Skip to content
A Burp Extension designed to identify argument injection vulnerabilities.
Branch: master
Clone or download
Latest commit 009d834 Apr 17, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
screenshots Initial version. Apr 16, 2019 Initial version. Apr 16, 2019 Initial version. Apr 16, 2019

Argument Injection Hammer

Argument Injection Hammer is an extension for the intercepting proxy Burp Suite that extends the scanner's ability to detect argument injection and manipulation vulnerabilities in web applications and web services.

A web application is vulnerable to argument injection when untrusted inputs are passed as arguments to an external command. An attacker can manipulate the arguments passed to the process to trigger either an arbitrary file write, arbitrary file read, or OS command injection depending on the supported arguments of the command and how the command is executed. Argument injection should not be confused with OS command injection in which it is possible to use shell metacharacters to force the target application to execute additional arbitrary OS commands.

The extension contains payloads that can detect argument injection and manipulation vulnerabilities associated with common Linux commands using both in-band detection techniques and timing-based detection techniques. The extension also supports limited brute forcing of short argument flags.

Supported Command Payloads

  • awk
  • curl
  • date
  • find
  • git
  • jrunscript
  • lua
  • mysql
  • nmap
  • openssl
  • perl
  • php
  • php-cgi
  • python
  • readelf
  • ruby
  • sed
  • sendmail
  • sort
  • sqlite3
  • ssh
  • tar
  • wget
  • zip


This extension is written in Python, so make sure to configure Jython first within Burp Suite. After configuring Jython, simply add the extension into Burp Suite (Extender -> Extensions -> Add).

Future Ideas

  • Support out-of-band detection techniques.
  • Add payloads to target common Windows commands.
  • Add payloads for additional Linux commands.
You can’t perform that action at this time.