commix (command injection)

commix --url="<url>?param=INJECT"

Automated tool to detect and exploit command injection in web applications.

When you suspect a parameter is passed to a system function (e.g., system, exec). commix tests multiple payloads and evasion techniques (encodings, space bypass) and can obtain an interactive shell.

If the parameter is sanitized or the command runs with restrictions (chroot, etc.). Also if the target is critical and payloads could cause damage.