Commix
Open-source tool that detects and exploits command injection vulnerabilities in web applications.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
About Commix
Commix, short for command injection exploiter, automates finding and exploiting OS command and code injection flaws in web applications. It sends crafted requests to test parameters, confirms exploitable conditions, and can spawn interactive access when a vulnerability is found. It ships with a range of techniques and options for handling different injection contexts.
It is a Python command-line tool aimed at penetration testers and security researchers, and is often bundled in security-focused distributions. It is intended only for testing systems you are authorized to assess.
Strengths
- Automates detection and exploitation of command injection
- Multiple injection techniques and configurable options
- Widely used and actively maintained
Limitations
- Command-line only
- Intended only for authorized testing
Details
- Pricing
- FreeFree and open source.
- License
- Open source, license not stated
- Developer
- Anastasios Stasinopoulos
- Platforms
- Windows, macOS, Linux, Command line
- How it runs
- Downloadable app
- Account
- Not required
- Works offline
- Yes
- Best suited for
- Penetration testers checking web apps for command injection
- Categories
- Network tools, Security tools, Developer tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to Commix
Compare allSoftware that can replace Commix for an important use case, and what changes if you switch.
sqlmap
Automates detecting and exploiting SQL injection flaws, for testing your own applications before someone else does.
sqlmap automates detecting and exploiting SQL injection rather than command injection, fingerprinting databases and dumping data on applications you are authorised to test.
Metasploit Framework
The standard open-source exploitation framework for authorised penetration testing and verifying that a vulnerability is real.
Metasploit Framework is a broad exploitation framework with many modules for verifying exploitability, going well beyond Commix's focus on command injection.
ZAP
Inspect and test web applications with the ZAP security proxy.
ZAP combines an intercepting proxy with automated scanning for a range of web flaws, broader but less specialised than Commix's command injection focus.
Wapiti
Check web applications with a Python-based vulnerability scanner.
Wapiti is a Python web vulnerability scanner that automates a range of application security tests rather than concentrating on command injection exploitation.
Similar software
Related functionality, not necessarily a direct replacement.
Burp Suite Community Edition
PortSwigger's free web security testing toolkit, for intercepting, inspecting and modifying HTTP traffic by hand.
Caido
Web security testing proxy for auditing web applications.
Nikto
Web server scanner for risky files, outdated software and misconfigurations.
