COMMIX(1)

NAME
commix - Automated All-in-One OS Command Injection Exploitation Tool

SYNOPSIS
commix [OPTIONS]

DESCRIPTION
commix (COMmand MIXer) is an open-source penetration testing tool that automates the detection and exploitation of OS command injection vulnerabilities in web applications.

It supports multiple injection techniques, HTTP request formats, authentication methods, session management, and payload tampering. Optional integration with the Metasploit Framework is available via the --msf-path option.

commix is intended for security researchers, penetration testers, and administrators performing authorized security assessments only.

OPTIONS

  General

-h, --help
    Show help and exit.

-v VERBOSE
    Verbosity level (0-4, Default: 0). Level 1 enables basic debug info; level 2 shows all HTTP requests; level 3 adds HTTP response headers; level 4 shows full request and response bodies.

--install
    Install commix system-wide, making it accessible from any location. Requires administrator privileges.

--version
    Show version number and exit.

--update
    Check for updates (apply if any) and exit. Requires installation via git clone from the official repository.

--output-dir=OUTDIR
    Set custom output directory path. The directory is created if it does not exist.

-s SESSION_FILE
    Load session from a stored (.sqlite) file.

--flush-session
    Flush session files for current target. Forces a fresh scan from scratch.

--ignore-session
    Ignore results stored in session file without deleting them. Useful for re-validating findings without losing historical data.

-t TRAFFIC_FILE
    Log all HTTP traffic into a textual file.

--time-limit=SECONDS
    Run with a time limit in seconds (e.g. 3600). Useful in automated environments such as CI/CD pipelines.

--batch
    Never ask for user input, use the default behaviour. Ideal for automation and headless environments.

--skip-heuristics
    Skip heuristic detection for code injection.

--codec=CODEC
    Force codec for character encoding (e.g. 'ascii').

--charset=CHARSET
    Time-related injection charset (e.g. '0123456789abcdef'). Useful for bypassing input filters or WAFs that block certain characters.

--check-internet
    Check internet connection before assessing the target.

--answers=ANSWERS
    Set predefined answers (e.g. 'quit=N,follow=N'). Enables automation by pre-defining responses to interactive prompts.

  Target

-u URL, --url=URL
    Target URL. This option is mandatory unless the target is defined through alternative methods such as log files or bulk input files.

--url-reload
    Reload target URL after command execution. Useful when the application state changes after each injection attempt.

-l LOGFILE
    Parse target from HTTP proxy log file.

-m BULKFILE
    Scan multiple targets given in a textual file.

-r REQUESTFILE
    Load HTTP request from a file. The file must contain the full raw HTTP request as sent to the server.

--crawl=CRAWLDEPTH
    Crawl the website starting from the target URL (Default: 1). Higher depths increase scan duration and server load.

--crawl-exclude=REGEXP
    Regexp to exclude pages from crawling (e.g. 'logout').

-x SITEMAP_URL
    Parse target(s) from remote sitemap(.xml) file.

--method=METHOD
    Force usage of given HTTP method (e.g. 'PUT'). Useful for testing RESTful APIs or non-standard endpoints.

  Request

-d DATA, --data=DATA
    Data string to be sent through POST. When provided, commix automatically switches from GET to POST.

--host=HOST
    HTTP Host header. Tested if --level is set to 3.

--referer=REFERER
    HTTP Referer header. Tested if --level is set to 3.

--user-agent=AGENT
    HTTP User-Agent header. Tested if --level is set to 3.

--random-agent
    Use a randomly selected HTTP User-Agent header from a built-in list. Useful for evading basic WAF or CDN filtering.

--param-del=PDEL
    Set character for splitting parameter values (default: '&').

--cookie=COOKIE
    HTTP Cookie header (e.g. 'key1=value1; key2=value2').

--cookie-del=CDEL
    Set character for splitting cookie values (default: ';').

--http1.0
    Force requests to use the HTTP/1.0 protocol. Useful for legacy servers.

-H HEADER, --header=HEADER
    Extra header (e.g. 'X-Forwarded-For: 127.0.0.1'). For multiple headers use --headers.

