General¶

-h, --help

Show help and exit.

-v VERBOSE

Verbosity level (0-4, Default: 0). Level 1 enables basic debug info; level 2 shows all HTTP requests; level 3 adds HTTP response headers; level 4 shows full request and response bodies.

--install

Install commix system-wide, making it accessible from any location. Requires administrator privileges.

--version

Show version number and exit.

--update

Check for updates (apply if any) and exit. Requires installation via git clone from the official repository.

--output-dir=OUTDIR

Set custom output directory path. The directory is created if it does not exist.

-s SESSION_FILE

Load session from a stored (.sqlite) file.

--flush-session

Flush session files for current target. Forces a fresh scan from scratch.

--ignore-session

Ignore results stored in session file without deleting them. Useful for re-validating findings without losing historical data.

-t TRAFFIC_FILE

Log all HTTP traffic into a textual file.

--time-limit=SECONDS

Run with a time limit in seconds (e.g. 3600). Useful in automated environments such as CI/CD pipelines.

--batch

Never ask for user input, use the default behaviour. Ideal for automation and headless environments.

--skip-heuristics

Skip heuristic detection for code injection.

--codec=CODEC

Force codec for character encoding (e.g. 'ascii').

--charset=CHARSET

Time-related injection charset (e.g. '0123456789abcdef'). Useful for bypassing input filters or WAFs that block certain characters.

--check-internet

Check internet connection before assessing the target.

--answers=ANSWERS

Set predefined answers (e.g. 'quit=N,follow=N'). Enables automation by pre-defining responses to interactive prompts.

Target¶

-u URL, --url=URL

Target URL. This option is mandatory unless the target is defined through alternative methods such as log files or bulk input files.

--url-reload

Reload target URL after command execution. Useful when the application state changes after each injection attempt.

-l LOGFILE

Parse target from HTTP proxy log file.

-m BULKFILE

Scan multiple targets given in a textual file.

-r REQUESTFILE

Load HTTP request from a file. The file must contain the full raw HTTP request as sent to the server.

--crawl=CRAWLDEPTH

Crawl the website starting from the target URL (Default: 1). Higher depths increase scan duration and server load.

--crawl-exclude=REGEXP

Regexp to exclude pages from crawling (e.g. 'logout').

-x SITEMAP_URL

Parse target(s) from remote sitemap(.xml) file.

--method=METHOD

Force usage of given HTTP method (e.g. 'PUT'). Useful for testing RESTful APIs or non-standard endpoints.

Request¶

-d DATA, --data=DATA

Data string to be sent through POST. When provided, commix automatically switches from GET to POST.

--host=HOST

HTTP Host header. Tested if --level is set to 3.

--referer=REFERER

HTTP Referer header. Tested if --level is set to 3.

--user-agent=AGENT

HTTP User-Agent header. Tested if --level is set to 3.

--random-agent

Use a randomly selected HTTP User-Agent header from a built-in list. Useful for evading basic WAF or CDN filtering.

--param-del=PDEL

Set character for splitting parameter values (default: '&').

--cookie=COOKIE

HTTP Cookie header (e.g. 'key1=value1; key2=value2').

--cookie-del=CDEL

Set character for splitting cookie values (default: ';').

--http1.0

Force requests to use the HTTP/1.0 protocol. Useful for legacy servers.

-H HEADER, --header=HEADER

Extra header (e.g. 'X-Forwarded-For: 127.0.0.1'). For multiple headers use --headers.

--headers=HEADERS

Extra headers separated by '\n' (e.g. 'Accept-Language: fr\nETag: 123').

--proxy=PROXY

Use an HTTP proxy to connect to the target URL (e.g. 'http://127.0.0.1:8080'). For SOCKS proxies, use proxychains.

--tor

Use the Tor network. Requires the Tor service to be running.

--tor-port=PORT

Set Tor proxy port (Default: 8118). Use 9050 for the native Tor SOCKS port when combined with proxychains.

--auth-url=URL

Login panel URL. Use with --auth-data to enable automated authentication.

--auth-data=DATA

Login parameters and data (e.g. 'user=admin&pass=1234').

--auth-type=TYPE

HTTP authentication type (Basic, Digest, Bearer).

--auth-cred=CRED

HTTP authentication credentials (e.g. 'admin:admin').

--abort-code=CODE

Abort on (problematic) HTTP error code(s) (e.g. '401,403').

--ignore-code=CODE

Ignore (problematic) HTTP error code(s) (e.g. '404,403').

