commixproject/commix

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

5824 stars · 940 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Commix (short for command injection exploiter) is an open-source penetration testing tool that automates the detection and exploitation of OS command injection vulnerabilities. It is written in Python, runs cross-platform, and supports advanced exploitation techniques including filter bypasses, file interaction, and post-exploitation shell acquisition.

Use cases

• detect command injection vulnerabilities in web applications
• automatically exploit os command injection flaws during pentests
• bypass input filters when injecting commands
• obtain a shell from a command injection vulnerability
• test targets for command injection during bug bounty hunting
• integrate command injection testing into pentest pipelines

When to choose

• you need automated detection and exploitation of command injection vulnerabilities
• you want a cross-platform Python tool with minimal dependencies for pentesting
• you need filter bypass techniques and post-exploitation features for command injection
• you are doing authorized penetration testing or bug bounty work on command injection flaws

When to avoid

• you are looking for a general web vulnerability scanner rather than a command injection specialist
• you need to test vulnerability classes other than command injection (e.g., SQL injection)
• you lack authorization to test the target system
• you need a GUI-based security testing tool

Facets

cli-tool · maturity active

penetration-testing vulnerability-scanning security security penetration-testing windows python cli command-injection exploitation pentesting bugbounty os-command-injection security-testing command-line linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="commixproject/commix")