CIP Cyber

Commix: Command Injection Exploiter

Table of Contents

Commix a short form for Command Injection Exploiter is an environment that web developers, penetration testers and even security researchers can use to test web applications in order to find bugs or vulnerabilities.

Commix is written in python programming language. That helps to find vulnerabilities related to command injection attacks. In Command injection attack the goal is to execute arbitrary commands on the host operating system via a vulnerable application. These attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell.

The arbitrary commands will be executed on successful command injection attack through vulnerable application. The features available in Commix include a set of options for specifying which parameters should be injected and to append the injection payloads. User can also define data in POST request as well as employ injection payload suffix and prefix string to exploit the target.

Moreover, it supports base64 encoding for multiple injection techniques (eval-based, time based or file based).

Requirements 

Python version 2.6.x or 2.7.x is required for running this program.

Supported Platform

Linux
Mac OS X
Windows (Experimental)

Installation 

Download commix by cloning the Git repository:

git clone https://github.com/stasinopoulos/commix.git commix

Commix comes packaged on the official repositories of the following Linux distributions:

ArchAssault
BlackArch
Kali Linux
BackBox
Weakerthan

Commix also comes pre-installed, on the following penetration testing frameworks:

The Penetration Testers Framework (PTF)
CTF-Tools
PentestBox
PenBox
Katoolin

Usage

To get a list of all options and switches use:

python commix.py -h


So, do you want to get some ideas on how to use commix? Have a quick look of all available options and switches here.

CIP Cyber Staff

CIP Cyber Staff

CIP Cyber Staff comprises CIP cybersecurity experts committed to delivering comprehensive information on critical infrastructure protection. The content covers diverse topics, equipping professionals to defend organizations and communities in an ever-evolving cyber landscape.

Most popular

Industrial Cybersecurity

Want always be up to date?

Don't miss the latest news

By subscribing to our mailing list, you will be enrolled to receive our new trainings, latest blog posts, product news, and more.

CIP Training & Certifications

Transform your cybersecurity skills with CIP Cyber’s comprehensive training & course offerings

Related Articles

Do Hackers Really use Metasploit? NO!

Undoubtedly, Metasploit is one of the most organized, well-developed tools in the pen-testers toolbox. But, do hackers use it? Some of them, but not the

5 Key Vulnerabilities in Global Payroll

The cyber threat against payroll is growing in sophistication and frequency, according to the latest FBI cybercrime report. Many of these attacks exploit fixable vulnerabilities

Sunset: Dusk VM walkthrough

Sunset: dusk is a vulnerable by design Debian based machine created by whitecrOwz. It is available on https://www.vulnhub.com This machine is ranked as a beginner

Want always be up to date?

Don't miss the latest news

By subscribing to our mailing list, you will be enrolled to receive our new trainings, latest blog posts, product news, and more.

CIP Training & Certifications

Transform your cybersecurity skills with CIP Cyber’s comprehensive training & course offerings