--headers=HEADERS
    Extra headers separated by '\n' (e.g. 'Accept-Language: fr\nETag: 123').

--proxy=PROXY
    Use an HTTP proxy to connect to the target URL (e.g. 'http://127.0.0.1:8080'). For SOCKS proxies, use proxychains.

--tor
    Use the Tor network. Requires the Tor service to be running.

--tor-port=PORT
    Set Tor proxy port (Default: 8118). Use 9050 for the native Tor SOCKS port when combined with proxychains.

--auth-url=URL
    Login panel URL. Use with --auth-data to enable automated authentication.

--auth-data=DATA
    Login parameters and data (e.g. 'user=admin&pass=1234').

--auth-type=TYPE
    HTTP authentication type (Basic, Digest, Bearer).

--auth-cred=CRED
    HTTP authentication credentials (e.g. 'admin:admin').

--abort-code=CODE
    Abort on (problematic) HTTP error code(s) (e.g. '401,403').

--ignore-code=CODE
    Ignore (problematic) HTTP error code(s) (e.g. '404,403').

--force-ssl
    Force usage of SSL/HTTPS regardless of the URL scheme.

--ignore-proxy
    Ignore system default proxy settings.

--ignore-redirects
    Ignore redirection attempts (HTTP 3xx).

--timeout=SECONDS
    Seconds to wait before timeout connection (Default: 30).

--retries=RETRIES
    Retries when the connection timeouts (Default: 3).

--drop-set-cookie
    Ignore Set-Cookie header from response. Useful for maintaining a stable session throughout the scan.

  Enumeration

--all
    Retrieve everything.

--current-user
    Retrieve current user name.

--hostname
    Retrieve current hostname.

--is-root
    Check if the current user has root privileges (Unix/Linux).

--is-admin
    Check if the current user has admin privileges (Windows).

--sys-info
    Retrieve system information (OS version, kernel, architecture).

--users
    Retrieve system users.

--passwords
    Retrieve system users password hashes.

--privileges
    Retrieve system users privileges.

--ps-version
    Retrieve PowerShell's version number (Windows targets).

  File Access

--file-read=FILEPATH
    Read a file from the target host (e.g. '/etc/passwd').

--file-write=FILEPATH
    Write a local file to the target host. Use with --file-dest.

--file-dest=FILEPATH
    Host's absolute filepath to write and/or upload to.

  Modules

--shellshock
    Enable the Shellshock (CVE-2014-6271) injection module. Tests CGI scripts that rely on Bash, where injected payloads in HTTP headers (User-Agent, Referer, Cookie) may be executed.

  Injection

-p PARAMETER
    Testable parameter(s). Multiple parameters can be specified as a comma-separated list.

--skip=PARAMETER
    Skip testing for given parameter(s).

--suffix=SUFFIX
    Injection payload suffix string. Useful for closing quotes or syntax elements in the injection context.

--prefix=PREFIX
    Injection payload prefix string. Useful for opening quotes or syntax elements in the injection context.

--technique=TECH
    Specify injection technique(s) to use. Available techniques:

    C   Classic - results-based injection; output is reflected directly in the HTTP response.

    E   Dynamic Code Evaluation - targets eval() or similar functions (e.g. assert(), preg_replace() with /e in PHP).

    T   Time-based - blind injection via conditional response delays (e.g. sleep, timeout). Useful when output is suppressed.

    F   File-based - semi-blind injection that writes command output to a file on the server and reads it back.
Multiple techniques can be combined (e.g. --technique='ctf').

--skip-technique=TECH
    Specify injection technique(s) to skip (e.g. --skip-technique='tf').

--maxlen=MAXLEN
    Set the max length of output for time-related injection techniques (Default: 10000 chars).

--delay=SECONDS
    Seconds to delay between each HTTP request. Helps evade rate-limiting and WAF mechanisms.

--time-sec=SECONDS
    Seconds to delay the OS response in time-based techniques (Default: 1).

--tmp-path=PATH
    Set the absolute path of web server's temp directory.

--web-root=PATH
    Set the web server document root directory (e.g. '/var/www').

--alter-shell=SHELL
    Use an alternative os-shell (e.g. 'Python'). Useful when the default shell is restricted.

