Anastasios S.

Team leader @Obrela_Labs.
Author of @commixproject.
Builder n' breaker seduced by the dark side.

[Anastasios S. @ancst]

FYI @commixproject is to command injections, what @sqlmap is to SQL injections! Feel free to #fork @github! https://t.co/TEe7hQjmxS #python

[Commix Project @commixproject]

The #BugBounty community asked for an API. Since 2016. Almost a decade later, commix now has a REST API + a @Burp_Suite extension.

- API: https://t.co/PlktIOfYwd
- Burp: https://t.co/n0a5MGr7tW

#Pentesting #InfoSec #CyberSecurity #HackerOne #Bugcrowd #Intigriti #YesWeHack #CTF

[Anastasios S. @ancst]

@commixproject Worth noting: @PortSwigger’s Burp Suite docs and @owasp’s Web Security Testing Guide cover blind command injection via time delays, output redirection, and OOB interaction. A Boolean-based approach doesn’t appear to be documented.

[Commix Project @commixproject]

How do you extract command output from blind command injection with no output, no sleep, and no OAST? @commixproject now introduces a Boolean-based blind technique.
If you're a #BugBounty hunter on #HackerOne, #Bugcrowd, #Intigriti, #YesWeHack, or anywhere else, this is for you.

[Commix Project @commixproject]

#Bugbounty hunting + #WAF + PHP code #injection?

WAF blocks system, exec, shell_exec etc?

Don't send them in the payload.
New tamper "phpserverheader" moves them into HTTP headers and reconstructs execution through "$_SERVER".

Update now to the latest dev and happy hunting.🫡

[Anastasios S. @ancst]

Great to see @YesWeHack covering command injection in this comprehensive guide.

The guide covers results-based, time-based, OOB and second-order command injection, and how @commixproject can be used to automate their detection and exploitation.

[YesWeHack ⠵ @yeswehack]

Want to find your first OS command injection? We're here to help! 💪

From classic attacks to second-order exploitation, our guide has everything you need ✅

#BugBountyTips

https://t.co/4PeUrnGk9T

[Anastasios S. @ancst]

Command injection is easy to demo and hard to find. Filters strip your separators. The response echoes nothing back. Sometimes DNS is the only thing leaving the network.
@commixproject handles all and commix-testbed (https://t.co/loZUbGuATO) gives you somewhere legal to practise.

[Anastasios S. @ancst]

Silence is not a clean bill of health.

With ‘--oob’, @commixproject gets the target to phone home instead: HTTPS, or DNS when everything else is filtered. Native interactsh client, no extra binaries to babysit.

Big ups to @pdiscoveryio for interactsh 🫡

[Commix Project @commixproject]

🚨 Breaking news: Commix now does out-of-band (OAST) detection and exploitation.

No output? No timing signal? Doesn't matter - the target now calls @pdiscoveryio's interactsh.

#OpenSource #InfoSec #CTF #CyberSecurity #BugBounty #BugBountyTips #BugBountyTools #Pentest

[Commix Project @commixproject]

🚨 Breaking news: Time-related techniques just got a serious upgrade.

Added parallel data retrieval with `--threads` and optimized time-related techniques using binary search for character extraction.

https://t.co/7CacikvVkW

#BugBounty #BugBounty #BugBountyTools #Pentest

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: GitHub has been compromised by TeamPCP. GitHub has confirmed the internal breach. A poisoned VS Code extension on an employee device exfiltrated ~3,800 internal repositories.

TeamPCP is already selling the data on a cybercrime forum.

[Commix Project @commixproject]

Commix recognized among the Top Pentesting Tools for 2025 by @ECCOUNCIL.

https://t.co/72QdFV85DH

Respect to everyone who keeps pushing it forward.

Big salut. 🫡

#pentesting
#infosec
#bugbounty
#cybersecurity
#opensource

[Commix Project @commixproject]

🚨 Heads up! Automated Commix crash reporting is officially deprecated.
All GitHub issues are now manual - review, tweak, and submit.

[Commix Project @commixproject]

Celebrating 11 years of @commixproject. 🎉
The anniversary release v4.1 is out: https://t.co/JHN18b6uHw
Huge thanks to everyone who contributed, tested, reported issues, and supported the project over the years. 🫡
#OpenSource #InfoSec #CTF #BugBounty #BugBountyTools #Pentesting

[Anastasios S. @ancst]

@cyber_razz Nice list - all bangers, but you ain't fully loaded 'til @commixproject 's in the arsenal.

[Commix Project @commixproject]

Improved handling of non-ASCII characters in URL path and query components. https://t.co/5ifAzIlbma #OpenSource #InfoSec #CTF #CyberSecurity #BugBounty #BugBountyTips #BugBountyTools #Pentesting

[Trickest @trick3st]

Our top Vulnerability Scanning tools:

- ZAP: Web app vulnerabilities
- Nuclei: Precise scanning, no false positives
- Sqlmap: Automate SQL injection flaw detection
- Commix: Command injection vulnerabilities
- Nikto: Web server audits

Read the guide👇

https://t.co/1xas8OUwlB

[Abhinav Singwal @yogsec]

Automated Command Injection Scan on Live Parameterized URLs with Commix ☕👇

cat urls.txt | grep "?" | httpx -mc 200 -silent | while read url; do commix --url="$url" --batch; done

[Commix Project @commixproject]

🚨 Breaking News!

Usage wiki just dropped a major update. Clearer, deeper, and packed with examples to get you in, pop the shell, and keep moving.

https://t.co/VsNwZdNEZI

#bugbounty #infosec #rce #commandinjection #pentesting #hacking

[Help Net Security @helpnetsecurity]

Hottest cybersecurity open-source tools of the month: February 2025 - https://t.co/FKFacMTV5p - @Github @commixproject @ancst @netbird - #GitHub #OpenSource #CyberSecurity #CyberSecurityNews #SecurityNews #software

[Commix Project @commixproject]

Added a new tamper script "https://t.co/25mGnlK0HZ" that replaces each character in a user-supplied OS command with a random case https://t.co/R0S3AKvCkX #OpenSource #InfoSec #CTF #CyberSecurity #BugBounty #BugBountyTips #BugBountyTools #Pentesting

[GitHubGPT @GitHubGPT]

📛 commix
🧠 Commix is an open-source penetration testing tool that automates the detection and exploitation of command injection vulnerabilities, requiring Python to run.
🛠️ @commixproject
💻 Python
⭐ 4930
🍴 849
🔗 https://t.co/S5wh8PiWqO