Automated All-in-One OS Command Injection Exploitation Tool
This report presents the forensic synthetic code analysis of commixproject/commix, a Python project with 5,782 GitHub stars. SynthScan v2.0 examined 27,182 lines of code across 131 source files, recording 780 pattern matches distributed across 13 syntactic categories. The overall adjusted score of 45.8 places this repository in the Strong AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 780 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | setup.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | commix.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/compat.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/convert.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/main.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/testing.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/shells/bind_tcp.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/shells/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/shells/reverse_tcp.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/randomcase.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/sleep2usleep.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/backslashes.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/rev.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/hexencode.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/sleep2timeout.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/xforwardedfor.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/space2plus.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/printf2echo.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/multiplespaces.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/uninitializedvariable.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/slash2env.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/caret.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/doublequotes.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/backticks.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/space2htab.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/dollaratsigns.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/space2ifs.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/space2vtab.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/base64encode.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/nested.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/tamper/singlequotes.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/proxy.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/redirection.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/tor.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/authentication.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/parameters.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/headers.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/requests.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/modules/modules_handler.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/modules/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/modules/shellshock/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/injections/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/injections/blind/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/injections/blind/techniques/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | …/injections/blind/techniques/time_based/tb_payloads.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | …ore/injections/blind/techniques/time_based/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | …e/injections/blind/techniques/time_based/tb_handler.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | …/injections/blind/techniques/time_based/tb_injector.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/injections/results_based/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | …c/core/injections/results_based/techniques/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | …ections/results_based/techniques/classic/cb_handler.