Commix

Automated command-injection exploitation.

KaliParrothigh

pkg: commix

Commix finds and exploits OS command-injection vulnerabilities in web apps and parameters.

Syntax

commix --url {url}

Example

commix --url "https://example.com/ping?host=1"

Tests the host parameter for command injection and offers a shell if vulnerable.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

--url <https://t/ping?host=1>Target URL.
--data <host=1>POST data to test.
--os-cmdRun a single command if injectable.
--level <1>Test depth 1-3.
--batchNon-interactive (accept defaults).

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

commix

Usage examples

commix --url "https://t/ping?host=1" --batch

Auto-detect command injection.

commix --url "https://t/ping" --data "host=1" --os-cmd whoami

Run whoami via injection.

Advantages
  • Specialised, effective for cmd-injection
  • Multiple injection techniques
  • Interactive pseudo-shell
Disadvantages
  • Very intrusive (runs OS commands)
  • High false-negative on filtered inputs
  • Requires authorization
Tags
#command-injection#web

Official docs: Commix

Related commands

Frequently asked questions

What is Commix used for?
Commix finds and exploits OS command-injection vulnerabilities in web apps and parameters.
What is an example Commix command?
A common example is: commix --url "https://example.com/ping?host=1" — Tests the host parameter for command injection and offers a shell if vulnerable.
Is Commix part of Kali Linux?
Yes. Commix ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install commix.
What category of security tool is Commix?
Commix is a Web Application tool with a high-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →