@ancst

Team leader @Obrela_Labs. Author of @commixproject. Builder n' breaker seduced by the dark side.

 Athens, Greece
stasinopoulos.github.io/
Joined November 2013
  • Tweets4.2K
  • Following378
  • Followers1.7K
59Media
FYI @commixproject is to command injections, what @sqlmap is to SQL injections! Feel free to #fork @github! github.com/stasinopoulos/com… #python

GitHub - commixproject/commix: Automated Αll-in-One OS command injection exploitation tool.

Automated Αll-in-One OS command injection exploitation tool. - commixproject/commix

github.com
4
66
1
102
Anastasios S. retweeted
Commix Project@commixprojectOct 15
The #BugBounty community asked for an API. Since 2016. Almost a decade later, commix now has a REST API + a @Burp_Suite extension. - API: github.com/commixproject/com… - Burp: github.com/commixproject/com… #Pentesting #InfoSec #CyberSecurity #HackerOne #Bugcrowd #Intigriti #YesWeHack #CTF
1
1
174
Anastasios S. retweeted
Commix Project@commixprojectSep 28
How do you extract command output from blind command injection with no output, no sleep, and no OAST? @commixproject now introduces a Boolean-based blind technique. If you're a #BugBounty hunter on #HackerOne, #Bugcrowd, #Intigriti, #YesWeHack, or anywhere else, this is for you.
1
1
3
274
Anastasios S. retweeted
Commix Project@commixprojectSep 26
#Bugbounty hunting + #WAF + PHP code #injection? WAF blocks system, exec, shell_exec etc? Don't send them in the payload. New tamper "phpserverheader" moves them into HTTP headers and reconstructs execution through "$_SERVER". Update now to the latest dev and happy hunting.🫡
1
2
353
Great to see @YesWeHack covering command injection in this comprehensive guide. The guide covers results-based, time-based, OOB and second-order command injection, and how @commixproject can be used to automate their detection and exploitation.
YesWeHack ⠵
@yeswehackApr 23
Want to find your first OS command injection? We're here to help! 💪 From classic attacks to second-order exploitation, our guide has everything you need ✅ #BugBountyTips yeswehack.com/learn-bug-boun…

The ultimate Bug Bounty guide to OS command injection vulnerabilities

Often leading to RCE, OS command injection is a core Bug Bounty skillset. This guide features direct, blind, OOB, time-based and second-order walkthroughs.

yeswehack.com
1
170
Command injection is easy to demo and hard to find. Filters strip your separators. The response echoes nothing back. Sometimes DNS is the only thing leaving the network. @commixproject handles all and commix-testbed (github.com/commixproject/com…) gives you somewhere legal to practise.

GitHub - commixproject/commix-testbed: A collection of web pages, vulnerable to command injection...

A collection of web pages, vulnerable to command injection flaws. - commixproject/commix-testbed

github.com
1
3
171
Silence is not a clean bill of health. With ‘--oob’, @commixproject gets the target to phone home instead: HTTPS, or DNS when everything else is filtered. Native interactsh client, no extra binaries to babysit. Big ups to @pdiscoveryio for interactsh 🫡
Commix Project@commixprojectSep 7
🚨 Breaking news: Commix now does out-of-band (OAST) detection and exploitation. No output? No timing signal? Doesn't matter - the target now calls @pdiscoveryio's interactsh. #OpenSource #InfoSec #CTF #CyberSecurity #BugBounty #BugBountyTips #BugBountyTools #Pentest
1
165
Anastasios S. retweeted
Commix Project@commixprojectAug 15
🚨 Breaking news: Time-related techniques just got a serious upgrade. Added parallel data retrieval with `--threads` and optimized time-related techniques using binary search for character extraction. github.com/commixproject/com… #BugBounty #BugBounty #BugBountyTools #Pentest

Added parallel data retrieval with `--threads` and optimized time-rel… · commixproject/commix@ff2...

