Commix

No entries match these filters. Clear filters

1. v4.1 Dec 20, 2025 · release notes

   Commix v4.1 adds --http1.0 flag, randomcase.py tamper script, URL stability verification, and external User-Agent loading.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.1 https://github.com/commixproject/commix.git
   # already have the repo? check out this version:
   $ git checkout v4.1

   └──▷ TRY IT
   Force HTTP/1.0 protocol for compatibility with legacy servers that reject HTTP/1.1 keep-alive connections.
   copy

   $ commix --url "http://example.com/page?id=1" --http1.0

   Use the new tamper script to bypass case-sensitive WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. rules by randomizing command casing.
   copy

   $ commix --url "http://example.com/page?id=1" --tamper=randomcase.py

   • Adds --http1.0 switch to force all outgoing requests to use HTTP/1.0 protocol.
   • Adds new tamper script randomcase.py that replaces each character in a user-supplied OS command with a random case.
   • Adds ability to verify target URL content stability by comparing responses across delayed requests.
   • Replaces hardcoded User-Agent strings with loading from external files.

   4 details in Everything

2. v4.0 Dec 20, 2024 · release notes

   Commix v4.0 adds --abort-code and --time-limit flags for conditional aborting and execution timeouts

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.0 https://github.com/commixproject/commix.git
   # already have the repo? check out this version:
   $ git checkout v4.0

   └──▷ TRY IT
   Stop the injection test immediately if the target returns a 401 Unauthorized error, preventing unnecessary requests.
   copy

   $ commix --url 'http://example.com/page.php' --param='id' --abort-code=401

   Limit the duration of a long-running blind injection test to 60 minutes to avoid hanging CI pipelines.
   copy

   $ commix --url 'http://example.com/page.php' --param='id' --time-limit=3600

   • Adds --abort-code <code> option to stop testing when a specific HTTP status code (e.g. 401) is received
   • Adds --time-limit <seconds> flag to enforce an execution timeout in seconds (e.g. 3600)

   2 details in Everything

3. v3.9 Jan 19, 2024 · release notes

   Commix v3.9 adds --ignore-stdin, --ignore-proxy, and --smart heuristic checks

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.9 https://github.com/commixproject/commix.git
   # already have the repo? check out this version:
   $ git checkout v3.9

   • --smart option runs tests only when positive heuristics are detected.
   • --ignore-proxy switch ignores the system default HTTP proxy.
   • --ignore-stdin hidden option allows ignoring STDIN input.

   3 details in Everything

4. v3.8 Aug 14, 2023 · release notes

   Commix v3.8 adds Bearer auth, --alert for post-exploitation commands, new rev tamper script

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.8 https://github.com/commixproject/commix.git
   # already have the repo? check out this version:
   $ git checkout v3.8

   • Adds support for Bearer HTTP authentication type for injecting payloads in authorization headers.
   • Adds new --alert option to run a specified host OS command upon detecting an injection point.
   • Adds new tamper script rev.py that reverses user-supplied operating system commands characterwise.

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The --dependencies flag has been replaced by --ignore-dependencies, breaking scripts that use the former.
5. v3.7 Feb 17, 2023 · release notes

   Commix v3.7 adds --crawl-exclude regex and combines --crawl with piped stdin targets

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.7 https://github.com/commixproject/commix.git
   # already have the repo? check out this version:
   $ git checkout v3.7

   └──▷ USE IT
   Crawl a site while explicitly skipping logout pages to avoid false positives or unnecessary checks.
   shell copy

   commix --url "http://example.com" --crawl --crawl-exclude "logout"

   Scan multiple targets simultaneously by piping them into Commix with the crawl feature enabled.
   shell copy

   echo 'http://target1 http://target2' | commix --crawl -t stdout

   • Adds --crawl-exclude option to set a regular expression for excluding pages from crawling during automated testing.
   • Enables combining --crawl with scanning multiple targets provided via standard input (piped-input/stdin).

   2 details in Everything

6. v3.6 Nov 18, 2022 · release notes

   Commix v3.6 adds a new tamper script printf2echo.py for bypassing input filters.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.6 https://github.com/commixproject/commix.git
   # already have the repo? check out this version:
   $ git checkout v3.6

   └──▷ TRY IT
   Use this tamper script during injection when the target filters standard printf encoding methods.
   copy

   $ ./commix.py --url="http://example.com/page.php?id=1" --tamper=printf2echo.py --cmd="id"

   • Adds new tamper script printf2echo.py that replaces printf-based ASCII to Decimal encoding with echo -n $char | od -An -tuC | xargs.

