COMMIX(1)

📦 version 4.1, in ubuntu stonking

💖 NAME 💖 — commix(1)

bestie, welcome to the commix(1) page from the User Commands section. commix — Automated All-in-One OS Command Injection Exploitation Tool. periodt. 💅

🌈 SYNOPSIS 🌈

commix [OPTIONS]

💅 DESCRIPTION 💅

okay so commix (aka COMmand MIXer) is an open-source penetration testing tool that automates the detection and exploitation of OS command injection vulnerabilities in web applications. it's giving automation queen, no cap. 👑

It supports multiple injection techniques, HTTP request formats, authentication methods, session management, and payload tampering. Optional integration with the Metasploit Framework is available via the --msf-path option. iykyk 😌

⚠️ commix is intended for security researchers, penetration testers, and administrators performing authorized security assessments only. bestie, do not be out here testing random websites, that is NOT the vibe. 🚨

🎀 OPTIONS 🎀

✨ General ✨

  • -h, --help — shows help and exits. the classic “help me help you” button. 👋💖
  • -v VERBOSE — verbosity level (0-4, Default: 0). Level 1 enables basic debug info; level 2 shows all HTTP requests; level 3 adds HTTP response headers; level 4 shows full request and response bodies. the way this escalates... 💀
  • --install — installs commix system-wide, making it accessible from any location. Requires administrator privileges. so, sudo energy. 🔐
  • --version — shows the version number and exits. simple, iconic, done. ⭐
  • --update — checks for updates (applies them if there are any) and exits. Requires installation via git clone from the official repository. git bestie behaviour. 🧚
  • --output-dir=OUTDIR — sets a custom output directory path. The directory is created if it does not exist. auto-magic folder creation ✨
  • -s SESSION_FILE — loads session from a stored (.sqlite) file. save your progress, main character. 💾
  • --flush-session — flushes session files for the current target. Forces a fresh scan from scratch. blank slate era. 🧼
  • --ignore-session — ignores results stored in the session file without deleting them. Useful for re-validating findings without losing historical data. best of both worlds. 🦋
  • -t TRAFFIC_FILE — logs all HTTP traffic into a textual file. tea, but make it forensic. 🍵
  • --time-limit=SECONDS — runs with a time limit in seconds (e.g. 3600). Useful in automated environments such as CI/CD pipelines. automation girlies rise. 🤖
  • --batch — never asks for user input, uses the default behaviour. Ideal for automation and headless environments. no thoughts, just defaults. 😶‍🌫️
  • --skip-heuristics — skips heuristic detection for code injection. skip! 🦘
  • --codec=CODEC — forces codec for character encoding (e.g. 'ascii'). encoding but make it decisive. 🔤
  • --charset=CHARSET — time-related injection charset (e.g. '0123456789abcdef'). Useful for bypassing input filters or WAFs that block certain characters. sneaky link 👀
  • --check-internet — checks internet connection before assessing the target. bestie we gotta make sure the wifi is wifi-ing. 📶
  • --answers=ANSWERS — sets predefined answers (e.g. 'quit=N,follow=N'). Enables automation by pre-defining responses to interactive prompts. scripted responses, slay. 💬

🎯 Target 🎯

  • -u URL, --url=URL — target URL. This option is mandatory unless the target is defined through alternative methods such as log files or bulk input files. the main character option. 🌟
  • --url-reload — reloads target URL after command execution. Useful when the application state changes after each injection attempt. refresh refresh refresh. 🔄
  • -l LOGFILE — parses target from HTTP proxy log file. forensics era. 🔍
  • -m BULKFILE — scans multiple targets given in a textual file. not one, not two, but many. 👯
  • -r REQUESTFILE — loads HTTP request from a file. The file must contain the full raw HTTP request as sent to the server. copy-paste realness. 📋
  • --crawl=CRAWLDEPTH — crawls the website starting from the target URL (Default: 1). Higher depths increase scan duration and server load. go deeper, but respectfully. 🕷️
  • --crawl-exclude=REGEXP — regexp to exclude pages from crawling (e.g. 'logout'). not that page, bestie. 🚫
  • -x SITEMAP_URL — parses target(s) from remote sitemap(.xml) file. xml girlies understand. 🗺️
  • --method=METHOD — forces usage of a given HTTP method (e.g. 'PUT'). Useful for testing RESTful APIs or non-standard endpoints. RESTful realness. 🛠️