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | …njections/results_based/techniques/classic/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | …ctions/results_based/techniques/classic/cb_injector.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | …ctions/results_based/techniques/classic/cb_payloads.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | …ons/results_based/techniques/eval_based/eb_injector.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | …ctions/results_based/techniques/eval_based/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| 47 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | commix.py | 31 | CODE | |
| LOW | src/core/main.py | 24 | CODE | |
| LOW | src/core/main.py | 25 | CODE | |
| LOW | src/core/main.py | 36 | CODE | |
| LOW | src/core/main.py | 38 | CODE | |
| LOW | src/core/main.py | 38 | CODE | |
| LOW | src/core/main.py | 38 | CODE | |
| LOW | src/core/main.py | 45 | CODE | |
| LOW | src/core/testing.py | 16 | CODE | |
| LOW | src/core/testing.py | 18 | CODE | |
| LOW | src/core/shells/bind_tcp.py | 17 | CODE | |
| LOW | src/core/shells/bind_tcp.py | 18 | CODE | |
| LOW | src/core/shells/bind_tcp.py | 19 | CODE | |
| LOW | src/core/shells/bind_tcp.py | 20 | CODE | |
| LOW | src/core/shells/bind_tcp.py | 27 | CODE | |
| LOW | src/core/shells/bind_tcp.py | 27 | CODE | |
| LOW | src/core/shells/reverse_tcp.py | 17 | CODE | |
| LOW | src/core/shells/reverse_tcp.py | 18 | CODE | |
| LOW | src/core/shells/reverse_tcp.py | 19 | CODE | |
| LOW | src/core/shells/reverse_tcp.py | 32 | CODE | |
| LOW | src/core/shells/reverse_tcp.py | 32 | CODE | |
| LOW | src/core/tamper/sleep2usleep.py | 17 | CODE | |
| LOW | src/core/tamper/sleep2usleep.py | 18 | CODE | |
| LOW | src/core/tamper/sleep2usleep.py | 20 | CODE | |
| LOW | src/core/tamper/backslashes.py | 17 | CODE | |
| LOW | src/core/tamper/hexencode.py | 16 | CODE | |
| LOW | src/core/tamper/sleep2timeout.py | 17 | CODE | |
| LOW | src/core/tamper/sleep2timeout.py | 18 | CODE | |
| LOW | src/core/tamper/sleep2timeout.py | 20 | CODE | |
| LOW | src/core/tamper/slash2env.py | 16 | CODE | |
| LOW | src/core/tamper/slash2env.py | 17 | CODE | |
| LOW | src/core/tamper/caret.py | 17 | CODE | |
| LOW | src/core/tamper/caret.py | 18 | CODE | |
| LOW | src/core/tamper/base64encode.py | 16 | CODE | |
| LOW | src/core/tamper/nested.py | 16 | CODE | |
| LOW | src/core/tamper/nested.py | 17 | CODE | |
| LOW | src/core/requests/proxy.py | 16 | CODE | |
| LOW | src/core/requests/proxy.py | 17 | CODE | |
| LOW | src/core/requests/proxy.py | 20 | CODE | |
| LOW | src/core/requests/proxy.py | 22 | CODE | |
| LOW | src/core/requests/proxy.py | 24 | CODE | |
| LOW | src/core/requests/proxy.py | 24 | CODE | |
| LOW | src/core/requests/proxy.py | 24 | CODE | |
| LOW | src/core/requests/proxy.py | 24 | CODE | |
| LOW | src/core/requests/proxy.py | 25 | CODE | |
| LOW | src/core/requests/redirection.py | 16 | CODE | |
| LOW | src/core/requests/redirection.py | 17 | CODE | |
| LOW | src/core/requests/redirection.py | 18 | CODE | |
| LOW | src/core/requests/redirection.py | 19 | CODE | |
| LOW | src/core/requests/redirection.py | 24 | CODE | |
| LOW | src/core/requests/redirection.py | 30 | CODE | |
| LOW | src/core/requests/redirection.py | 33 | CODE | |
| LOW | src/core/requests/redirection.py | 33 | CODE | |
| LOW | src/core/requests/redirection.py | 33 | CODE | |
| LOW | src/core/requests/redirection.py | 33 | CODE | |
| LOW | src/core/requests/redirection.py | 21 | CODE | |
| LOW | src/core/requests/redirection.py | 23 | CODE | |
| LOW | src/core/requests/tor.py | 17 | CODE | |
| LOW | src/core/requests/tor.py | 19 | CODE | |
| LOW | src/core/requests/tor.py | 22 | CODE | |
| 184 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | src/core/main.py | 633 | # Check if defined "--list-tampers" option. | COMMENT |
| LOW⚡ | src/core/main.py | 642 | # Check if defined "--ignore-dependencies" option. | COMMENT |
| LOW⚡ | src/core/main.py | 646 | # Check if defined "--update" option. | COMMENT |