   1 detail in Everything

7. v3.5 Jul 3, 2022 · release notes

   Adds --answers, --no-logging, stdin support, and heuristic detection for command injectioncommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. in Commix v3.5

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.5 https://github.com/commixproject/commix.git
   # already have the repo? check out this version:
   $ git checkout v3.5

   └──▷ USE IT
   Automate interactions with interactive prompts (e.g., WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. bypass questions) without manual input.
   shell copy

   commix -u 'http://example.com' --answers 'Y,N,Y'

   Disable file logging for environments where disk I/O is restricted or logs are managed externally.
   shell copy

   commix -u 'http://example.com' --no-logging

   • Adds new option --answers to set user answers to asked questions during commix run
   • Adds new option --no-logging for disabling logging to a file
   • Added support regarding parsing target(s) from piped-input (i.e. stdin)
   • Added support for heuristic detection regarding command injections
   • Added support regarding combining --crawl option with scanning multiple targets given in a textual file (i.e. via option -m)

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Removed the deprecated modules ICMP exfiltration and DNS exfiltration
8. v3.4 Feb 25, 2022 · release notes

   Commix v3.4 adds --drop-set-cookie, new cookie checks, and renames --encoding to --codec.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.4 https://github.com/commixproject/commix.git
   # already have the repo? check out this version:
   $ git checkout v3.4

   └──▷ USE IT
   Ignore Set-Cookie headers when testing for blind SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. to reduce noise.
   shell copy

   commix --url "http://example.com/page?id=1" --cookie="session=abc" --drop-set-cookie

   Specify encoding codec using the new --codec flag.
   shell copy

   commix --url "http://example.com/page?id=1" --codec=utf-8

   • Adds --drop-set-cookie option to ignore Set-Cookie HTTP headers in responses.
   • Adds support for checking for not declared cookies.
   • Replaces the --encoding option with --codec.

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The --encoding option has been replaced with --codec. Existing scripts using --encoding will fail.
9. v3.3 Sep 13, 2021 · release notes

   Commix v3.3 adds --skip-heuristic flag, custom HTTP auth wordlist parsing, new tamper script backticks.py, and --method force option

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.3 https://github.com/commixproject/commix.git
   # already have the repo? check out this version:
   $ git checkout v3.3

   └──▷ TRY IT
   Scan a target while bypassing the tool's dynamic code evaluation heuristics to avoid false negatives
   copy

   $ commix --url "http://target.com/page.php?id=1" --skip-heuristic

   Force the tool to use PUT requests instead of the default method when testing an endpoint that requires it
   copy

   $ commix --url "http://target.com/api" --method PUT

   • Adds --skip-heuristic flag to skip dynamic code evaluation heuristic check
   • Adds backticks.py tamper script that uses backticks for commands substitution
   • Adds support for parsing custom wordlists regarding HTTP authentication (i.e. Basic, Digest) dictionary-based cracker
   • Adds the .bat files command separator %1a
   • Adds --method option to force usage of provided HTTP method (e.g. PUT)

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The --backticks switch has been removed; users must now use the backticks.py tamper script instead
10. v3.2 Apr 12, 2021 · release notes

    Commix v3.2 adds --timeout CLI flag and two new tamper scripts for payload generation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v3.2

    └──▷ USE IT
    Prevent the tool from hanging on unresponsive targets by setting a specific connection timeout.
    shell copy

    commix --url "http://example.com/vuln.php?param=value" --timeout=5

    Use the new slash-to-environment tamper script to obfuscate paths in injection payloads.
    shell copy

    commix --url "http://example.com/vuln.php?param=value" --tamper=slash2env.py

    Apply the new uninitialized variable tamper to bypass simple WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. filters by inserting bash syntax errors.
    shell copy

    commix --url "http://example.com/vuln.php?param=value" --tamper=uninitializedvariable.py

    • Adds --timeout CLI argument to control connection wait time (default 30 seconds).
    • Adds new tamper script slash2env.py that replaces slashes (/) with environment variable value ${PATH%%u*}.
    • Adds new tamper script uninitializedvariable.py that adds uninitialized bash variables between the characters of each command in generated payloads.

