Repository Analysis

commixproject/commix

Automated All-in-One OS Command Injection Exploitation Tool

42.0 Strong AI signal View on GitHub

Analysis Overview

This report presents the forensic synthetic code analysis of commixproject/commix, a Python project with 5,828 GitHub stars. SynthScan v2.0 examined 30,324 lines of code across 132 source files, recording 808 pattern matches distributed across 13 syntactic categories. The overall adjusted score of 42.0 places this repository in the Strong AI signal band.

The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).

42.0
Adjusted Score
42.0
Raw Score
100%
Time Factor
2026-08-25
Last Push
5.8K
Stars
Python
Language
30.3K
Lines of Code
132
Files
808
Pattern Hits
2026-08-29
Scan Date
0.84
HC Hit Rate

What These Metrics Mean

Adjusted Score
Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score
The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor
The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits
Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate
High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files
Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 0HIGH 111MEDIUM 28LOW 669

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 808 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Cross-File Repetition108 hits · 540 pts
SeverityFileLineSnippetContext
HIGHsetup.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHcommix.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/compat.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/convert.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/main.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/testing.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/shells/bind_tcp.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/shells/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/shells/reverse_tcp.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/randomcase.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/sleep2usleep.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/backslashes.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/rev.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/hexencode.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/sleep2timeout.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/xforwardedfor.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/space2plus.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/printf2echo.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/multiplespaces.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/uninitializedvariable.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/slash2env.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/caret.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/doublequotes.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/backticks.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/space2htab.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/dollaratsigns.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/space2ifs.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/space2vtab.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/base64encode.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/nested.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/singlequotes.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/stability.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/proxy.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/redirection.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/tor.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/authentication.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/parameters.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/headers.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/requests.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/modules/modules_handler.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/modules/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/modules/shellshock/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/injections/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/injections/blind/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/injections/blind/techniques/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…/injections/blind/techniques/time_based/tb_payloads.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…ore/injections/blind/techniques/time_based/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…e/injections/blind/techniques/time_based/tb_handler.