| LOW⚡ | src/core/main.py | 650 | # Check if defined "--install" option. | COMMENT |
| LOW⚡ | src/core/main.py | 655 | # Check if defined "--purge" option. | COMMENT |
| LOW⚡ | src/core/main.py | 870 | # Check if ".git" exists and check for updated version! | COMMENT |
| LOW⚡ | src/core/main.py | 874 | # Check if option is "--url" for single url test. | COMMENT |
| LOW⚡ | src/core/main.py | 882 | # Check if defined character used for splitting parameter values. | COMMENT |
| LOW⚡ | src/core/main.py | 886 | # Check if defined character used for splitting parameter values. | COMMENT |
| LOW | src/core/main.py | 145 | # Check if defined any HTTP Proxy (--proxy option). | COMMENT |
| LOW | src/core/main.py | 262 | # Check if http / https | COMMENT |
| LOW | src/core/main.py | 429 | # Check if defined character used for splitting cookie values. | COMMENT |
| LOW | src/core/main.py | 464 | # Check if specified wrong injection technique | COMMENT |
| LOW | src/core/main.py | 467 | # Check if used the ',' separator | COMMENT |
| LOW | src/core/main.py | 508 | # Check if defined "--url" or "-m" option. | COMMENT |
| LOW | src/core/main.py | 584 | # Check if defined "--version" option. | COMMENT |
| LOW | src/core/main.py | 597 | # Check if specified wrong alternative shell | COMMENT |
| LOW | src/core/main.py | 689 | # Check if defined "--proxy" option. | COMMENT |
| LOW | src/core/main.py | 714 | # Check if defined Tor (--tor option). | COMMENT |
| LOW | src/core/main.py | 731 | # Check if defined "--auth-cred" and/or '--auth-type'. | COMMENT |
| LOW | src/core/main.py | 753 | # Check if defined "--abort-code" option. | COMMENT |
| LOW | src/core/main.py | 762 | # Check if defined "--ignore-code" option. | COMMENT |
| LOW | src/core/main.py | 774 | # Check if defined "--wizard" option. | COMMENT |
| LOW | src/core/main.py | 813 | # Check if defined "--timesec" option. | COMMENT |
| LOW | src/core/main.py | 901 | # Check if option is "-m" for multiple urls test. | COMMENT |
| LOW | src/core/main.py | 923 | # Check if option "--crawl" is enabled. | COMMENT |
| LOW | src/core/requests/authentication.py | 59 | # Check if defined extra headers. | COMMENT |
| LOW⚡ | src/core/requests/authentication.py | 116 | # Check if verbose mode on | COMMENT |
| LOW | src/core/requests/authentication.py | 136 | # Check if defined any HTTP Proxy (--proxy option). | COMMENT |
| LOW | src/core/requests/parameters.py | 106 | # Check if single parameter is supplied. | COMMENT |
| LOW | src/core/requests/parameters.py | 108 | # Check if defined the INJECT_TAG | COMMENT |
| LOW | src/core/requests/parameters.py | 128 | # Check if multiple parameters are supplied without the "INJECT_HERE" tag. | COMMENT |
| LOW | src/core/requests/parameters.py | 133 | # Check if defined the "INJECT_HERE" tag | COMMENT |
| LOW | src/core/requests/parameters.py | 233 | # Check if parameters are empty or meaningless | COMMENT |
| LOW | src/core/requests/parameters.py | 298 | # Check if JSON Object. | COMMENT |
| LOW | src/core/requests/parameters.py | 306 | # Check if XML Object. | COMMENT |
| LOW | src/core/requests/parameters.py | 347 | # Check if single parameter is supplied. | COMMENT |
| LOW | src/core/requests/parameters.py | 398 | # Check if multiple parameters are supplied without the "INJECT_HERE" tag. | COMMENT |
| LOW | src/core/requests/parameters.py | 406 | # Check if not defined the "INJECT_HERE" tag in parameter | COMMENT |
| LOW | src/core/requests/parameters.py | 572 | # Check if defined "--prefix" option. | COMMENT |
| LOW | src/core/requests/parameters.py | 603 | # Check if defined "--suffix" option. | COMMENT |
| LOW | src/core/requests/parameters.py | 643 | # Check if single paramerter is supplied. | COMMENT |
| LOW | src/core/requests/parameters.py | 654 | # Check if defined the INJECT_TAG | COMMENT |
| LOW | src/core/requests/parameters.py | 669 | # Check if multiple parameters are supplied. | COMMENT |
