Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Vulnerabilities

Confirm command injection and run host commands

commix is an open-source command-injection tool that automates the detection and exploitation of operating-system command and code injection flaws in web applications, supporting classic, eval-based, and time-based techniques.

installgit clone https://github.com/commixproject/commix.git

Python

Agent
Detect command injection automaticallyExploit a confirmed injectionTest through proxies and filters

overview

What commix does

Commix automates OS command injection testing against a URL. Name injectable fields with -p, send POST bodies with --data, and confirm across classic, eval, time, and file techniques.

Raise --level (1-3) for more injection points. Limit methods with --technique, evade filters with --tamper, and hop through --proxy when needed. --crawl can discover parameters when you have not named one yet.

Trickest hosts Commix as a managed Vulnerabilities node: target URL or file in, results folder out. Feed endpoints a crawler already surfaced; confirmed injections are high-priority findings for the rest of the pipeline.

source github.com/commixproject/commix

use cases

Where commix fits

Detect command injection automatically

Test a URL and its parameters across classic, eval-based, time-based, and file-based techniques so injectable points get confirmed without hand-crafting payloads.

Exploit a confirmed injection

Once a point is found, run host commands with --os-cmd or an interactive os-shell, read and write files, and retrieve system info to demonstrate real impact.

Test through proxies and filters

Route requests through --proxy or --tor and apply --tamper scripts so testing reaches targets behind WAFs and network controls.

Crawl for testable parameters

Enable --crawl or sitemap parsing so Commix discovers parameters to test instead of relying on a single value you pass with -p.

reference

commix inputs and flags

86 inputs
NameTypeFlagDescription
urlSTRING·Target URL to test.
parameterSTRING-pTestable parameter(s) to inject into.
dataSTRING--dataData string sent through POST.
levelSTRING--levelLevel of tests to perform (1-3, default 1).
techniqueSTRING--techniqueInjection technique(s) to use (classic, eval, time, file).
os-cmdSTRING--os-cmdExecute a single operating system command on the host.
crawlBOOLEAN--crawlCrawl the website starting from the target URL.
proxySTRING--proxyRoute requests through a proxy to reach the target.

Showing key inputs. commix exposes 86 inputs in total.

Full flag reference (86 inputs)
NameTypeFlagDescription
osSTRING--osForce back-end operating system (e.g. 'Windows' or 'Unix').
allBOOLEAN--allRetrieve everything.
torBOOLEAN--torUse the Tor network.
urlSTRING·Target URL.
dataSTRING--dataData string to be sent through POST.
hostSTRING--hostHTTP Host header.
skipSTRING--skipSkip testing for given parameter(s).
urlsFILE·Scan multiple targets given in a textual file.
alertSTRING--alertRun host OS command(s) when injection point is found.
codecSTRING--codecForce codec for character encoding (e.g. 'ascii').
crawlBOOLEAN--crawlCrawl the website starting from the target URL
delaySTRING--delaySeconds to delay between each HTTP request.
levelSTRING--levelLevel of tests to perform (1-3, Default: 1).
proxySTRING--proxyUse a proxy to connect to the target URL.
purgeBOOLEAN--purgeSafely remove all content from commix data directory.
smartBOOLEAN--smartPerform thorough tests only if positive heuristic(s).
usersBOOLEAN--usersRetrieve system users.
cookieSTRING--cookieHTTP Cookie header.
headerSTRING--headerExtra header (e.g. 'X-Forwarded-For: 127.0.0.1').
maxlenSTRING--maxlenSet the max length of output for time-related
methodSTRING--methodForce usage of given HTTP method (e.g. PUT)
mobileBOOLEAN--mobileImitate smartphone through HTTP User-Agent header.
os-cmdSTRING--os-cmdExecute a single operating system command.
prefixSTRING--prefixInjection payload prefix string.
suffixSTRING--suffixInjection payload suffix string.
tamperSTRING--tamperUse given script(s) for tampering injection data.
answersSTRING--answersSet predefined answers (e.g. "quit=N,follow=N")
charsetSTRING--charsetTime-related injection charset (e.g. "0123456789abcdef")
headersSTRING--headersExtra headers (e.g. 'Accept-Language: fr\nETag: 123').
is-rootBOOLEAN--is-rootCheck if the current user have root privileges.
offlineBOOLEAN--offlineWork in offline mode.
refererSTRING--refererHTTP Referer header.
requestFILE-rLoad HTTP request from a file.
retriesSTRING--retriesRetries when the connection timeouts (Default: 3).
sessionFILE-sLoad session from a stored (.sqlite) file.
sitemapBOOLEAN-xParse target(s) from remote sitemap(.xml) file.
timeoutSTRING--timeoutSeconds to wait before timeout connection (Default:
auth-urlSTRING--auth-urlLogin panel URL.
hostnameBOOLEAN--hostnameRetrieve current hostname.
is-adminBOOLEAN--is-adminCheck if the current user have admin privileges.
log-fileFILE-lParse target from HTTP proxy log file.
skip-wafBOOLEAN--skip-wafSkip heuristic detection of WAF/IPS/IDS protection.
sys-infoBOOLEAN--sys-infoRetrieve system information.
time-secSTRING--time-secSeconds to delay the OS response (Default: 1).
tmp-pathSTRING--tmp-pathSet the absolute path of web server's temp directory.
tor-portSTRING--tor-portSet Tor proxy port (Default: 8118).
web-rootSTRING--web-rootSet the web server document root directory (e.g. '/var/www').
auth-credSTRING--auth-credHTTP authentication credentials (e.g. 'admin:admin').
auth-dataSTRING--auth-dataLogin parameters and data.
auth-typeSTRING--auth-typeHTTP authentication type (Basic, Digest, Bearer).
file-destSTRING--file-destHost's absolute filepath to write and/or upload to.
file-readSTRING--file-readRead a file from the target host.
force-sslBOOLEAN--force-sslForce usage of SSL/HTTPS.
param-delSTRING--param-delSet character for splitting parameter values.
parameterSTRING-pTestable parameter(s).
passwordsBOOLEAN--passwordsRetrieve system users password hashes.
skip-calcBOOLEAN--skip-calcSkip the mathematic calculation during the detection
techniqueSTRING--techniqueSpecify injection technique(s) to use.
tor-checkBOOLEAN--tor-checkCheck to see if Tor is used properly.
verbositySTRING-vVerbosity level (0-4, Default: 0).
cookie-delSTRING--cookie-delSet character for splitting cookie values.
file-writeSTRING--file-writeWrite to a file on the target host.
no-loggingBOOLEAN--no-loggingDisable logging to a file.
privilegesBOOLEAN--privilegesRetrieve system users privileges.
ps-versionBOOLEAN--ps-versionRetrieve PowerShell's version number.
shellshockBOOLEAN--shellshockThe 'shellshock' injection module.
skip-emptyBOOLEAN--skip-emptySkip testing the parameter(s) with empty value(s).
url-reloadBOOLEAN--url-reloadReload target URL after command execution.
user-agentSTRING--user-agentHTTP User-Agent header.
alter-shellSTRING--alter-shellUse an alternative os-shell (e.g. 'Python').
file-uploadSTRING--file-uploadUpload a file on the target host.
ignore-codeSTRING--ignore-codeIgnore (problematic) HTTP error code (e.g. 401).
current-userBOOLEAN--current-userRetrieve current user name.
failed-triesSTRING--failed-triesSet a number of failed injection tries, in file-based
ignore-proxyBOOLEAN--ignore-proxyIgnore system default proxy settings.
list-tampersBOOLEAN--list-tampersDisplay list of available tamper scripts.
random-agentBOOLEAN--random-agentUse a randomly selected HTTP User-Agent header.
crawl-excludeSTRING--crawl-excludeRegexp to exclude pages from crawling (e.g. "logout").
flush-sessionBOOLEAN--flush-sessionFlush session files for current target.
check-internetBOOLEAN--check-internetCheck internet connection before assessing the target.
ignore-sessionBOOLEAN--ignore-sessionIgnore results stored in session file.
skip-techniqueSTRING--skip-techniqueSpecify injection technique(s) to skip.
drop-set-cookieBOOLEAN--drop-set-cookieIgnore Set-Cookie header from response.
skip-heuristicsBOOLEAN--skip-heuristicsSkip heuristic detection for code injection.
ignore-redirectsBOOLEAN--ignore-redirectsIgnore redirection attempts.
ignore-dependenciesBOOLEAN--ignore-dependenciesIgnore all required third-party library dependencies.

