Commix: Command Injection Exploiter

Commix a short form for Command Injection Exploiter is an environment that web developers, penetration testers and even security researchers can use to test web applications in order to find bugs or vulnerabilities.

Commix is written in python programming language. That helps to find vulnerabilities related to command injection attacks. In Command injection attack the goal is to execute arbitrary commands on the host operating system via a vulnerable application. These attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell.

The arbitrary commands will be executed on successful command injection attack through vulnerable application. The features available in Commix include a set of options for specifying which parameters should be injected and to append the injection payloads. User can also define data in POST request as well as employ injection payload suffix and prefix string to exploit the target.

Moreover, it supports base64 encoding for multiple injection techniques (eval-based, time based or file based).


Python version 2.6.x or 2.7.x is required for running this program.

Supported Platform

Mac OS X
Windows (Experimental)


Download commix by cloning the Git repository:

git clone https://github.com/stasinopoulos/commix.git commix

Commix comes packaged on the official repositories of the following Linux distributions:

Kali Linux

Commix also comes pre-installed, on the following penetration testing frameworks:

The Penetration Testers Framework (PTF)


To get a list of all options and switches use:

python commix.py -h

So, do you want to get some ideas on how to use commix? Have a quick look of all available options and switches here.

Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

What Makes ICS/OT Infrastructure Vulnerable?

Infrastructure security for operational technologies (OT) and industrial control systems (ICS) varies from IT security in several ways, with the inverse confidentiality, integrity, and...

Everything You Must Know About IT/OT Convergence

What is an Operational Technology (OT)? Operational technology (OT) is a technology that primarily monitors and controls physical operations. It can automate and control machines,...

Understand the OT Security and Its Importance

This article discusses OT security and why it is essential for protecting industrial systems from cyberattacks. We will also discuss common control objectives that can...

What is Deepfake, and how does it Affect Cybersecurity?

Producing deepfake is easy. It is hard to detect. They operate with a description of reality rather than reality itself (e.g., a video). Any...