| LOW | src/core/requests/parameters.py | 675 | # Check if not defined the "INJECT_HERE" tag in parameter | COMMENT |
| LOW⚡ | src/core/requests/headers.py | 318 | # Check if defined any Cookie HTTP header. | COMMENT |
| LOW⚡ | src/core/requests/headers.py | 322 | # Check if defined any User-Agent HTTP header. | COMMENT |
| LOW⚡ | src/core/requests/headers.py | 326 | # Check if defined any Referer HTTP header. | COMMENT |
| LOW⚡ | src/core/requests/headers.py | 330 | # Check if defined any Host HTTP header. | COMMENT |
| LOW | src/core/requests/headers.py | 357 | # Check if defined any HTTP Authentication credentials. | COMMENT |
| LOW | src/core/requests/headers.py | 395 | # Check if defined any extra HTTP headers. | COMMENT |
| LOW | src/core/requests/headers.py | 442 | # Check if it is a custom header injection. | COMMENT |
| LOW⚡ | src/core/requests/requests.py | 952 | # Check if defined "--verbose" option. | COMMENT |
| LOW⚡ | src/core/requests/requests.py | 957 | # Check if defined cookie with "INJECT_HERE" tag | COMMENT |
| LOW⚡ | src/core/requests/requests.py | 962 | # Check if defined custom header with "INJECT_HERE" tag | COMMENT |
| LOW⚡ | src/core/requests/requests.py | 967 | # Check if defined user-agent with "INJECT_HERE" tag | COMMENT |
| LOW⚡ | src/core/requests/requests.py | 972 | # Check if defined referer with "INJECT_HERE" tag | COMMENT |
| LOW⚡ | src/core/requests/requests.py | 977 | # Check if defined host with "INJECT_HERE" tag | COMMENT |
| LOW | src/core/requests/requests.py | 71 | # Check if defined POST data | COMMENT |
| LOW | src/core/requests/requests.py | 109 | # Check if defined POST data | COMMENT |
| 50 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/core/main.py | 136 | CODE | |
| LOW | src/core/main.py | 345 | CODE | |
| LOW | src/core/testing.py | 24 | CODE | |
| LOW | src/core/shells/bind_tcp.py | 32 | CODE | |
| LOW | src/core/shells/bind_tcp.py | 93 | CODE | |
| LOW | src/core/shells/bind_tcp.py | 302 | CODE | |
| LOW | src/core/shells/bind_tcp.py | 345 | CODE | |
| LOW | src/core/shells/reverse_tcp.py | 37 | CODE | |
| LOW | src/core/shells/reverse_tcp.py | 99 | CODE | |
| LOW | src/core/shells/reverse_tcp.py | 478 | CODE | |
| LOW | src/core/shells/reverse_tcp.py | 522 | CODE | |
| LOW | src/core/tamper/randomcase.py | 29 | CODE | |
| LOW | src/core/tamper/rev.py | 30 | CODE | |
| LOW | src/core/tamper/space2ifs.py | 32 | CODE | |
| LOW | src/core/tamper/space2vtab.py | 30 | CODE | |
| LOW | src/core/requests/redirection.py | 56 | CODE | |
| LOW | src/core/requests/authentication.py | 71 | CODE | |
| LOW | src/core/requests/authentication.py | 104 | CODE | |
| LOW | src/core/requests/parameters.py | 41 | CODE | |
| LOW | src/core/requests/parameters.py | 180 | CODE | |
| LOW | src/core/requests/parameters.py | 221 | CODE | |
| LOW | src/core/requests/parameters.py | 466 | CODE | |
| LOW | src/core/requests/parameters.py | 538 | CODE | |
| LOW | src/core/requests/parameters.py | 615 | CODE | |
| LOW | src/core/requests/parameters.py | 724 | CODE | |
| LOW | src/core/requests/headers.py | 119 | CODE | |
| LOW | src/core/requests/headers.py | 314 | CODE | |
| LOW | src/core/requests/requests.py | 69 | CODE | |
| LOW | src/core/requests/requests.py | 102 | CODE | |
| LOW | src/core/requests/requests.py | 290 | CODE | |
| LOW | src/core/requests/requests.py | 708 | CODE | |
| LOW | src/core/requests/requests.py | 814 | CODE | |
| LOW | src/core/requests/requests.py | 885 | CODE | |
| LOW | src/core/requests/requests.py | 944 | CODE | |
| LOW | src/core/modules/shellshock/shellshock.py | 91 | CODE | |
| LOW | src/core/modules/shellshock/shellshock.py | 183 | CODE | |
| LOW | src/core/modules/shellshock/shellshock.py | 211 | CODE | |
| LOW | src/core/modules/shellshock/shellshock.py | 239 | CODE | |
| LOW | src/core/modules/shellshock/shellshock.py | 277 | CODE | |
| LOW | src/core/modules/shellshock/shellshock.py | 516 | CODE | |
| LOW | …/injections/blind/techniques/time_based/tb_payloads.py | 27 | CODE | |
| LOW | …/injections/blind/techniques/time_based/tb_payloads.py | 91 | CODE | |