    3 details in Everything

11. v3.1 Jun 26, 2020 · release notes

    Adds doublequotes.py tamper script for payload obfuscation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v3.1

    └──▷ USE IT
    Use this tamper to bypass WAFs that block standard injection patterns by spacing out payload characters with quotes.
    shell copy

    commix -u "http://example.com/vuln.php?id=1" --tamper doublequotes.py

12. v3.0-20191111 Nov 11, 2019 · release notes

    Commix v3.0 adds Python 3 support and new --ignore-code option replacing --ignore-401

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0-20191111 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v3.0-20191111

    └──▷ USE IT
    Scan a target while ignoring 401 Unauthorized responses using the new flag
    shell copy

    python commix.py --url=http://example.com/vuln_param --cookie="session=abc" --ignore-code 401

    • Adds --ignore-code <code> option to ignore specific HTTP error codes, replacing the deprecated --ignore-401 flag
    • Adds Python 3.x runtime support

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --ignore-401 option has been removed; use --ignore-code instead to filter HTTP error responses
13. v2.8-20190326 Mar 26, 2019 · release notes

    Commix v2.8 adds temp file output for crawl results and Windows reverse_tcp support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.8-20190326 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v2.8-20190326

    • Adds --output-crawl-tmp option to write crawling results to a temporary file.
    • Adds Windows Python compatibility for the reverse_tcp shell option.

    2 details in Everything

14. v2.7-20181218 Dec 18, 2018 · release notes

    Commix v2.7 adds --exclude-ext for crawl filtering and new $@/X-Forwarded-For tamper scripts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7-20181218 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v2.7-20181218

    └──▷ TRY IT
    Scan for injection points while ignoring static assets like images and stylesheets.
    copy

    $ commix --url "http://target/page.php?id=1" --exclude-ext "jpg,png,css"

    Use the new $@ tamper script to obfuscate payloads during an injection test.
    copy

    $ commix --url "http://target/page.php?id=1" --tamper "dollaratsigns"

    Append a spoofed forwarding header using the new tamper script.
    copy

    $ commix --url "http://target/page.php?id=1" --tamper "xforwardedfor"

    • --exclude-ext allows listing extensions to exclude from the crawler
    • Adds dollaratsigns.py tamper script inserting $@ between payload characters
    • Adds xforwardedfor.py tamper script appending fake X-Forwarded-For header

    3 details in Everything

15. v2.6-20180921 Sep 21, 2018 · release notes

    Commix v2.6 adds --list-tampers, new tamper scripts, expanded reverse shell support, and renames --purge-output to --purge

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.6-20180921 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v2.6-20180921

    └──▷ USE IT
    Use the new timeout-based tamper for more reliable time-based injection detection
    shell copy

    commix --url="http://example.com/page" --tamper=sleep2timeout.py

    • --purge is the new flag for purging output files, replacing the old --purge-output option
    • Adds --list-tampers option to list all available tamper scripts in the tool
    • Adds sleep2timeout.py and sleep2usleep.py as new tamper scripts for time-based attacks
    • Adds support for Ncat, Netcat-Openbsd, and Bash via /dev/tcp on reverse_tcp and bind_tcp shell options

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --purge-output CLI argument has been removed; use --purge instead
16. v2.5-20180713 Jul 13, 2018 · release notes

    Adds three new tamper scripts (nested.py, backslashes.py, multiplespaces.py) for payload obfuscation in Commix v2.5

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5-20180713 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v2.5-20180713

    • Added backslashes.py tamper script that adds backslashes between characters of generated payloads to bypass simple filters.
    • Added multiplespaces.py tamper script that inserts multiple spaces around OS commands for obfuscation.
    • Added nested.py tamper script that wraps generated payloads in double quotes.