…ated techniques using binary search for character extraction.

github.com
1
3
908
‼️🚨 BREAKING: GitHub has been compromised by TeamPCP. GitHub has confirmed the internal breach. A poisoned VS Code extension on an employee device exfiltrated ~3,800 internal repositories. TeamPCP is already selling the data on a cybercrime forum.
134
905
172
4,999
719,638
Anastasios S. retweeted
Commix Project@commixprojectJan 18
Commix recognized among the Top Pentesting Tools for 2025 by @ECCOUNCIL. eccouncil.org/cybersecurity-… Respect to everyone who keeps pushing it forward. Big salut. 🫡 #pentesting #infosec #bugbounty #cybersecurity #opensource

List of Top Penetration Testing tools for Cybersecurity 2026

Discover the top 30+ penetration testing tools used by pentesters. Compare the best cybersecurity tools for vulnerability assessment, ethical hacking, & security testing.

eccouncil.org
1
1
216
🚨 Heads up! Automated Commix crash reporting is officially deprecated. All GitHub issues are now manual - review, tweak, and submit.
1
165
Celebrating 11 years of @commixproject. 🎉 The anniversary release v4.1 is out: github.com/commixproject/com… Huge thanks to everyone who contributed, tested, reported issues, and supported the project over the years. 🫡 #OpenSource #InfoSec #CTF #BugBounty #BugBountyTools #Pentesting
1
1
152
Improved handling of non-ASCII characters in URL path and query components. github.com/commixproject/com… #OpenSource #InfoSec #CTF #CyberSecurity #BugBounty #BugBountyTips #BugBountyTools #Pentesting
1
2
419
Anastasios S. retweeted
Trickest
@trick3st29 Jan 2024
Our top Vulnerability Scanning tools: - ZAP: Web app vulnerabilities - Nuclei: Precise scanning, no false positives - Sqlmap: Automate SQL injection flaw detection - Commix: Command injection vulnerabilities - Nikto: Web server audits Read the guide👇 trickest.com/solutions/autom…
10
10
1,430
Anastasios S. retweeted
Abhinav Singwal
@yogsec6 Apr 2025
Automated Command Injection Scan on Live Parameterized URLs with Commix ☕👇 cat urls.txt | grep "?" | httpx -mc 200 -silent | while read url; do commix --url="$url" --batch; done
6
21
1,063
🚨 Breaking News! Usage wiki just dropped a major update. Clearer, deeper, and packed with examples to get you in, pop the shell, and keep moving. github.com/commixproject/com… #bugbounty #infosec #rce #commandinjection #pentesting #hacking

Usage

Automated Αll-in-One OS command injection exploitation tool. - commixproject/commix

github.com
3
3
310
Hottest cybersecurity open-source tools of the month: February 2025 - helpnetsecurity.com/2025/03/… - @Github @commixproject @ancst @netbird - #GitHub #OpenSource #CyberSecurity #CyberSecurityNews #SecurityNews #software

Hottest cybersecurity open-source tools of the month: March 2025 - Help Net Security

This article features open-source cybersecurity tools that are gaining attention for strengthening security across various environments.

helpnetsecurity.com
1
1
440
Added a new tamper script "randomcase.py" that replaces each character in a user-supplied OS command with a random case github.com/commixproject/com… #OpenSource #InfoSec #CTF #CyberSecurity #BugBounty #BugBountyTips #BugBountyTools #Pentesting
1
1
290
Anastasios S. retweeted
GitHubGPT
@GitHubGPT5 Mar 2025
📛 commix 🧠 Commix is an open-source penetration testing tool that automates the detection and exploitation of command injection vulnerabilities, requiring Python to run. 🛠️ @commixproject 💻 Python ⭐ 4930 🍴 849 🔗 github.com/commixproject/com…

GitHub - commixproject/commix: Automated Αll-in-One OS command injection exploitation tool.

Automated Αll-in-One OS command injection exploitation tool. - commixproject/commix

github.com
3
3
311
Commix: Open-source OS command injection exploitation tool - helpnetsecurity.com/2025/03/… - @commixproject @ancst #OpenSource @Github #GitHub #CyberSecurity #netsec #security #InfoSecurity #ITsecurity #CyberSecurityNews #SecurityNews
2
620
🚨CVE ALERT! While working with Nuclei @wiz_io, I discovered CVE-2024-43405, a vulnerability that bypasses template signature verification, potentially allowing malicious code execution on machines running Nuclei 🛡️ Here’s what you need to know: 🧵
9
72
7
317
73,604
Load more