| LOW | …/injections/blind/techniques/time_based/tb_payloads.py | 157 | CODE | |
| LOW | …/injections/blind/techniques/time_based/tb_payloads.py | 227 | CODE | |
| LOW | …/injections/blind/techniques/time_based/tb_payloads.py | 291 | CODE | |
| LOW | …/injections/blind/techniques/time_based/tb_payloads.py | 366 | CODE | |
| LOW | …/injections/blind/techniques/time_based/tb_payloads.py | 433 | CODE | |
| LOW | …/injections/blind/techniques/time_based/tb_payloads.py | 493 | CODE | |
| LOW | …e/injections/blind/techniques/time_based/tb_handler.py | 35 | CODE | |
| LOW | src/core/injections/controller/shell_options.py | 63 | CODE | |
| LOW | src/core/injections/controller/shell_options.py | 96 | CODE | |
| LOW | src/core/injections/controller/shell_options.py | 130 | CODE | |
| LOW | src/core/injections/controller/controller.py | 147 | CODE | |
| LOW | src/core/injections/controller/controller.py | 193 | CODE | |
| LOW | src/core/injections/controller/controller.py | 248 | CODE | |
| LOW | src/core/injections/controller/controller.py | 313 | CODE | |
| LOW | src/core/injections/controller/controller.py | 682 | CODE | |
| LOW | src/core/injections/controller/controller.py | 869 | CODE | |
| LOW | src/core/injections/controller/handler.py | 76 | CODE | |
| LOW | src/core/injections/controller/handler.py | 172 | CODE | |
| 104 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/core/main.py | 345 | def main(filename, url, http_request_method): | CODE |
| LOW | src/core/main.py | 164 | except Exception as err_msg: | CODE |
| LOW | src/core/main.py | 231 | except Exception as err_msg: | CODE |
| LOW | src/core/main.py | 622 | except Exception as ex: | CODE |
| LOW | src/core/main.py | 836 | except Exception as e: | CODE |
| LOW | src/core/testing.py | 44 | except Exception as e: | CODE |
| LOW | src/core/requests/proxy.py | 43 | except Exception as err_msg: | CODE |
| MEDIUM | src/core/requests/proxy.py | 30 | def use_proxy(request): | CODE |
| LOW | src/core/requests/tor.py | 52 | except Exception: | CODE |
| LOW | src/core/requests/authentication.py | 65 | except Exception as err_msg: | CODE |
| MEDIUM | src/core/requests/authentication.py | 40 | def authentication_process(http_request_method): | CODE |
| MEDIUM | src/core/requests/parameters.py | 227 | def is_empty_json_str(s): | CODE |
| LOW | src/core/requests/parameters.py | 201 | except Exception: | CODE |
| LOW | src/core/requests/parameters.py | 230 | except Exception: | CODE |
| LOW | src/core/requests/parameters.py | 504 | except Exception: | CODE |
| LOW | src/core/requests/parameters.py | 523 | except Exception: | CODE |
| LOW | src/core/requests/parameters.py | 739 | except Exception: | CODE |
| LOW | src/core/requests/headers.py | 261 | except Exception: | CODE |
| MEDIUM | src/core/requests/requests.py | 69 | def crawler_request(url, http_request_method): | CODE |
| MEDIUM | src/core/requests/requests.py | 860 | def technology_identification(response): | CODE |
| LOW | src/core/requests/requests.py | 56 | except Exception: | CODE |
| LOW | src/core/requests/requests.py | 253 | except Exception as err_msg: | CODE |
| LOW | src/core/requests/requests.py | 424 | except Exception as err_msg: | CODE |
| LOW | src/core/requests/requests.py | 429 | except Exception as err_msg: | CODE |
| LOW | src/core/requests/requests.py | 520 | except Exception as err_msg: | CODE |
| LOW | src/core/requests/requests.py | 563 | except Exception as err_msg: | CODE |
| LOW | src/core/requests/requests.py | 606 | except Exception as err_msg: | CODE |
| LOW | src/core/requests/requests.py | 649 | except Exception as err_msg: | CODE |
| LOW | src/core/requests/requests.py | 695 | except Exception as err_msg: | CODE |
| LOW | src/core/requests/requests.py | 774 | except Exception as e: | CODE |
| LOW | src/core/requests/requests.py | 876 | except Exception: | CODE |
| MEDIUM | src/core/injections/controller/checks.py | 484 | def tab_autocompleter(): | CODE |