--force-ssl

Force usage of SSL/HTTPS regardless of the URL scheme.

--ignore-proxy

Ignore system default proxy settings.

--ignore-redirects

Ignore redirection attempts (HTTP 3xx).

--timeout=SECONDS

Seconds to wait before timeout connection (Default: 30).

--retries=RETRIES

Retries when the connection timeouts (Default: 3).

--drop-set-cookie

Ignore Set-Cookie header from response. Useful for maintaining a stable session throughout the scan.

Enumeration¶

--all

Retrieve everything.

--current-user

Retrieve current user name.

--hostname

Retrieve current hostname.

--is-root

Check if the current user has root privileges (Unix/Linux).

--is-admin

Check if the current user has admin privileges (Windows).

--sys-info

Retrieve system information (OS version, kernel, architecture).

--users

Retrieve system users.

--passwords

Retrieve system users password hashes.

--privileges

Retrieve system users privileges.

--ps-version

Retrieve PowerShell's version number (Windows targets).

File Access¶

--file-read=FILEPATH

Read a file from the target host (e.g. '/etc/passwd').

--file-write=FILEPATH

Write a local file to the target host. Use with --file-dest.

--file-dest=FILEPATH

Host's absolute filepath to write and/or upload to.

Modules¶

--shellshock

Enable the Shellshock (CVE-2014-6271) injection module. Tests CGI scripts that rely on Bash, where injected payloads in HTTP headers (User-Agent, Referer, Cookie) may be executed.

Injection¶

-p PARAMETER

Testable parameter(s). Multiple parameters can be specified as a comma-separated list.

--skip=PARAMETER

Skip testing for given parameter(s).

--suffix=SUFFIX

Injection payload suffix string. Useful for closing quotes or syntax elements in the injection context.

--prefix=PREFIX

Injection payload prefix string. Useful for opening quotes or syntax elements in the injection context.

--technique=TECH

Specify injection technique(s) to use. Available techniques:

Multiple techniques can be combined (e.g. --technique='ctf').

--skip-technique=TECH

Specify injection technique(s) to skip (e.g. --skip-technique='tf').

--maxlen=MAXLEN

Set the max length of output for time-related injection techniques (Default: 10000 chars).

--delay=SECONDS

Seconds to delay between each HTTP request. Helps evade rate-limiting and WAF mechanisms.

--time-sec=SECONDS

Seconds to delay the OS response in time-based techniques (Default: 1).

--tmp-path=PATH

Set the absolute path of web server's temp directory.

--web-root=PATH

Set the web server document root directory (e.g. '/var/www').

--alter-shell=SHELL

Use an alternative os-shell (e.g. 'Python'). Useful when the default shell is restricted.

--os-cmd=COMMAND

Execute a single operating system command and display the output.

--os=OS

Force back-end operating system (e.g. 'Windows' or 'Unix'). Overrides automatic OS detection.

--tamper=SCRIPT

Use given script(s) for tampering injection data. Useful for bypassing WAFs and input filters. See --list-tampers for available scripts.

--msf-path=PATH

Set a local path where Metasploit Framework is installed (e.g. '/opt/metasploit-framework'). Enables post-exploitation integration with MSF modules.

Detection¶

--level=LEVEL

Level of tests to perform (1-3, Default: 1).

--skip-calc

Skip the mathematic calculation during the detection phase.

--skip-empty

Skip testing the parameter(s) with empty value(s).

--failed-tries=N

Set a number of failed injection tries before aborting, in file-based technique.

--smart

Perform thorough tests only if positive heuristic(s). Reduces false positives and shortens scan time.

Miscellaneous¶

--ignore-dependencies

Ignore all required third-party library dependencies. Use with caution as it may reduce functionality.

--list-tampers

Display list of available tamper scripts.

--alert=COMMAND

Run host OS command(s) when injection point is found. Useful for triggering alerts or integrating with external monitoring tools.

--no-logging

Disable logging to a file. Results are shown in the console only.

--purge

Safely remove all content from commix data directory (cache, sessions, logs).

--skip-waf

Skip heuristic detection of WAF/IPS/IDS protection.

--mobile

Imitate smartphone through HTTP User-Agent header. Useful for testing mobile-specific application interfaces.

--offline

Work in offline mode, disabling update checks and internet requirements.

--wizard

Simple wizard interface for beginner users.

--disable-coloring

Disable console output coloring. Useful when logging to files or in terminals without color support.