    3 details in Everything

17. v2.4-20180521 May 21, 2018 · release notes

    Adds new tamper scripts for payload character manipulation and improves script loading stability.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4-20180521 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v2.4-20180521

    • Adds the caret.py tamper script to insert a caret (^) between characters of generated payloads
    • Adds the singlequotes.py tamper script to insert single quotes (') between characters of generated payloads

    2 details in Everything

18. v2.3-20180307 Mar 7, 2018 · release notes

    Commix v2.3 adds Host header injection support and replaces --charset with --encoding

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3-20180307 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v2.3-20180307

    └──▷ TRY IT
    Run a time-based injection test using a custom encoding for the target URL.
    copy

    $ commix --url "http://target.com/page.php?id=1" --encoding=utf8

    • Adds --encoding option to replace the previous --charset flag for specifying custom character sets during data retrieval.
    • Adds automatic GitHub issue creation when an unhandled exception occurs, including detailed exception information.
    • Adds explicit support for testing Host HTTP header command injections.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --charset option has been removed and replaced with --encoding; scripts using --charset will fail.
19. v2.2-20171212 Dec 12, 2017 · release notes

    Commix v2.2 adds --failed-tries, --skip, and --skip-technique CLI flags for injection control

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.2-20171212 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v2.2-20171212

    └──▷ USE IT
    Skip testing the id parameter and only use blind boolean inference.
    shell copy

    commix --url "http://example.com/page?id=1" --skip="id" --skip-technique=time

    Stop the attack after 3 failed attempts to avoid noisy logs or timeouts.
    shell copy

    commix --url "http://example.com/page" --failed-tries=3

    • Adds --failed-tries to limit the number of failed injection attempts in file-based techniques
    • Adds --skip flag to exclude specific parameters from testing
    • Adds --skip-technique flag to exclude specific injection techniques

    3 details in Everything

20. v2.1-20171003 Oct 3, 2017 · release notes

    Commix v2.1 adds --header, --check-tor, --backticks, --disable-coloring and --purge-output options plus new tamper script support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1-20171003 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v2.1-20171003

    └──▷ USE IT
    Inject a custom HTTP header and disable coloring for cleaner logs.
    shell copy

    commix --url "http://target.com/vuln" --header "X-Forwarded-For: 127.0.0.1" --disable-coloring

    Force backtick-based command substitution for environments where $() is filtered.
    shell copy

    commix --url "http://target.com/vuln" --param "id" --backticks

    Validate Tor connectivity and purge previous output files before starting.
    shell copy

    commix --url "http://target.com/vuln" --check-tor --purge-output

    • Adds --header CLI option to inject a single extra HTTP header (e.g. X-Forwarded-For: 127.0.0.1).
    • Adds --check-tor CLI option to verify Tor connectivity before exploitation.
    • Adds --backticks CLI option to force command substitution using backticks instead of $().
    • Adds --disable-coloring CLI option to suppress colored console output.
    • Adds --purge-output CLI option to safely delete all contents from the output directory.

    +3 more show less

    • Adds --check-internet CLI option to validate internet connectivity prior to target assessment.
    • Introduces new tamper script space2vtab.py which replaces spaces (%20) with vertical tabs (%0b).
    • Replaces space2tab.py with the new space2htab.py tamper script.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The space2tab.py tamper script has been removed and replaced by space2htab.py.
21. v2.0-20170714 Jul 14, 2017 · release notes

    Commix v2.0 adds --mobile and --retries CLI options

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0-20170714 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v2.0-20170714

    └──▷ USE IT
    Test injection payloads against mobile-specific applications by spoofing a smartphone user-agent.
    shell copy

    commix --url "http://example.com/page?id=1" --mobile

    Automatically retry failed requests due to network instability during an assessment.
    shell copy

    commix --url "http://example.com/page?id=1" --retries 5

    • Adds --mobile flag to imitate smartphone User-Agent
    • Adds --retries option to retry requests on connection timeout

    2 details in Everything

22. v1.9-20170502 May 2, 2017 · release notes

    Adds --ignore-redirects, --wizard CLI options and replaces --root-dir with --web-root

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9-20170502 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v1.9-20170502

    └──▷ USE IT
    Prevent the tool from following HTTP redirects during an injection test.
    shell copy

    commix --url=http://example.com/page?id=1 --cookie=PHPSESSID=abc --ignore-redirects

    Use the interactive wizard to configure a test without memorizing flags.
    shell copy

    commix --wizard

    Set the web root directory for file-based injection techniques.
    shell copy

    commix --url=http://example.com/upload --param=path --data="../../etc/passwd" --web-root=/var/www

