https://cybertoolchain.io/tools/commix New releases and features in Commix, tracked by The Cyber Toolchain. en Sat, 20 Dec 2025 07:24:10 GMT https://github.com/commixproject/commix/releases/tag/v4.1 https://github.com/commixproject/commix/releases/tag/v4.1 Sat, 20 Dec 2025 07:24:10 GMT Commix v4.1 adds `--http1.0` flag, `randomcase.py` tamper script, URL stability verification, and external User-Agent loading. • Adds `--http1.0` switch to force all outgoing requests to use `HTTP/1.0` protocol. • Adds new tamper script `randomcase.py` that replaces each character in a user-supplied OS command with a random case. • Adds ability to verify target URL content stability by comparing responses across delayed requests. • Replaces hardcoded User-Agent strings with loading from external files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/commix https://github.com/commixproject/commix/releases/tag/v4.0 https://github.com/commixproject/commix/releases/tag/v4.0 Fri, 20 Dec 2024 06:18:10 GMT Commix v4.0 adds `--abort-code` and `--time-limit` flags for conditional aborting and execution timeouts • Adds `--abort-code <code>` option to stop testing when a specific HTTP status code (e.g. 401) is received • Adds `--time-limit <seconds>` flag to enforce an execution timeout in seconds (e.g. 3600) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/commix https://github.com/commixproject/commix/releases/tag/v3.9 https://github.com/commixproject/commix/releases/tag/v3.9 Fri, 19 Jan 2024 06:44:15 GMT Commix v3.9 adds --ignore-stdin, --ignore-proxy, and --smart heuristic checks • `--smart` option runs tests only when positive heuristics are detected. • `--ignore-proxy` switch ignores the system default HTTP proxy. • `--ignore-stdin` hidden option allows ignoring STDIN input. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/commix https://github.com/commixproject/commix/releases/tag/v3.8 https://github.com/commixproject/commix/releases/tag/v3.8 Mon, 14 Aug 2023 08:46:05 GMT Commix v3.8 adds Bearer auth, `--alert` for post-exploitation commands, new 'rev' tamper script • Adds support for `Bearer` HTTP authentication type for injecting payloads in authorization headers. • Adds new `--alert` option to run a specified host OS command upon detecting an injection point. • Adds new tamper script "rev.py" that reverses user-supplied operating system commands characterwise. Breaking changes: • The `--dependencies` flag has been replaced by `--ignore-dependencies`, breaking scripts that use the former. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/commix https://github.com/commixproject/commix/releases/tag/v3.7 https://github.com/commixproject/commix/releases/tag/v3.7 Fri, 17 Feb 2023 07:30:16 GMT Commix v3.7 adds --crawl-exclude regex and combines --crawl with piped stdin targets • Adds `--crawl-exclude` option to set a regular expression for excluding pages from crawling during automated testing. • Enables combining `--crawl` with scanning multiple targets provided via standard input (piped-input/stdin). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/commix https://github.com/commixproject/commix/releases/tag/v3.6 https://github.com/commixproject/commix/releases/tag/v3.6 Fri, 18 Nov 2022 07:10:11 GMT Commix v3.6 adds a new tamper script 'printf2echo.py' for bypassing input filters. • Adds new tamper script `printf2echo.py` that replaces printf-based ASCII to Decimal encoding with `echo -n $char | od -An -tuC | xargs`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/commix https://github.com/commixproject/commix/releases/tag/v3.5 https://github.com/commixproject/commix/releases/tag/v3.5 Sun, 03 Jul 2022 07:23:27 GMT Adds `--answers`, `--no-logging`, stdin support, and heuristic detection for command injection in Commix v3.5 • Adds new option `--answers` to set user answers to asked questions during commix run • Adds new option `--no-logging` for disabling logging to a file • Added support regarding parsing target(s) from piped-input (i.e. `stdin`) • Added support for heuristic detection regarding command injections • Added support regarding combining `--crawl` option with scanning multiple targets given in a textual file (i.e. via option `-m`) Breaking changes: • Removed the deprecated modules "ICMP exfiltration" and "DNS exfiltration" Full history on Cyber Toolchain: https://cybertoolchain.io/tools/commix https://github.com/commixproject/commix/releases/tag/v3.4 https://github.com/commixproject/commix/releases/tag/v3.4 Fri, 25 Feb 2022 07:27:34 GMT Commix v3.4 adds `--drop-set-cookie`, new cookie checks, and renames `--encoding` to `--codec`. • Adds `--drop-set-cookie` option to ignore `Set-Cookie` HTTP headers in responses. • Adds support for checking for not declared cookies. • Replaces the `--encoding` option with `--codec`. Breaking changes: • The `--encoding` option has been replaced with `--codec`. Existing scripts using `--encoding` will fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/commix