| MEDIUM | src/core/injections/controller/checks.py | 577 | def value_inside_boundaries(parameter, http_request_method): | CODE |
| MEDIUM | src/core/injections/controller/checks.py | 679 | def process_page_content(response, action): | CODE |
| LOW | src/core/injections/controller/checks.py | 341 | except Exception as e: | CODE |
| LOW | src/core/injections/controller/checks.py | 570 | except Exception as e: | CODE |
| LOW | src/core/injections/controller/checks.py | 619 | except Exception as e: | CODE |
| LOW | src/core/injections/controller/checks.py | 1809 | except Exception: | CODE |
| LOW | src/core/injections/controller/checks.py | 1826 | except Exception: | CODE |
| LOW | src/core/injections/controller/checks.py | 2040 | except Exception: | CODE |
| LOW | src/core/injections/controller/checks.py | 2182 | except Exception: | CODE |
| LOW | src/utils/update.py | 105 | except Exception as err_msg: | CODE |
| LOW | src/utils/update.py | 181 | except Exception as err_msg: | CODE |
| LOW | src/utils/common.py | 52 | except Exception as err_msg: | CODE |
| MEDIUM | src/utils/common.py | 47 | def safe_input(message): | CODE |
| MEDIUM | src/utils/session_handler.py | 110 | def clear(url): | CODE |
| MEDIUM | src/utils/session_handler.py | 147 | def import_injection_points(url, technique, injection_type, filename, separator, | CODE |
| LOW | src/utils/session_handler.py | 139 | except Exception as e: | CODE |
| LOW | src/utils/session_handler.py | 337 | except Exception: | CODE |
| LOW | src/utils/install.py | 33 | except Exception as e: | CODE |
| LOW | src/utils/install.py | 100 | except Exception as e: | CODE |
| LOW | src/utils/install.py | 113 | except Exception as e: | CODE |
| LOW | src/utils/crawler.py | 280 | except Exception as e: # for non-HTML files and non-valid links | CODE |
| MEDIUM | src/utils/crawler.py | 104 | def store_crawling(output_href): | CODE |
| LOW | src/thirdparty/beautifulsoup/beautifulsoup.py | 1852 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/core/main.py | 337 | def check_value_inside_boundaries(url, http_request_method): | CODE |
| LOW | src/core/tamper/uninitializedvariable.py | 38 | def add_uninitialized_variable(payload): | CODE |
| LOW | src/core/requests/parameters.py | 754 | def specify_header_injection_parameter(header_value, header_name): | CODE |
| LOW | src/core/requests/parameters.py | 783 | def specify_user_agent_parameter(user_agent): | CODE |
| LOW | src/core/requests/parameters.py | 789 | def specify_referer_parameter(referer): | CODE |
| LOW | src/core/requests/parameters.py | 801 | def specify_custom_header_parameter(custom_header_value): | CODE |
| LOW | src/core/requests/requests.py | 784 | def application_identification(url): | CODE |
| LOW | src/core/requests/requests.py | 860 | def technology_identification(response): | CODE |
| LOW | …/injections/blind/techniques/time_based/tb_payloads.py | 227 | def cmd_execution_alter_shell(separator, cmd, output_length, timesec, http_request_method): | CODE |
| LOW | …ctions/results_based/techniques/classic/cb_payloads.py | 129 | def cmd_execution_alter_shell(separator, TAG, cmd): | CODE |
| LOW | …ons/results_based/techniques/eval_based/eb_payloads.py | 199 | def cmd_execution_alter_shell(separator, TAG, cmd): | CODE |
| LOW⚡ | src/core/injections/controller/controller.py | 74 | def init_http_header_injection_status(): | CODE |
| LOW⚡ | src/core/injections/controller/controller.py | 83 | def init_cookie_injection_status(): | CODE |
| LOW⚡ | src/core/injections/controller/controller.py | 89 | def check_for_stored_sessions(url, check_parameter, http_request_method): | CODE |
| LOW | src/core/injections/controller/controller.py | 147 | def command_injection_heuristic_basic(url, http_request_method, check_parameter, the_type, header_name, inject_http_head | CODE |
| LOW | src/core/injections/controller/controller.py | 193 | def code_injections_heuristic_basic(url, http_request_method, check_parameter, the_type, header_name, inject_http_header | CODE |