📨 Request 📨

  • -d DATA, --data=DATA — data string to be sent through POST. When provided, commix automatically switches from GET to POST. glow-up from GET to POST. ✨
  • --host=HOST — HTTP Host header. Tested if --level is set to 3. header homework. 📚
  • --referer=REFERER — HTTP Referer header. Tested if --level is set to 3. where did you come from, where did you go. 🕵️
  • --user-agent=AGENT — HTTP User-Agent header. Tested if --level is set to 3. identity crisis, but on purpose. 🎭
  • --random-agent — uses a randomly selected HTTP User-Agent header from a built-in list. Useful for evading basic WAF or CDN filtering. randomize me. 🎲
  • --param-del=PDEL — sets character for splitting parameter values (default: '&'). the & stays undefeated. 💪
  • --cookie=COOKIE — HTTP Cookie header (e.g. 'key1=value1; key2=value2'). cookie monster behaviour. 🍪
  • --cookie-del=CDEL — sets character for splitting cookie values (default: ';'). semicolon stans rise. ⁉️
  • --http1.0 — forces requests to use the HTTP/1.0 protocol. Useful for legacy servers. old-school cool. 👵
  • -H HEADER, --header=HEADER — extra header (e.g. 'X-Forwarded-For: 127.0.0.1'). For multiple headers use --headers. header drip. 💅
  • --headers=HEADERS — extra headers separated by '\n' (e.g. 'Accept-Language: fr\nETag: 123'). newline girlies know. 📝
  • --proxy=PROXY — uses an HTTP proxy to connect to the target URL (e.g. 'http://127.0.0.1:8080'). For SOCKS proxies, use proxychains. proxy princess. 👑
  • --tor — uses the Tor network. Requires the Tor service to be running. anonymity era. 🧅
  • --tor-port=PORT — sets Tor proxy port (Default: 8118). Use 9050 for the native Tor SOCKS port when combined with proxychains. port check, bestie. 🔌
  • --auth-url=URL — login panel URL. Use with --auth-data to enable automated authentication. login automation slay. 🔑
  • --auth-data=DATA — login parameters and data (e.g. 'user=admin&pass=1234'). credentials but make them parameters. 🔐
  • --auth-type=TYPE — HTTP authentication type (Basic, Digest, Bearer). pick your fighter. 🥊
  • --auth-cred=CRED — HTTP authentication credentials (e.g. 'admin:admin'). the classic admin/admin moment. 🙈
  • --abort-code=CODE — aborts on (problematic) HTTP error code(s) (e.g. '401,403'). stop right there. 🛑
  • --ignore-code=CODE — ignores (problematic) HTTP error code(s) (e.g. '404,403'). not today, error code. 🙅
  • --force-ssl — forces usage of SSL/HTTPS regardless of the URL scheme. secure the bag. 🔒
  • --ignore-proxy — ignores system default proxy settings. proxy? never heard of her. 💁
  • --ignore-redirects — ignores redirection attempts (HTTP 3xx). no detours. 🚧
  • --timeout=SECONDS — seconds to wait before timeout connection (Default: 30). patience is a virtue. ⏳
  • --retries=RETRIES — retries when the connection timeouts (Default: 3). try, try, try again. 🔁
  • --drop-set-cookie — ignores Set-Cookie header from response. Useful for maintaining a stable session throughout the scan. session stability queen. 🍪🚫

🔍 Enumeration 🔍

  • --all — retrieve everything. gimme the whole lore. 📚
  • --current-user — retrieves current user name. who dis? 👤
  • --hostname — retrieves current hostname. hello, my name is... 🏷️
  • --is-root — checks if the current user has root privileges (Unix/Linux). root check. 👑
  • --is-admin — checks if the current user has admin privileges (Windows). admin check. 🪟
  • --sys-info — retrieves system information (OS version, kernel, architecture). tell me everything. 💻
  • --users — retrieves system users. the whole guest list. 👥
  • --passwords — retrieves system users password hashes. hash girlies, this one’s for you. 🔐
  • --privileges — retrieves system users privileges. who can do what. 🎟️
  • --ps-version — retrieves PowerShell's version number (Windows targets). PowerShell bestie check. ⚡

