This document provides an overview of Commix, an open source tool for exploiting and testing for command injection vulnerabilities. It begins with an introduction to command injection attacks and why they occur. It then discusses the different types of command injection, including results-based and blind command injection techniques. The document outlines Commix's architecture, features, and modules. It concludes with recommendations for command injection testbeds and references for further information.

1. Commix
The Command Injector

2. Who am I ?
Working as an
Application security
Tester
Contact me
@rs.a0007@gmail.co

3. Agenda
 Introduction to Command Injection
 Why and where Command Injection may Occur?
 Types of Command Injection
 Detection techniques
 Intro to Commix
 Commix Architecture
 Features and modules of commix
 Demo

4. What is Command Injection ?
 Command injection is an attack in which the goal is
execution of arbitrary commands on the host operating
system via a vulnerable application
 Command injection attacks are possible when an
application passes unsafe user supplied data (forms,
cookies, HTTP headers etc.) to a system shell. The
commands are executed with the privileges of vulnerable
application

5. Where may command injections exist?
 ADSL SOHO routers (i.e D-Link, TP-Link, Linksys, ....)
 IP Cameras (i.e TP-Link, D-Link, Vivotek, Zero-IP, ...)
 Network Printers (i.e Xerox, ...)
 IP PBX Applications (i.e Asterisk PBX, FreePBX, ...)
 Raspberry PI based Web Applications
 Web Applications (i.e IBM, Sophos, Symantec, LanDesk, Cacti, SquirrelMail, ....)
 Arduino based Web Applications

6. Why are command injections occur?
 Command Injection attacks are OS-independent
 Can Occur in Windows, Linux, Unix etc.
 Also a programming language independent
 May occur in applications written in various programming languages C,C++,C#, PHP,
Java, Perl, Python, Ruby etc.
 ..or web-based applications written in web app frameworks such as ASP.NET, Python
Django, Ruby on Rails, CGI etc.

7. Types of Command Injection
 Results-based Command Injection
 The output of the injected command is visible on the vulnerable application
 The attacker can directly infer if the command injection is succeeded or not
 Blind Command Injection
 The vulnerable application does not output the results of the injected
command
 The attacker cannot see the results of the injected commands on the screen

8. Blind Command Injection - Techniques
There are two techniques to approach on Blind Command Injection
 Time-based Command Injection
 The results of the injected command can be noted by the “time
delays”
 File-based Command Injection tempfile based
 The results of the injected command will be written to a file
accessible on the vulnerable application

9. How to detect command injection ?
 Use separators like ; : & | , .
Techniques to bypass WAF or any filters
 URL Encoding
 Base64 Encoding
 Wildcard obfuscation

10. About Commix
 Commix is short for Command Injection Exploiter
 It is designed by Anastasios Stasinopoulos
 It Is aiming at facilitating web developers, penetration testers, security
researchers to test and exploit command injection attacks on the web
applications
 it is very easy to find and exploit a command injection vulnerability on
certain parameters or HTTP headers
 Commix is written in python programming language
 It requires python version 2.6.x or 2.7.x to install it

11. Supports
 Supported Platforms
 Linux
 Mac OSX
 Windows (experimental)
 Available in below distros
 ArchStrike
 BlackArch Linux
 BackBox
 Kali Linux
 Parrot Security OS
 Weakerthan Linux

12. Architecture of Commix

14. Reduced False Positives
 On results-based command injection
 Prints the results in three lines as
 Type of technique
 Which technique
 Payload
 On blind-based command injection
 Evaluates the average response time of server
 Applies the average time as a time to test

15. Features of commix
 It allows to provide our own HTTP Headers
 It supports to test via all these headers
 It supports enumeration options like
 Current user
 Current hostname
 User has root privileges or not
 System Information
 System users list etc.

16. Modules
 The “ICMP exfiltration“ module
 This module is designed to provide a server-side component
to receive and store files, exfiltrated over ICMP echo request
packets
 The 'Shellshock' module
 This module is designed to affect a bash vulnerability which
allows an attacker to remotely execute shell commands by
attaching malicious code in environment variables used by the
operating system.
 Develop and easily import your own modules
 Increase the capabilities of commix and/or adapt it to our needs

17. It’s Demo Time

18. Testbeds
 Commix testbed - https://github.com/s4n7h0/xvwa
 Pentester Academy command injection iso -
https://www.vulnhub.com/entry/command-injection-iso-1,81/
 bWAPP(bee-box) - https://www.vulnhub.com/entry/bwapp-bee-
box-v16,53/
 XVWA - https://github.com/s4n7h0/xvwa
 DVWA - http://www.dvwa.co.uk/
 OWASP Mutillidae - https://sourceforge.net/projects/mutillidae/

19. References
 OWASP -
https://www.owasp.org/index.php/Command_Injection
 Commix- http://www.commixproject.com/
 Usage examples -
https://github.com/commixproject/commix/wiki/Usage-
Examples

20. Any Questions?