skills.rest
AeonDave
AeonDaveCOMMUNITY
Explore all skills by this author →
GitHub

commix

Detect and exploit OS command injection vulnerabilities in web applications.

15|1|Updated Feb 12, 2026
Search Tags:#penetration testing#web security#command injection#vulnerability exploitation#commix#os command
One-click install
npx skills add https://github.com/AeonDave/malskill --skill commix
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: commix
Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/web-app/commix
Command: npx skills add https://github.com/AeonDave/malskill --skill commix

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automates the detection and exploitation of OS command injection vulnerabilities in web applications, streamlining the process of identifying and leveraging these security flaws.

Core Features & Use Cases

  • Automated Detection: Identifies command injection flaws in URLs, POST data, cookies, and HTTP headers.
  • Exploitation: Supports various techniques including classic, time-based, temp-file-based, and file-based methods.
  • Shell Access: Facilitates escalation from injection to interactive OS shell access.
  • Use Case: When a web application parameter is suspected of command injection, use this Skill to confirm the vulnerability and potentially gain shell access to the server.

Quick Start

Use the commix skill to test the URL http://target.com/page?ip=127.0.0.1 for command injection vulnerabilities.

Frequently Asked Questions about commix

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect and exploit OS command injection vulnerabilities in web applications?▼

To detect and exploit OS command injection vulnerabilities in web applications, this skill automates testing of URLs, POST data, cookies, and HTTP headers using classic, time-based, and file-based techniques to confirm exploitable flaws.

What techniques can I use to test for command injection flaws in HTTP headers and cookies?▼

You can test for command injection flaws in HTTP headers and cookies using classic, time-based, temp-file-based, and file-based techniques, which automate the validation of vulnerable parameters across various HTTP request components.

Can I escalate a command injection vulnerability into an interactive OS shell?▼

Yes, you can escalate a confirmed command injection vulnerability into an interactive OS shell. The skill facilitates this shell access during security assessments to allow direct server interaction.

What is the best way to automate web security testing for OS command injection?▼

The best way to automate web security testing for OS command injection is to target specific application parameters with automated detection tools that apply time-based and file-based exploitation techniques to validate vulnerabilities.

Does time-based command injection work for blind vulnerability exploitation?▼

Yes, time-based command injection works for blind vulnerability exploitation. The skill supports time-based techniques alongside temp-file and file-based methods to detect injection flaws that do not return direct output.

Related Skills

Explore More Software Engineering Skills→
ersinkocersinkoc
2

Web Application Fingerprinting

Identify website technologies via HTTP headers and HTML analysis.

Community
Intermediate
salmanabdurrahmansalmanabdurrahman

vuln-command-injection

Validates OS command injection vulnerabilities using non-destructive time-based probes and OOB callbacks.

Community
Advanced
gongzeqgongzeq

katana-crawl-web

Crawls authorized web targets to generate deduplicated candidate URLs for vulnerability scanning.

Community
Intermediate
ArianHobson333ArianHobson333
7

injection

Detect and exploit NoSQL and OS Command injection vulnerabilities in web applications.

Community
Advanced