headers like Referer and User-Agent, and cookies. Once a vulnerability is found, commix offers a pseudo-terminal shell for interactive command execution on the target system.

Use cases include security assessments of web applications to find OS command injection flaws, automated vulnerability scanning, and post-exploitation activities through gained shell access.

Commix tests web parameters and HTTP headers for command injection vulnerabilities using multiple techniques: results-based classic injection, time-based blind injection, dynamic code evaluation, and tempfile-based semi-blind injection. It sends payloads like ';echo KSXTLU$((18+64))$(echo KSXTLU)KSXTLU' or Windows-specific '%26 for /f "delims=" %i in ('cmd /c "set /a (49+1)"') do @set /p = AWMZVA%iAWMZVAAWMZVA' to detect injectable points. Upon success, it provides an os_shell for command execution, supporting enumeration (--current-user, --sys-info), file access (--file-read, --file-write), and shell options like reverse_tcp/bind_tcp.