📂 File Access 📂

  • --file-read=FILEPATH — reads a file from the target host (e.g. '/etc/passwd'). file reading era. 📖
  • --file-write=FILEPATH — writes a local file to the target host. Use with --file-dest. upload but make it specific. 📤
  • --file-dest=FILEPATH — host's absolute filepath to write and/or upload to. destination, not suggestion. 📍

🧩 Modules 🧩

  • --shellshock — enables the Shellshock (CVE-2014-6271) injection module. Tests CGI scripts that rely on Bash, where injected payloads in HTTP headers (User-Agent, Referer, Cookie) may be executed. vintage vulnerability, still iconic. 🐚💥

💉 Injection 💉

  • -p PARAMETER — testable parameter(s). Multiple parameters can be specified as a comma-separated list. pick your targets. 🎯
  • --skip=PARAMETER — skips testing for given parameter(s). not this one, bestie. ⏭️
  • --suffix=SUFFIX — injection payload suffix string. Useful for closing quotes or syntax elements in the injection context. closing the vibe. 🔚
  • --prefix=PREFIX — injection payload prefix string. Useful for opening quotes or syntax elements in the injection context. opening the vibe. 🔛
  • --technique=TECH — specify injection technique(s) to use. Available techniques:
    • C — Classic - results-based injection; output is reflected directly in the HTTP response. reflected realness. 🪞
    • E — Dynamic Code Evaluation - targets eval() or similar functions (e.g. assert(), preg_replace() with /e in PHP). eval era. 🧠
    • T — Time-based - blind injection via conditional response delays (e.g. sleep, timeout). Useful when output is suppressed. wait for it... ⏱️
    • F — File-based - semi-blind injection that writes command output to a file on the server and reads it back. write, read, slay. 📝

Multiple techniques can be combined (e.g. --technique='ctf'). combo meal 🍟

  • --skip-technique=TECH — specifies injection technique(s) to skip (e.g. --skip-technique='tf'). not those techniques. 🚫
  • --maxlen=MAXLEN — sets the max length of output for time-related injection techniques (Default: 10000 chars). character limit, but make it hacker. 🔢
  • --delay=SECONDS — seconds to delay between each HTTP request. Helps evade rate-limiting and WAF mechanisms. slow down to speed up. 🐢
  • --time-sec=SECONDS — seconds to delay the OS response in time-based techniques (Default: 1). one second of suspense. ⏲️
  • --tmp-path=PATH — sets the absolute path of web server's temp directory. temp folder, but fancy. 📁
  • --web-root=PATH — sets the web server document root directory (e.g. '/var/www'). root directory realness. 🌐
  • --alter-shell=SHELL — uses an alternative os-shell (e.g. 'Python'). Useful when the default shell is restricted. plan B slay. 🐍
  • --os-cmd=COMMAND — executes a single operating system command and displays the output. one command, one moment. ⚡
  • --os=OS — forces back-end operating system (e.g. 'Windows' or 'Unix'). Overrides automatic OS detection. OS but make it manual. 🖥️
  • --tamper=SCRIPT — uses given script(s) for tampering injection data. Useful for bypassing WAFs and input filters. See --list-tampers for available scripts. tamper tantrum. 🎭
  • --msf-path=PATH — sets a local path where Metasploit Framework is installed (e.g. '/opt/metasploit-framework'). Enables post-exploitation integration with MSF modules. MSF crossover episode. 🚀

🕵️ Detection 🕵️

  • --level=LEVEL — level of tests to perform (1-3, Default: 1).
    • 1 — Tests URL parameters and POST data only. starter pack. 🍼
    • 2 — Includes level 1 plus injection testing in HTTP cookies. cookies get tested too. 🍪
    • 3 — Includes level 2 plus injection testing in HTTP headers (User-Agent, Referer, Host, etc.). headers join the party. 🎉
  • --skip-calc — skips the mathematic calculation during the detection phase. math? skipped. ➗🚫
  • --skip-empty — skips testing the parameter(s) with empty value(s). empty? not today. 🕳️
  • --failed-tries=N — sets a number of failed injection tries before aborting, in file-based technique. know when to fold 'em. 🃏
  • --smart — does the full thorough test only when there's a positive heuristic to go on. Basically: it waits for a vibe check before going all in. 💅 Fewer false positives, shorter scan time. Win-win.

✨ Miscellaneous ✨

  • --ignore-dependencies — ignores every single required third-party library dependency. 🫶 Careful though, bestie — the manpage literally says use with caution, because it may reduce functionality. Not everything survives when you cut the side quests.
  • --list-tampers — shows you the list of tamper scripts that are available. Window shopping, but for payload mutators. 🛍️
  • --alert=COMMAND — runs host OS command(s) the moment an injection point is found. Perfect for triggering alerts or hooking into external monitoring tools. 📣 Like a little "we found it!!" bat signal.
  • --no-logging — turns off logging to a file. Results show up in the console only. 🙈
  • --purge — safely removes all content from the commix data directory — that's cache, sessions, and logs. A full reset, no crumbs left. 🧹
  • --skip-waf — skips the heuristic detection of WAF/IPS/IDS protection. 🚪 Just walks right past the bouncer.
  • --mobile — imitates a smartphone via the HTTP User-Agent header. Handy for testing mobile-specific application interfaces. 📱
  • --offline — offline mode, baby: no update checks, no internet requirements. ✈️
  • --wizard — a simple wizard interface, made for beginner users. 🧙‍♀️ Everyone starts somewhere, and that's iconic.
  • --disable-coloring — kills the console output coloring. Great when you're logging to files or stuck in a terminal with no color support. 🎨🚫

🍓 EXAMPLES 🍓

Ok bestie, this is the part where it all clicks. Here's how people actually run it:

Test a URL for command injection vulnerabilities:

commix -u http://example.com/search.php?query=test

Test a POST request:

commix -u http://example.com/login.php -d user=admin&pass=test

Test with a specific parameter and higher verbosity:

commix -u http://example.com/page.php?id=1&name=test -p name -v 3

Test using a saved HTTP request file:

commix -r /tmp/request.txt

Test through a proxy (e.g. Burp Suite):

commix -u http://example.com/?id=1
--proxy="http://127.0.0.1:8080"

Test through the Tor network:

commix -u http://example.com/?id=1 --tor --tor-port=9050

Use only Classic and Time-based techniques:

commix -u http://example.com/?id=1 --technique=ct

Test at level 3 (includes HTTP headers):

commix -u http://example.com/?id=1 --level=3 --random-agent

Test for Shellshock in a CGI endpoint:

commix -u http://example.com/cgi-bin/status/ --shellshock

Retrieve current user and system information upon successful injection:

commix -u http://example.com/?id=1 --current-user --sys-info

Read a remote file from the target host:

commix -u http://example.com/?id=1 --file-read="/etc/passwd"

Write a local file to the target host:

commix -u http://example.com/?id=1 --file-write="shell.php"
--file-dest="/var/www/html/shell.php"

Run in batch mode with time limit:

commix -u http://example.com/?id=1 --batch --time-limit=120

Use a tamper script to bypass WAF filtering:

commix -u http://example.com/?id=1 --tamper=space2plus

Scan multiple targets from a file:

commix -m /tmp/targets.txt --batch

Pipeline with waybackurls for automated target discovery:

echo example.com | waybackurls | grep vuln.php | commix
--data="addr=1" --os-cmd="whoami" --batch

Ok so this part is not a joke, bestie, and I need you to actually read it. 💀

Using commix to attack targets without prior mutual consent is illegal. Periodt. It is the end user's responsibility to obey all applicable local, state, and federal laws. The developers assume no liability and are not responsible for any misuse or damage caused by this program.

So: consent first, always. Don't be that person. 🙏

🌈 SEE ALSO 🌈

👑 AUTHOR 👑

Anastasios Stasinopoulos <ancst@commixproject.com>

This manual page was written by Josenilson Ferreira da Silva <nilsonfsilva@hotmail.com> for the Debian project (but may be used by others). 🫶

And that's the whole page, bestie!! 💖 This is commix version 4.1, dated 2026-06, filed under COMMIX(1). Go forth, be curious, stay legal, and slay responsibly. 🎀✨🦋

📦 where this page comes from