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…/injections/blind/techniques/time_based/tb_injector.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/injections/results_based/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…c/core/injections/results_based/techniques/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…ections/results_based/techniques/classic/cb_handler.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…njections/results_based/techniques/classic/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…ctions/results_based/techniques/classic/cb_injector.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…ctions/results_based/techniques/classic/cb_payloads.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…ons/results_based/techniques/eval_based/eb_injector.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
48 more matches not shown…
Unused Imports228 hits · 206 pts
SeverityFileLineSnippetContext
LOWcommix.py31CODE
LOWsrc/core/main.py26CODE
LOWsrc/core/main.py27CODE
LOWsrc/core/main.py38CODE
LOWsrc/core/main.py40CODE
LOWsrc/core/main.py40CODE
LOWsrc/core/main.py40CODE
LOWsrc/core/main.py47CODE
LOWsrc/core/main.py933CODE
LOWsrc/core/testing.py16CODE
LOWsrc/core/testing.py18CODE
LOWsrc/core/shells/bind_tcp.py17CODE
LOWsrc/core/shells/bind_tcp.py18CODE
LOWsrc/core/shells/bind_tcp.py19CODE
LOWsrc/core/shells/bind_tcp.py20CODE
LOWsrc/core/shells/bind_tcp.py27CODE
LOWsrc/core/shells/bind_tcp.py27CODE
LOWsrc/core/shells/reverse_tcp.py17CODE
LOWsrc/core/shells/reverse_tcp.py18CODE
LOWsrc/core/shells/reverse_tcp.py19CODE
LOWsrc/core/shells/reverse_tcp.py33CODE
LOWsrc/core/shells/reverse_tcp.py33CODE
LOWsrc/core/requests/proxy.py16CODE
LOWsrc/core/requests/proxy.py17CODE
LOWsrc/core/requests/proxy.py20CODE
LOWsrc/core/requests/proxy.py23CODE
LOWsrc/core/requests/proxy.py25CODE
LOWsrc/core/requests/proxy.py25CODE
LOWsrc/core/requests/proxy.py25CODE
LOWsrc/core/requests/proxy.py25CODE
LOWsrc/core/requests/proxy.py26CODE
LOWsrc/core/requests/redirection.py16CODE
LOWsrc/core/requests/redirection.py17CODE
LOWsrc/core/requests/redirection.py18CODE
LOWsrc/core/requests/redirection.py19CODE
LOWsrc/core/requests/redirection.py24CODE
LOWsrc/core/requests/redirection.py28CODE
LOWsrc/core/requests/redirection.py30CODE
LOWsrc/core/requests/redirection.py30CODE
LOWsrc/core/requests/redirection.py30CODE
LOWsrc/core/requests/redirection.py30CODE
LOWsrc/core/requests/redirection.py21CODE
LOWsrc/core/requests/redirection.py23CODE
LOWsrc/core/requests/tor.py17CODE
LOWsrc/core/requests/tor.py19CODE
LOWsrc/core/requests/tor.py22CODE
LOWsrc/core/requests/tor.py24CODE
LOWsrc/core/requests/tor.py25CODE
LOWsrc/core/requests/tor.py25CODE
LOWsrc/core/requests/tor.py25CODE
LOWsrc/core/requests/tor.py25CODE
LOWsrc/core/requests/authentication.py17CODE
LOWsrc/core/requests/authentication.py18CODE
LOWsrc/core/requests/authentication.py19CODE
LOWsrc/core/requests/authentication.py28CODE
LOWsrc/core/requests/authentication.py29CODE
LOWsrc/core/requests/authentication.py29CODE
LOWsrc/core/requests/authentication.py29CODE
LOWsrc/core/requests/parameters.py17CODE
LOWsrc/core/requests/parameters.py18CODE
168 more matches not shown…
Redundant / Tautological Comments107 hits · 177 pts
SeverityFileLineSnippetContext
LOWsrc/core/main.py741 # Check if defined "--list-tampers" option.COMMENT
LOWsrc/core/main.py750 # Check if defined "--ignore-dependencies" option.COMMENT
LOWsrc/core/main.py754 # Check if defined "--update" option.COMMENT
LOWsrc/core/main.py758 # Check if defined "--install" option.COMMENT
LOWsrc/core/main.py763 # Check if defined "--purge" option.COMMENT
LOWsrc/core/main.py1008 # Check if ".git" exists and check for updated version!COMMENT
LOWsrc/core/main.py1012 # Check if option is "--url" for single url test.COMMENT
LOWsrc/core/main.py1020 # Check if defined character used for splitting parameter values.COMMENT
LOWsrc/core/main.py1024 # Check if defined character used for splitting parameter values.COMMENT
LOWsrc/core/main.py150 # Check if defined any HTTP Proxy (--proxy option).COMMENT
LOWsrc/core/main.py277 # Check if http / httpsCOMMENT
LOWsrc/core/main.py504 # Check if defined character used for splitting cookie values.COMMENT
LOWsrc/core/main.py539 # Check if specified wrong injection techniqueCOMMENT
LOWsrc/core/main.py542 # Check if used the ',' separatorCOMMENT
LOWsrc/core/main.py602 # Check if defined "--url" or "-m" option.COMMENT
LOWsrc/core/main.py683 # Check if defined "--version" option.COMMENT
