commix
Automated command-injection tester. Use after you have a reflected parameter that smells like a shell concat, not as a first spray.
Tags: command-injection, rce
- Category
- inject
- Maintenance signal
- active
Use this when: Command boundary. A callback you control is the proof. Do not aim a shell at a host you do not own.
Install
git
git clone https://github.com/commixproject/commix.gitCommand templates
Probe a URL
python3 commix.py --url='{url}' --level=2