Commix
Commix is a free command-injection exploitation tool used to detect and exploit OS command injection flaws in web apps for pentesters on authorized targets.
0 upvotes · 0 downvotes
No ratings yet
- Pricing
- Free
- Platforms
- LinuxWindowsmacOS
- License
- Open source
- Reviewed
- Last reviewed 25 October 2026
What it is
An automated Python tool that tests web parameters for OS command injection and can escalate a finding toward an interactive shell when the flaw allows it. It covers several injection techniques across common server stacks.
What it helps with
- Detecting OS command injection in web parameters
- Confirming findings with safe proof commands in scope
- Working across Unix-like and Windows back ends
- Feeding confirmed issues into a manual retest in a proxy
Who it's for
Pentesters and AppSec engineers testing web applications they own or are authorized to assess.
Worth knowing
It is an exploitation aid, not a general scanner. Running it against systems without authorization is unlawful.
Does it replace a full web scanner?
No, it focuses on command injection; Nuclei, ZAP, or Burp Suite cover broader testing.
Which targets does it support?
It has techniques for Unix-like and Windows back ends behind common web stacks.
Discussion & reviews
0 comments
No contributions yet. Be the first to review or comment.