| LOW | src/core/injections/controller/controller.py | 231 | def classic_command_injection_technique(url, timesec, filename, http_request_method): | CODE |
| LOW | src/core/injections/controller/controller.py | 248 | def dynamic_code_evaluation_technique(url, timesec, filename, http_request_method): | CODE |
| LOW | src/core/injections/controller/controller.py | 266 | def timebased_command_injection_technique(url, timesec, filename, http_request_method, url_time_response): | CODE |
| LOW | src/core/injections/controller/controller.py | 283 | def filebased_command_injection_technique(url, timesec, filename, http_request_method, url_time_response): | CODE |
| LOW | src/core/injections/controller/controller.py | 300 | def check_parameter_in_http_header(check_parameter): | CODE |
| LOW | src/core/injections/controller/controller.py | 532 | def filtered_testable_parameters(): | CODE |
| LOW | src/core/injections/controller/handler.py | 429 | def do_results_based_proccess(url, timesec, filename, http_request_method, injection_type, technique): | CODE |
| LOW⚡ | src/core/injections/controller/checks.py | 1412 | def enable_all_enumeration_options(): | CODE |
| LOW | src/core/injections/controller/checks.py | 98 | def injection_techniques_status(): | CODE |
| LOW | src/core/injections/controller/checks.py | 183 | def process_custom_injection_data(data): | CODE |
| LOW | src/core/injections/controller/checks.py | 205 | def custom_injection_marker_character(url, http_request_method): | CODE |
| LOW | src/core/injections/controller/checks.py | 567 | def get_value_value_inside_boundaries(value): | CODE |
| LOW | src/core/injections/controller/checks.py | 627 | def ignore_anticsrf_parameter(parameter): | CODE |
| LOW | src/core/injections/controller/checks.py | 639 | def ignore_google_analytics_cookie(cookie): | CODE |
| LOW | src/core/injections/controller/checks.py | 649 | def sanitize_payload_newlines(payload): | CODE |
| LOW | src/core/injections/controller/checks.py | 779 | def check_for_false_positive_result(false_positive_warning): | CODE |
| LOW | src/core/injections/controller/checks.py | 918 | def procced_with_file_based_technique(): | CODE |
| LOW | src/core/injections/controller/checks.py | 937 | def check_reverse_tcp_options(reverse_tcp_option): | CODE |
| LOW | src/core/injections/controller/checks.py | 1313 | def error_loading_session_file(): | CODE |
| LOW | src/core/injections/controller/checks.py | 1332 | def time_delay_recommendation(): | CODE |
| LOW | src/core/injections/controller/checks.py | 1340 | def time_delay_due_to_unstable_request(timesec): | CODE |
| LOW | src/core/injections/controller/checks.py | 1391 | def identified_http_auth_type(auth_type): | CODE |
| LOW | src/core/injections/controller/checks.py | 1437 | def check_provided_parameters(): | CODE |
| LOW | src/core/injections/controller/checks.py | 1891 | def perform_payload_modification(payload): | CODE |
| LOW | src/core/injections/controller/checks.py | 2615 | def remove_command_substitution(cmd): | CODE |
| LOW | src/core/injections/controller/checks.py | 2752 | def define_vulnerable_http_header(http_header_name): | CODE |
| LOW | src/core/injections/controller/checks.py | 2814 | def identified_vulnerable_param(url, technique, injection_type, vuln_parameter, payload, http_request_method, filename, | CODE |
| LOW | src/core/injections/controller/checks.py | 3016 | def time_related_export_injection_results(cmd, separator, output, check_exec_time): | CODE |
| LOW | src/core/injections/controller/checks.py | 3058 | def windows_only_attack_vector(): | CODE |
| LOW | …ections/semiblind/techniques/file_based/fb_payloads.py | 105 | def cmd_execution_alter_shell(separator, cmd, OUTPUT_TEXTFILE): | CODE |
| LOW | …ns/semiblind/techniques/tempfile_based/tfb_payloads.py | 259 | def cmd_execution_alter_shell(separator, cmd, j, OUTPUT_TEXTFILE, timesec, http_request_method): | CODE |
| LOW | src/utils/session_handler.py | 273 | def check_stored_injection_points(url, check_parameter, http_request_method): | CODE |
| LOW | src/utils/settings.py | 105 | def print_legal_disclaimer_msg(legal_disclaimer_msg): | CODE |
