Automated Αll-in-One OS command injection exploitation tool. Created by @ancst
Joined March 2015
- Tweets332
- Following1
- Followers2.9K
- Likes224
The #BugBounty community asked for an API. Since 2016. Almost a decade later, commix now has a REST API + a @Burp_Suite extension.
- API: github.com/commixproject/com…
- Burp: github.com/commixproject/com…
#Pentesting #InfoSec #CyberSecurity #HackerOne #Bugcrowd #Intigriti #YesWeHack #CTF
Commix Project retweeted
Worth noting: @PortSwigger’s Burp Suite docs and @owasp’s Web Security Testing Guide cover blind command injection via time delays, output redirection, and OOB interaction. A Boolean-based approach doesn’t appear to be documented.
How do you extract command output from blind command injection with no output, no sleep, and no OAST? @commixproject now introduces a Boolean-based blind technique.
If you're a #BugBounty hunter on #HackerOne, #Bugcrowd, #Intigriti, #YesWeHack, or anywhere else, this is for you.
#Bugbounty hunting + #WAF + PHP code #injection?
WAF blocks system, exec, shell_exec etc?
Don't send them in the payload.
New tamper "phpserverheader" moves them into HTTP headers and reconstructs execution through "$_SERVER".
Update now to the latest dev and happy hunting.🫡
Commix Project retweeted
Great to see @YesWeHack covering command injection in this comprehensive guide.
The guide covers results-based, time-based, OOB and second-order command injection, and how @commixproject can be used to automate their detection and exploitation.
Want to find your first OS command injection? We're here to help! 💪
From classic attacks to second-order exploitation, our guide has everything you need ✅
#BugBountyTips
yeswehack.com/learn-bug-boun…
Commix Project retweeted
Command injection is easy to demo and hard to find. Filters strip your separators. The response echoes nothing back. Sometimes DNS is the only thing leaving the network.
@commixproject handles all and commix-testbed (github.com/commixproject/com…) gives you somewhere legal to practise.
Commix Project retweeted
Silence is not a clean bill of health.
With ‘--oob’, @commixproject gets the target to phone home instead: HTTPS, or DNS when everything else is filtered. Native interactsh client, no extra binaries to babysit.
Big ups to @pdiscoveryio for interactsh 🫡
🚨 Breaking news: Commix now does out-of-band (OAST) detection and exploitation.
No output? No timing signal? Doesn't matter - the target now calls @pdiscoveryio's interactsh.
#OpenSource #InfoSec #CTF #CyberSecurity #BugBounty #BugBountyTips #BugBountyTools #Pentest
🚨 Breaking news: Commix now does out-of-band (OAST) detection and exploitation.
No output? No timing signal? Doesn't matter - the target now calls @pdiscoveryio's interactsh.
#OpenSource #InfoSec #CTF #CyberSecurity #BugBounty #BugBountyTips #BugBountyTools #Pentest
🚨 Breaking news: Time-related techniques just got a serious upgrade.
Added parallel data retrieval with `--threads` and optimized time-related techniques using binary search for character extraction.
github.com/commixproject/com…
#BugBounty #BugBounty #BugBountyTools #Pentest
Commix recognized among the Top Pentesting Tools for 2025 by @ECCOUNCIL.
eccouncil.org/cybersecurity-…
Respect to everyone who keeps pushing it forward.
Big salut. 🫡
#pentesting
#infosec
#bugbounty
#cybersecurity
#opensource
🚨 Heads up! Automated Commix crash reporting is officially deprecated.
All GitHub issues are now manual - review, tweak, and submit.
Celebrating 11 years of @commixproject. 🎉
The anniversary release v4.1 is out: github.com/commixproject/com…
Huge thanks to everyone who contributed, tested, reported issues, and supported the project over the years. 🫡
#OpenSource #InfoSec #CTF #BugBounty #BugBountyTools #Pentesting
Improved handling of non-ASCII characters in URL path and query components. github.com/commixproject/com… #OpenSource #InfoSec #CTF #CyberSecurity #BugBounty #BugBountyTips #BugBountyTools #Pentesting
Commix Project retweeted
Our top Vulnerability Scanning tools:
- ZAP: Web app vulnerabilities
- Nuclei: Precise scanning, no false positives
- Sqlmap: Automate SQL injection flaw detection
- Commix: Command injection vulnerabilities
- Nikto: Web server audits
Read the guide👇
trickest.com/solutions/autom…
🚨 Breaking News!
Usage wiki just dropped a major update. Clearer, deeper, and packed with examples to get you in, pop the shell, and keep moving.
github.com/commixproject/com…
#bugbounty #infosec #rce #commandinjection #pentesting #hacking
Added a new tamper script "randomcase.py" that replaces each character in a user-supplied OS command with a random case github.com/commixproject/com… #OpenSource #InfoSec #CTF #CyberSecurity #BugBounty #BugBountyTips #BugBountyTools #Pentesting
Commix Project retweeted
Commix: Open-source OS command injection exploitation tool - helpnetsecurity.com/2025/03/… - @commixproject @ancst #OpenSource @Github #GitHub #CyberSecurity #netsec #security #InfoSecurity #ITsecurity #CyberSecurityNews #SecurityNews
Commix Project retweeted
📛 commix
🧠 Commix is an open-source penetration testing tool that automates the detection and exploitation of command injection vulnerabilities, requiring Python to run.
🛠️ @commixproject
💻 Python
⭐ 4930
🍴 849
🔗 github.com/commixproject/com…
Today Is the Day! Ten years of @commixproject and the (anniversary) v4.0 is out: github.com/commixproject/com… #OpenSource #InfoSec #CTF #CyberSecurity #BugBounty #BugBountyTips #BugBountyTools #Pentesting
Commix Project retweeted
Want to scan for command injection vulnerabilities on auto-pilot? 😎️👇️
Commix is an open-source command injection scanner written in python to help you scan for these bugs easily! 🤑
Check it out! 👇️
hubs.li/Q025-9sZ0
