Features

Features implemented in commix include:

Generic features

• Support for both Unix-like and Windows targets, with the back-end detected automatically (or forced with --os) so every payload is shaped to the operating system it identifies
• Four injection techniques - results-based (classic), boolean-based (blind), time-based (blind), and file-based (blind, with a tempfile-based variant for write-restricted targets) - selected with --technique or by the type they report with --type
• An out-of-band (OAST) channel over HTTP/S and DNS on the separate --oob switch
• Code injection support (--eval) - tests the string a target evaluates as code, in PHP, Python, Ruby, JavaScript or PowerShell, over the same four techniques
• Broad injection surface - GET/POST parameters, HTTP headers, cookies, and JSON, XML or GraphQL request bodies, plus a shellshock module for CGI targets and --jwt to test a JSON Web Token's kid claim as an injection point of its own
• Flexible targeting - a single URL, a crawl, HTML forms, a sitemap, an OpenAPI (Swagger) description, a proxy log, a bulk file, a raw HTTP request file, or piped stdin
• Filter and WAF evasion - multiple combinable tamper scripts, applied in a deterministic order
• Resumable scans - results are stored per target in a session file and picked back up on the next run
• Machine-readable output - export results as JSON, as a CSV covering every target tested, or as a HAR log of the run's HTTP traffic
• Reusable option profiles - the options a run was given can be saved and reused on a later one
• REST API (commixapi.py) for driving scans over HTTP, with a Burp Suite extension built on top of it
• Verbosity levels (-v, 0-4) and exploitation proof - --proof re-proves any finding with an experiment of its own and writes the transcript beside the run's output

Fingerprint and enumeration features

• Wide back-end support - PHP, Python, Perl, Ruby, ASP.NET, JSP and CGI
• Active fingerprint of the target operating system, settled before a payload meant for one platform is ever sent to the other
• Retrieve the current user (--current-user), hostname (--hostname), whether it has root (--is-root) or administrative (--is-admin) privileges, detailed system information (--sys-info), and the installed PowerShell version (--ps-version)
• Enumerate user accounts (--users) and password hashes (--passwords), with a dictionary attack offered automatically against any hash it can compute (MD5-crypt, SHA-256/512-crypt)
• Retrieve detailed privilege information (--privileges)
• Retrieve everything above in a single pass (--all)

Takeover features

• An interactive OS shell on the target (--os-shell), or a single scripted command with its output shown directly (--os-cmd)
• Built-in reverse TCP and bind TCP shell modes
• --pty to upgrade a plain shell to a full interactive PTY
• --priv-esc to suggest local privilege-escalation exploits the instant a Meterpreter session opens
• Read and write arbitrary files on the target (--file-read/--file-write), with --file-dest to set the destination path, and file download/upload over an established shell
• --common-files to check a bundled wordlist of sensitive paths before ever naming one by hand
• Windows registry read, write and delete (--reg-read/--reg-add/--reg-del)
• --cleanup to remove whatever a run's --file-write/--reg-add left behind

Demo

See Screenshots for commix in action, or Usage examples for worked examples against real, vulnerable applications.