| LOW | src/utils/settings.py | 188 | def print_http_response_content(content): | CODE |
| LOW | src/thirdparty/flatten_json/flatten_json.py | 14 | def check_if_numbers_are_consecutive(list_): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/core/main.py | 381 | # Define the level of tests to perform. | COMMENT |
| MEDIUM | src/core/main.py | 604 | # Define the level of verbosity. | COMMENT |
| MEDIUM | src/core/main.py | 855 | # Define the local path where Metasploit Framework is installed. | COMMENT |
| MEDIUM⚡ | src/core/requests/authentication.py | 106 | # Define the HTTP authentication type. | COMMENT |
| MEDIUM⚡ | src/core/requests/authentication.py | 108 | # Define the authentication wordlists for usernames / passwords. | COMMENT |
| MEDIUM | src/core/requests/parameters.py | 181 | # Define the vulnerable parameter | COMMENT |
| MEDIUM | src/utils/logs.py | 83 | # Create the logs filename | COMMENT |
| MEDIUM | src/utils/session_handler.py | 127 | # Create a comma-separated string of ids to keep | COMMENT |
| MEDIUM | src/utils/session_handler.py | 153 | # Create the table if it does not exist | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/core/requests/parameters.py | 48 | CODE | |
| LOW | src/core/requests/parameters.py | 623 | CODE | |
| LOW | src/core/requests/requests.py | 939 | CODE | |
| LOW | src/utils/settings.py | 107 | CODE | |
| LOW | src/utils/settings.py | 112 | CODE | |
| LOW | src/utils/settings.py | 117 | CODE | |
| LOW | src/utils/settings.py | 122 | CODE | |
| LOW | src/utils/settings.py | 127 | CODE | |
| LOW | src/utils/settings.py | 132 | CODE | |
| LOW | src/utils/settings.py | 137 | CODE | |
| LOW | src/utils/settings.py | 142 | CODE | |
| LOW | src/utils/settings.py | 147 | CODE | |
| LOW | src/utils/settings.py | 152 | CODE | |
| LOW | src/utils/settings.py | 157 | CODE | |
| LOW | src/utils/settings.py | 162 | CODE | |
| LOW | src/utils/settings.py | 167 | CODE | |
| LOW | src/utils/settings.py | 172 | CODE | |
| LOW | src/utils/settings.py | 177 | CODE | |
| LOW | src/utils/settings.py | 181 | CODE | |
| LOW | src/utils/settings.py | 185 | CODE | |
| LOW | src/utils/settings.py | 190 | CODE | |
| LOW | src/utils/settings.py | 195 | CODE | |
| LOW | src/utils/settings.py | 200 | CODE | |
| LOW | src/utils/settings.py | 205 | CODE | |
| LOW | src/utils/settings.py | 210 | CODE | |
| LOW | src/utils/settings.py | 215 | CODE | |
| LOW | src/thirdparty/beautifulsoup/beautifulsoup.py | 1100 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/utils/update.py | 40 | process = subprocess.Popen("git reset --hard HEAD && git clean -fd && git pull", shell=True, stdout=subprocess.PIPE, | CODE |
| HIGH | src/utils/requirements.py | 26 | subprocess.Popen(requirement, stdout=null, stderr=null) | CODE |
| HIGH | src/utils/settings.py | 1020 | JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]*"|\d+|true|false|null).*\}\s*(\]\s*)*\Z' | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ons/results_based/techniques/eval_based/eb_injector.py | 41 | # eof | COMMENT |
| LOW | src/core/injections/controller/injector.py | 581 | # eof | COMMENT |
| LOW | src/utils/crawler.py | 341 | # eof | COMMENT |
| LOW | src/thirdparty/beautifulsoup/beautifulsoup.py | 741 | # you modify an attribute value after parsing | COMMENT |
| LOW | src/thirdparty/beautifulsoup/beautifulsoup.py | 1441 | # | COMMENT |
| LOW | src/thirdparty/beautifulsoup/beautifulsoup.py | 1741 | COMMENT | |
| LOW | src/thirdparty/six/__init__.py | 1 | # Copyright (c) 2010-2020 Benjamin Peterson | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/thirdparty/beautifulsoup/beautifulsoup.py | 1455 | # haven't already gone through a supposedly comprehensive | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/utils/sgmllib.py | 22 | __all__ = ["SGMLParser", "SGMLParseError"] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/core/injections/controller/checks.py | 2150 | def process_data(data_type, http_request_method): | CODE |