timsonner Commix
Purpose
Use this skill only after manual triage suggests a credible command-injection candidate and the rules of engagement allow controlled validation.
Phase Fit
- Primary: Validation and Controlled Impact Demonstration
- Secondary: Vulnerability Analysis, Retest and Closure
Use When
- Need to validate a likely command-injection issue with the lowest safe settings.
- Need a repeatable retest for an already triaged command-injection candidate.
- Need focused automation around a known proof path.
Avoid When
- No credible injection candidate exists.
- Automated probing would exceed the approved impact level.
Inputs
- Approved URL or request path
- Suspected parameter and auth context
- Stop conditions and impact ceiling
Procedure
- Start with the lowest-risk validation path.
- Validate only the specific parameter or request already under review.
- Stop as soon as the issue is confirmed to the approved standard.
- Record the exact request path and options used.
- Preserve the proof path for retest.
Command Syntax
Replace sample targets with approved in-scope URLs.
# Basic GET parameter injection test
commix --url 'https://portal.contoso.com/ping.php?target=127.0.0.1'
# POST body injection
commix --url 'https://portal.contoso.com/api/exec' --data 'cmd=ls'
# HTTP header injection (X-Forwarded-For)
commix --url 'https://portal.contoso.com/log' --headers 'X-Forwarded-For:*'
# Authenticated scan with session cookie
commix --url 'https://portal.contoso.com/admin/tools' --cookie 'session=<token>'
# Use only time-based blind technique
commix --url 'https://portal.contoso.com/ping.php?ip=127.0.0.1' --technique=time
# Replay a saved HTTP request file
commix --request-file request.txt
Evidence to Capture
- Exact parameter or request path that validated
- Preconditions required for reproduction
- Minimal proof needed for remediation
Safety Boundaries
- Do not escalate beyond minimal proof without explicit written approval.
- Stop immediately if the application shows instability or unintended state changes.