Commix: Detecting and Exploiting Command Injection Flaws
summary
An open source Python tool named Commix automates detection and exploitation of command injection via generated attack vectors, HTTP headers and enumeration flags, and supports result-based and time-based blind techniques plus a temp file based hybrid; it includes an alternative Python shell, an ICMP exfiltration module, and plugins for common pentest frameworks. Commix runs from GitHub or distro packages, claims high success rates during testing and discovers multiple 0-day vulnerabilities (including a WordPress plugin and a sub-technology web app).
AI-written summary · about
chapters (19)
- 0:00Start
- 0:47Introduction
- 1:54Why are command injections still alive?
- 2:34What causes command injection flaws?
- 3:34Analysis of command injection attacks.
- 5:11Time-based technique.
- 6:17File-based technique.
- 7:33General information
- 8:03Installation
- 8:41Supported exploitation techniques.
- 9:34Architecture overview
- 10:27Reducing false positives.
- 11:31HTTP headers
- 12:02Enumeration options. The enumeration options, can be used to enumerate the target
- 12:46Alternative os-shell.
- 14:40Modules
- 15:40Command injection testbeds.
- 16:310-day #2 disclosure
- 17:34Bugs and enhancements
related talks
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
01h 01mHow hacking works - Web edition
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
53mHow hacking works - Web edition
26mTesting Python Security
39mHow to think like a hacker
32mWeaponizing Python for Good: Building a Next-Gen CVE Scanner That Detects Zero-Day Vulnerability
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way