Alternatives to Commix
Open-source tool that detects and exploits command injection vulnerabilities in web applications. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Commix
Open-source tool that detects and exploits command injection vulnerabilities in web applications.
Replacements
Listings that take over the same core job as Commix.
sqlmap
Automates detecting and exploiting SQL injection flaws, for testing your own applications before someone else does.
sqlmap automates detecting and exploiting SQL injection rather than command injection, fingerprinting databases and dumping data on applications you are authorised to test.
Metasploit Framework
The standard open-source exploitation framework for authorised penetration testing and verifying that a vulnerability is real.
Metasploit Framework is a broad exploitation framework with many modules for verifying exploitability, going well beyond Commix's focus on command injection.
ZAP
Inspect and test web applications with the ZAP security proxy.
ZAP combines an intercepting proxy with automated scanning for a range of web flaws, broader but less specialised than Commix's command injection focus.
Wapiti
Check web applications with a Python-based vulnerability scanner.
Wapiti is a Python web vulnerability scanner that automates a range of application security tests rather than concentrating on command injection exploitation.
Similar software
Related functionality, not a direct replacement.
Burp Suite Community Edition
PortSwigger's free web security testing toolkit, for intercepting, inspecting and modifying HTTP traffic by hand.
Caido
Web security testing proxy for auditing web applications.
Nikto
Web server scanner for risky files, outdated software and misconfigurations.
