Commix
Automated command-injection exploitation.
KaliParrothigh
pkg: commix
Commix finds and exploits OS command-injection vulnerabilities in web apps and parameters.
Syntax
commix --url {url}
Example
commix --url "https://example.com/ping?host=1"
Tests the host parameter for command injection and offers a shell if vulnerable.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
commix
Usage examples
commix --url "https://t/ping?host=1" --batch
Auto-detect command injection.
commix --url "https://t/ping" --data "host=1" --os-cmd whoami
Run whoami via injection.
Advantages
- Specialised, effective for cmd-injection
- Multiple injection techniques
- Interactive pseudo-shell
Disadvantages
- Very intrusive (runs OS commands)
- High false-negative on filtered inputs
- Requires authorization
Tags
#command-injection#web
Official docs: Commix ↗
Related commands
Frequently asked questions
What is Commix used for?
Commix finds and exploits OS command-injection vulnerabilities in web apps and parameters.
What is an example Commix command?
A common example is: commix --url "https://example.com/ping?host=1" — Tests the host parameter for command injection and offers a shell if vulnerable.
Is Commix part of Kali Linux?
Yes. Commix ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install commix.
What category of security tool is Commix?
Commix is a Web Application tool with a high-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.