commix

Automated OS command injection detection and exploitation.

Quick Start

# GET parameter
commix --url="http://target.com/ping?ip=127.0.0.1"

# POST parameter
commix --url="http://target.com/ping" --data="ip=127.0.0.1"

# From Burp request
commix -r request.txt

# Mark injection point explicitly with *
commix --url="http://target.com/page?ip=*"