commix
Commix (short for [comm]and [i]njection e[x]ploiter) is an open-source penetration testing tool, written by Anastasios Stasinopoulos (@ancst), that automates the detection and exploitation of command injection vulnerabilities.
Name:commix
Category:Vulnerabilities
Publisher:trickest
Created:9/7/2021
Container:
quay.io/trickest/commix:fc5febe-patch-3Output Type:
License:Unknown
Source:View Source
Parameters
--osForce back-end operating system (e.g. 'Windows' or 'Unix').--allRetrieve everything.--torUse the Tor network.--dataData string to be sent through POST.--hostHTTP Host header.--skipSkip testing for given parameter(s).--alertRun host OS command(s) when injection point is found.--codecForce codec for character encoding (e.g. 'ascii').--crawlCrawl the website starting from the target URL--delaySeconds to delay between each HTTP request.--levelLevel of tests to perform (1-3, Default: 1).--proxyUse a proxy to connect to the target URL.--purgeSafely remove all content from commix data directory.--smartPerform thorough tests only if positive heuristic(s).--usersRetrieve system users.--cookieHTTP Cookie header.--headerExtra header (e.g. 'X-Forwarded-For: 127.0.0.1').--maxlenSet the max length of output for time-related--methodForce usage of given HTTP method (e.g. PUT)--mobileImitate smartphone through HTTP User-Agent header.--os-cmdExecute a single operating system command.--prefixInjection payload prefix string.--suffixInjection payload suffix string.--tamperUse given script(s) for tampering injection data.--answersSet predefined answers (e.g. quit=N,follow=N)--charsetTime-related injection charset (e.g. 0123456789abcdef)--headersExtra headers (e.g. 'Accept-Language: fr
ETag: 123').--is-rootCheck if the current user have root privileges.--offlineWork in offline mode.--refererHTTP Referer header.-rLoad HTTP request from a file.--retriesRetries when the connection timeouts (Default: 3).-sLoad session from a stored (.sqlite) file.-xParse target(s) from remote sitemap(.xml) file.--timeoutSeconds to wait before timeout connection (Default:--auth-urlLogin panel URL.--hostnameRetrieve current hostname.--is-adminCheck if the current user have admin privileges.-lParse target from HTTP proxy log file.--skip-wafSkip heuristic detection of WAF/IPS/IDS protection.--sys-infoRetrieve system information.--time-secSeconds to delay the OS response (Default: 1).--tmp-pathSet the absolute path of web server's temp directory.--tor-portSet Tor proxy port (Default: 8118).--web-rootSet the web server document root directory (e.g. '/var/www').--auth-credHTTP authentication credentials (e.g. 'admin:admin').--auth-dataLogin parameters and data.--auth-typeHTTP authentication type (Basic, Digest, Bearer).--file-destHost's absolute filepath to write and/or upload to.--file-readRead a file from the target host.--force-sslForce usage of SSL/HTTPS.--param-delSet character for splitting parameter values.-pTestable parameter(s).--passwordsRetrieve system users password hashes.--skip-calcSkip the mathematic calculation during the detection--techniqueSpecify injection technique(s) to use.--tor-checkCheck to see if Tor is used properly.-vVerbosity level (0-4, Default: 0).--cookie-delSet character for splitting cookie values.--file-writeWrite to a file on the target host.--no-loggingDisable logging to a file.--privilegesRetrieve system users privileges.--ps-versionRetrieve PowerShell's version number.--shellshockThe 'shellshock' injection module.--skip-emptySkip testing the parameter(s) with empty value(s).--url-reloadReload target URL after command execution.--user-agentHTTP User-Agent header.--alter-shellUse an alternative os-shell (e.g. 'Python').--file-uploadUpload a file on the target host.--ignore-codeIgnore (problematic) HTTP error code (e.g. 401).--current-userRetrieve current user name.--failed-triesSet a number of failed injection tries, in file-based--ignore-proxyIgnore system default proxy settings.--list-tampersDisplay list of available tamper scripts.--random-agentUse a randomly selected HTTP User-Agent header.--crawl-excludeRegexp to exclude pages from crawling (e.g. logout).--flush-sessionFlush session files for current target.--check-internetCheck internet connection before assessing the target.--ignore-sessionIgnore results stored in session file.--skip-techniqueSpecify injection technique(s) to skip.--drop-set-cookieIgnore Set-Cookie header from response.--skip-heuristicsSkip heuristic detection for code injection.--ignore-redirectsIgnore redirection attempts.--ignore-dependenciesIgnore all required third-party library dependencies.