example

Run commix

commix · command
# detect and exploit command injection in the 'addr' POST parameter
commix -u "https://example.com/ping.php" --data="addr=127.0.0.1" -p addr --level=2 --os-cmd="id"
sample output
[*] Checking connection to the target URL... [ ok ]
[*] Setting the POST parameter 'addr' for tests.
[*] Testing the (results-based) classic command injection technique... [ succeed ]
[+] The POST parameter 'addr' seems injectable via (results-based) classic command injection technique.
    [~] Payload: ;echo VCEKZP$((80+27))$(echo VCEKZP)VCEKZP
[*] Type "?" for available options.
commix(os_shell) > id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
commix(os_shell) > hostname
web01.example.com

guidance

Choosing commix

Reach for Commix when you suspect OS command injection and want detection plus exploitation in one tool. For SQL injection use sqlmap; for broad CVE coverage use nuclei. Feed it endpoints that take user input.

sqlmap

Automates SQL injection. Commix is the command-injection counterpart with the same detect-and-exploit model.

nuclei

Template scanner for broad coverage. Commix goes deeper on one injection class.

tplmap

Targets server-side template injection. Different bug class, similar exploit flow.

faq

commix questions

Classic, eval-based, time-based, and file-based OS command injection. Narrow the set with --technique, or skip methods with --skip-technique.

Set --user-agent for a custom value, --random-agent to rotate a browser string, or --mobile to imitate a smartphone. The default Agent names the tool and is easy for WAFs to spot.

Run a single command with --os-cmd, read a file with --file-read, or gather host details with --sys-info, --current-user, or --is-root. Use --all when you want the full enumeration set.

Raise --level from 1 to 3, choose methods with --technique, and enable --crawl (or -x for a sitemap) so it finds parameters instead of relying only on -p.

Route through --proxy or --tor, apply --tamper scripts (list them with --list-tampers), and add --skip-waf to skip built-in protection heuristics. Pace with --delay and --time-sec.

Pass the body with --data (for example --data="addr=127.0.0.1") and name the field with -p. Commix also injects through --cookie, --header, and --referer, or loads a saved request with -r.

related

More Vulnerabilities tools

  1. agentsleak

    Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.

  2. dalfox

    Parameter mining and XSS testing with headless verification.

  3. dnsreaper

    Subdomain takeover scanner with cloud-zone intake.

  4. find-gh-poc

    Locate public CVE proof-of-concept repositories on GitHub.

  5. golemhalt

    Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.

  6. honeymcp

    Black Hat Arsenal deception layer for MCP servers, exported as a schedulable ghost-tool catalog.

Run commix yourself

A target feeds katana to surface parameters, then Commix tests them for command injection and writes confirmed injections as output.

Run commix in TrickestBrowse the library

Facts on this page come from the live Trickest tool library.