--os-cmd=COMMAND
    Execute a single operating system command and display the output.

--os=OS
    Force back-end operating system (e.g. 'Windows' or 'Unix'). Overrides automatic OS detection.

--tamper=SCRIPT
    Use given script(s) for tampering injection data. Useful for bypassing WAFs and input filters. See --list-tampers for available scripts.

--msf-path=PATH
    Set a local path where Metasploit Framework is installed (e.g. '/opt/metasploit-framework'). Enables post-exploitation integration with MSF modules.

  Detection

--level=LEVEL
    Level of tests to perform (1-3, Default: 1).

    1   Tests URL parameters and POST data only.

    2   Includes level 1 plus injection testing in HTTP cookies.

    3   Includes level 2 plus injection testing in HTTP headers (User-Agent, Referer, Host, etc.).

--skip-calc
    Skip the mathematic calculation during the detection phase.

--skip-empty
    Skip testing the parameter(s) with empty value(s).

--failed-tries=N
    Set a number of failed injection tries before aborting, in file-based technique.

--smart
    Perform thorough tests only if positive heuristic(s). Reduces false positives and shortens scan time.

  Miscellaneous

--ignore-dependencies
    Ignore all required third-party library dependencies. Use with caution as it may reduce functionality.

--list-tampers
    Display list of available tamper scripts.

--alert=COMMAND
    Run host OS command(s) when injection point is found. Useful for triggering alerts or integrating with external monitoring tools.

--no-logging
    Disable logging to a file. Results are shown in the console only.

--purge
    Safely remove all content from commix data directory (cache, sessions, logs).

--skip-waf
    Skip heuristic detection of WAF/IPS/IDS protection.

--mobile
    Imitate smartphone through HTTP User-Agent header. Useful for testing mobile-specific application interfaces.

--offline
    Work in offline mode, disabling update checks and internet requirements.

--wizard
    Simple wizard interface for beginner users.

--disable-coloring
    Disable console output coloring. Useful when logging to files or in terminals without color support.

EXAMPLES

Test a URL for command injection vulnerabilities:
    commix -u http://example.com/search.php?query=test

Test a POST request:
    commix -u http://example.com/login.php -d user=admin&pass=test

Test with a specific parameter and higher verbosity:
    commix -u http://example.com/page.php?id=1&name=test -p name -v 3

Test using a saved HTTP request file:
    commix -r /tmp/request.txt

Test through a proxy (e.g. Burp Suite):
    commix -u http://example.com/?id=1 --proxy="http://127.0.0.1:8080"

Test through the Tor network:
    commix -u http://example.com/?id=1 --tor --tor-port=9050

Use only Classic and Time-based techniques:
    commix -u http://example.com/?id=1 --technique=ct

Test at level 3 (includes HTTP headers):
    commix -u http://example.com/?id=1 --level=3 --random-agent

Test for Shellshock in a CGI endpoint:
    commix -u http://example.com/cgi-bin/status/ --shellshock

Retrieve current user and system information upon successful injection:
    commix -u http://example.com/?id=1 --current-user --sys-info

Read a remote file from the target host:
    commix -u http://example.com/?id=1 --file-read="/etc/passwd"

Write a local file to the target host:
    commix -u http://example.com/?id=1 --file-write="shell.php" --file-dest="/var/www/html/shell.php"

Run in batch mode with time limit:
    commix -u http://example.com/?id=1 --batch --time-limit=120

Use a tamper script to bypass WAF filtering:
    commix -u http://example.com/?id=1 --tamper=space2plus

Scan multiple targets from a file:
    commix -m /tmp/targets.txt --batch

Pipeline with waybackurls for automated target discovery:
    echo example.com | waybackurls | grep vuln.php | commix --data="addr=1" --os-cmd="whoami" --batch

LEGAL DISCLAIMER
Usage of commix for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

SEE ALSO
sqlmap(1), nmap(1), curl(1), proxychains(1)

AUTHOR
Anastasios Stasinopoulos <ancst@commixproject.com>

This manual page was written by Josenilson Ferreira da Silva <nilsonfsilva@hotmail.com> for the Debian project (but may be used by others).