    • Adds --ignore-redirects option to ignore redirection attempts
    • Adds --wizard option for a beginner-friendly interface
    • Replaces the --root-dir option with --web-root

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --root-dir CLI argument is removed; use --web-root instead.
23. v1.8-20170315 Mar 15, 2017 · release notes

    Commix v1.8 adds --time-sec, --charset, %26 delimiter, and Regsvr32 bypass support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8-20170315 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v1.8-20170315

    • Replaces --delay with --time-sec to control HTTP request delay
    • Adds --charset option to force character encoding for data retrieval
    • Adds %26 as both a new prefix and suffix delimiter for payloads
    • Adds support for Regsvr32.exe Application Whitelisting Bypass technique

    4 details in Everything

24. v1.7-20170203 Feb 3, 2017 · release notes

    Commix v1.7 adds --skip-empty flag and URI path/shell type placeholders to the Set option

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7-20170203 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v1.7-20170203

    └──▷ USE IT
    Scan only parameters that have non-empty values to reduce noise.
    shell copy

    commix --url "http://example.com/vuln.php" --param "id" --skip-empty

    Inject the current request URI path or server port into parameters for context-aware testing.
    shell copy

    commix --url "http://example.com/test?id=1" --set 'id=[URIPATH],[SRVPORT]'

    Target the specific shellshock-vulnerable CGI path if known.
    shell copy

    commix --url "http://example.com/cgi-bin/cgiCmdNotify"

    • --skip-empty flag added to skip testing parameters with empty values
    • Adds URIPATH and SRVPORT as new values for the Set option
    • Adds /cgi-bin/cgiCmdNotify shellscript path as a known vulnerable endpoint for shellshock

    3 details in Everything

25. v1.6-20161228 Dec 28, 2016 · release notes

    Adds --batch, -x, --offline, -r, and -m options; logs command execution results

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6-20161228 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v1.6-20161228

    └──▷ TRY IT
    Run the cyber tool non-interactively in a CI/CD pipeline or unattended script.
    copy

    $ commix --url "http://target/page" --data "param=value" --batch

    Load an HTTP request payload from a file instead of command-line arguments.
    copy

    $ commix -r /path/to/request.txt

    Scan multiple hosts listed in a text file for cyber vulnerabilities.
    copy

    $ commix -m targets.txt

    • Add --batch option to skip all user input prompts by using default behavior.
    • Add -x flag for parsing target URLs from a remote sitemap (.xml) file.
    • Add --offline flag to operate the scanner without an active internet connection.
    • Add -r option to load raw HTTP requests from a local file for injection testing.
    • Add -m option to scan multiple targets defined in a textual input file.

    +1 more show less

    • Log executed commands and their results into the output log file.

    6 details in Everything

26. v1.5-20161117 Nov 17, 2016 · release notes

    Commix v1.5 adds hex encode tamper, HTTP traffic logging, metasploit path config, and verbose levels.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5-20161117 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v1.5-20161117

    └──▷ USE IT
    Encode injection payloads to hex format before sending.
    shell copy

    ./commix.py --url='http://target/page' --tamper=hexencode.py

    Save all HTTP traffic to a text file for offline analysis.
    shell copy

    ./commix.py --url='http://target/page' -t traffic.log

    Point commix to a specific Metasploit installation for exploitation modules.
    shell copy

    ./commix.py --url='http://target/page' --msf-path=/opt/metasploit-framework

    • Adds hexencode.py tamper script for payload encoding
    • Adds -t option to log all HTTP traffic into a textual file
    • Adds --msf-path option for specifying Metasploit installation path
    • Adds verbosity level 4 for printing HTTP response page content
    • Adds verbosity level 3 for printing HTTP response headers

    +1 more show less

    • Adds verbosity level 2 for printing performed HTTP request headers

    6 details in Everything

27. v1.4-20161017 Oct 17, 2016 · release notes

    Adds --crawl subcommand for website crawling and bind TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. shell support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4-20161017 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v1.4-20161017

    └──▷ TRY IT
    Crawl the target website to discover additional injection points
    copy

    $ commix --url "http://example.com" --crawl 1

    • Adds --crawl CLI option to crawl a given website starting from the target URL
    • Adds support for bind TCP shell via the bind_tcp option

    2 details in Everything

28. v1.3-20160914 Sep 14, 2016 · release notes

    Adds metasploit web_delivery support, PowerShell x86 shellcode generation, and --skip-calc option

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3-20160914 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v1.3-20160914

    • Added --skip-calc option to skip mathematical calculation during the detection phase
    • Added support for generating and injecting native x86 shellcode (Powershell)
    • Added support for the metasploit web_delivery script
    • Added support for generating Python/PHP meterpreter reverse TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. payloads via metasploit

    4 details in Everything

29. v1.2-20160812 Aug 12, 2016 · release notes

    Adds custom working directory support, space-to-tab tamper script, Magic Unicorn integration, and target extension recognition.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2-20160812 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v1.2-20160812

    └──▷ USE IT
    Use a specific tamper script to bypass WAFs that block spaces.
    shell copy

    commix --url "http://example.com/page?id=1" --tamper="space2tab.py"

    • Adds the ability for setting custom (PHP / Python) working directory
    • Adds new tamper script space2tab.py that replaces every space (%20) with horizontal tab (%09)
    • Adds the ability for generating powershell attack vectors via TrustedSec's Magic Unicorn
    • Adds the ability for checking if there is a new version available
    • Adds the ability for target application extension recognition (i.e. PHP, ASP etc)

    5 details in Everything

30. v1.1-20160714 Jul 14, 2016 · release notes

    Commix v1.1 adds ASP.NET injection support, session persistence, and HTTP server auto-enablement for file uploads.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1-20160714 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v1.1-20160714

    • --file-upload HTTP server can now be enabled automatically via a new config or flag (implied by automated enabling) to streamline upload payloads.
    • Support for injections against ASP.NET applications.
    • Injection level is now stored into session files for the current target, allowing continuity across restarts.
    • Detection of create_function() usage in injected code.

    4 details in Everything

31. v1.0-20160614 Jun 14, 2016 · release notes

    Commix v1.0 adds explicit Shellshock detection capability for URLs and script lists

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0-20160614 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v1.0-20160614

    • Added --check-shellshock (implied by capability) to check if a URL is probable to contain scripts vulnerable to Shellshock
    • Added built-in list of pages / scripts potentially vulnerable to Shellshock

    2 details in Everything

32. v0.9b-20160607 Jun 7, 2016 · release notes

    Commix v0.9b adds --tamper CLI flag to run injection scripts like space2plus.py and introduces verbosity levels.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9b-20160607 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v0.9b-20160607

    • Adds --tamper CLI flag that accepts a list of tamper script file paths, enabling combined or sequential script execution during injection
    • Adds new command-line option --verbosity <level> to control output detail (supports levels 0 and 1)
    • Includes new default tamper script space2plus.py which replaces URL-encoded spaces (%20) with plus signs (+)

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --base64 flag is removed; users must now use the base64encode.py tamper script via the new --tamper option instead
33. v0.8b-20160506 May 6, 2016 · release notes

    Adds --level, -p, and --all flags; replaces INJECT_HERE with *; enhances cookie and parameter enumeration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8b-20160506 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v0.8b-20160506

    └──▷ USE IT
    Set the test verbosity level to maximum for exhaustive scanning.
    shell copy

    commix --url "http://example.com" --level 3

    Scan only specific GET and POST parameters identified by a flag.
    shell copy

    commix --url "http://example.com" -p "id,category"

    • Adds --level (1-3) to specify the level of tests to perform
    • Adds -p flag for a comma-separated list of GET and POST parameters
    • Adds --all flag to enable all supported enumeration options
    • Replaces the INJECT_HERE tag with the * (asterisk) wildcard character
    • Enhances cookie data checking to support verifying every parameter in the provided cookie data

    +2 more show less

    • Enhances GET/POST checking to verify every GET parameter in the defined URL and/or every POST provided data
    • Adds ability to check for empty value(s) in defined GET, POST, Cookie data and skip

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The INJECT_HERE tag is replaced with the * (asterisk) wildcard character
34. v0.7b-20160418 Apr 18, 2016 · release notes

    Commix v0.7b adds Digest HTTP authentication support with dictionary cracking and session storage

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7b-20160418 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v0.7b-20160418

    • Session files can now store valid (Digest) credentials for the current target using store_credentials capability.
    • Verbose mode (-v) added to HTTP authentication dictionary-based cracker.

    2 details in Everything

35. v0.6b-20160401 Apr 1, 2016 · release notes

    Adds --ignore-401, --skip-waf, --dns-server flags and dictionary-based Basic auth cracker

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6b-20160401 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v0.6b-20160401

    └──▷ TRY IT
    Test targets that reject auth attempts before returning useful data by ignoring the initial 401 response.
    copy

    $ commix --url "http://example.com/page.php?param=val" --ignore-401

    Scan a target while bypassing WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. heuristic detection using the DNS exfiltration technique on a specific server.
    copy

    $ commix --url "http://example.com/page.php?param=val" --dns-server="8.8.8.8" --skip-waf

    • --ignore-401 option ignores HTTP Error 401 and continues tests without valid credentials
    • --skip-waf option skips heuristic detection of WAF/IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection./IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. protection
    • --dns-server option supports the DNS exfiltration injection technique
    • Dictionary-based cracker for Basic HTTP authentication credentials added with identifier support

    4 details in Everything

36. v0.5b-20160316 Mar 16, 2016 · release notes

    Adds --os flag for forced OS detection, verbose ICMP exfiltration, and custom HTTP header support via --headers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5b-20160316 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v0.5b-20160316

    └──▷ USE IT
    Inject payloads while sending custom headers like a specific User-Agent or X-Forwarded-For.
    shell copy

    commix --url="http://example.com/vuln" --param="id" --headers='User-Agent: CustomBot; X-Custom: 123'

    Force the tool to assume the target is running Linux regardless of heuristic detection.
    shell copy

    commix --url="http://example.com/vuln" --param="id" --os "linux"

    Enable verbose output for the ICMP exfiltration module to see detailed packet exchange logs.
    shell copy

    commix --url="http://example.com/vuln" --param="id" --technique=I --verbose

    • --headers parameter allows testing with custom HTTP headers during injection tests.
    • --os flag forces a user-defined operating system name for the target.
    • Verbose mode added to ICMP exfiltration injection technique module.

    3 details in Everything

37. v0.4.1b-20160226 Feb 26, 2016 · release notes

    Adds session persistence via new -s, --ignore-session, and --flush-session CLI flags to resume injection attacks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.1b-20160226 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v0.4.1b-20160226

    └──▷ USE IT
    Resume an interrupted injection campaign by loading previously executed commands from the session file.
    shell copy

    commix -u "http://target.com/vuln?param=<cmd>" -s

    Force a fresh scan by ignoring any previously saved session data for the target.
    shell copy

    commix -u "http://target.com/vuln?param=<cmd>" --ignore-session

    Clear all stored session data for the current target before starting a new test.
    shell copy

    commix -u "http://target.com/vuln?param=<cmd>" --flush-session

    • Adds -s CLI flag for loading executed commands from a session file
    • Adds --ignore-session CLI flag to ignore results stored in session file
    • Adds --flush-session CLI flag for flushing session files for current target
    • Adds capability to resume injection points from a previous session

    4 details in Everything

38. v0.4b-20160204 Feb 4, 2016 · release notes

    Commix v0.4b adds WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. detection/mutation and --force-ssl support for cyber tooling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4b-20160204 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v0.4b-20160204

    └──▷ USE IT
    Force SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. when the target redirects to HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. or requires it for valid exploitation paths
    shell copy

    commix --url "http://target.com/vuln.php?id=1" --force-ssl

    • Adds automatic payload mutation when WAF/IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection./IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. protection is detected to bypass restrictions
    • Adds the --force-ssl flag to force HTTPS requests regardless of initial target protocol
    • Adds WAF/IPS/IDS detection capability via analysis of error pages during scanning

    3 details in Everything

39. v0.3b-20160115 Jan 15, 2016 · release notes

    Adds -l proxy log parsing and --ps-version check to Commix v0.3b-20160115

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3b-20160115 https://github.com/commixproject/commix.git
    # already have the repo? check out this version:
    $ git checkout v0.3b-20160115

    └──▷ TRY IT
    Inject into parameters logged by an intercepting proxy without manual extraction
    copy

    $ commix -l burp_log.txt

    • Added new option -l that parses target and data from HTTP proxy log files such as Burp or WebScarab
    • Added new option --ps-version that checks PowerShell's version number on the target host
    • Added support for tab completion in shell options on MacOSX platforms

    3 details in Everything