LOWsrc/core/main.py696 # Check if specified wrong alternative shellCOMMENT
LOWsrc/core/main.py797 # Check if defined "--proxy" option.COMMENT
LOWsrc/core/main.py822 # Check if defined Tor (--tor option).COMMENT
LOWsrc/core/main.py839 # Check if defined "--auth-cred" and/or '--auth-type'.COMMENT
LOWsrc/core/main.py866 # Check if defined "--abort-code" option.COMMENT
LOWsrc/core/main.py875 # Check if defined "--ignore-code" option.COMMENT
LOWsrc/core/main.py887 # Check if defined "--wizard" option.COMMENT
LOWsrc/core/main.py926 # Check if defined "--timesec" option.COMMENT
LOWsrc/core/main.py930 # Check if defined "--threads" option.COMMENT
LOWsrc/core/main.py1043 # Check if option is "-m" for multiple urls test.COMMENT
LOWsrc/core/main.py1066 # Check if option "--crawl" is enabled.COMMENT
LOWsrc/core/requests/authentication.py55 # Check if defined extra headers.COMMENT
LOWsrc/core/requests/authentication.py128 # Check if verbose mode onCOMMENT
LOWsrc/core/requests/authentication.py151 # Check if defined any HTTP Proxy (--proxy option).COMMENT
LOWsrc/core/requests/parameters.py393 # Check if JSON Object.COMMENT
LOWsrc/core/requests/parameters.py401 # Check if XML Object.COMMENT
LOWsrc/core/requests/parameters.py754 # Check if defined the INJECT_TAGCOMMENT
LOWsrc/core/requests/parameters.py764 # Check if multiple parameters are supplied.COMMENT
LOWsrc/core/requests/parameters.py769 # Check if not defined the "INJECT_HERE" tag in parameterCOMMENT
LOWsrc/core/requests/parameters.py180 # Check if single parameter is supplied.COMMENT
LOWsrc/core/requests/parameters.py182 # Check if defined the INJECT_TAGCOMMENT
LOWsrc/core/requests/parameters.py201 # Check if defined the "INJECT_HERE" tagCOMMENT
LOWsrc/core/requests/parameters.py315 # Check if parameters are empty or meaninglessCOMMENT
LOWsrc/core/requests/parameters.py520 # Check if not defined the "INJECT_HERE" tag in parameterCOMMENT
LOWsrc/core/requests/parameters.py588 # Check if single parameter is supplied.COMMENT
LOWsrc/core/requests/parameters.py687 # Check if defined "--prefix" option.COMMENT
LOWsrc/core/requests/parameters.py710 # Check if defined "--suffix" option.COMMENT
LOWsrc/core/requests/parameters.py743 # Check if single paramerter is supplied.COMMENT
LOWsrc/core/requests/headers.py374 # Check if defined any Cookie HTTP header.COMMENT
LOWsrc/core/requests/headers.py378 # Check if defined any User-Agent HTTP header.COMMENT
LOWsrc/core/requests/headers.py382 # Check if defined any Referer HTTP header.COMMENT
LOWsrc/core/requests/headers.py386 # Check if defined any Host HTTP header.COMMENT
LOWsrc/core/requests/headers.py413 # Check if defined any HTTP Authentication credentials.COMMENT
LOWsrc/core/requests/headers.py451 # Check if defined any extra HTTP headers.COMMENT
LOWsrc/core/requests/headers.py498 # Check if it is a custom header injection.COMMENT
LOWsrc/core/requests/requests.py174 # Check if defined POST dataCOMMENT
LOWsrc/core/requests/requests.py1077 # Check if defined "--verbose" option.COMMENT
LOWsrc/core/requests/requests.py1082 # Check if defined cookie with "INJECT_HERE" tagCOMMENT
LOWsrc/core/requests/requests.py1087 # Check if defined custom header with "INJECT_HERE" tagCOMMENT
LOWsrc/core/requests/requests.py1092 # Check if defined user-agent with "INJECT_HERE" tagCOMMENT
LOWsrc/core/requests/requests.py1097 # Check if defined referer with "INJECT_HERE" tagCOMMENT
LOWsrc/core/requests/requests.py1102 # Check if defined host with "INJECT_HERE" tagCOMMENT
LOWsrc/core/requests/requests.py114 # Check if defined POST dataCOMMENT
LOWsrc/core/requests/requests.py282 # Check if failed to identify the realm attribute.COMMENT
47 more matches not shown…
Deep Nesting172 hits · 134 pts
SeverityFileLineSnippetContext
LOWsrc/core/main.py138CODE
LOWsrc/core/main.py410CODE
LOWsrc/core/testing.py24CODE
LOWsrc/core/shells/bind_tcp.py32CODE
LOWsrc/core/shells/bind_tcp.py137CODE
LOWsrc/core/shells/bind_tcp.py456CODE
LOWsrc/core/shells/bind_tcp.py539CODE
LOWsrc/core/shells/reverse_tcp.py38CODE
LOWsrc/core/shells/reverse_tcp.py169CODE
LOWsrc/core/shells/reverse_tcp.py715CODE
LOWsrc/core/shells/reverse_tcp.py798CODE
LOWsrc/core/tamper/space2ifs.py37CODE
LOWsrc/core/tamper/space2vtab.py35CODE
LOWsrc/core/requests/redirection.py58CODE
LOWsrc/core/requests/authentication.py79CODE
LOWsrc/core/requests/authentication.py112CODE
LOWsrc/core/requests/parameters.py123CODE
LOWsrc/core/requests/parameters.py391CODE
LOWsrc/core/requests/parameters.py454CODE
LOWsrc/core/requests/parameters.py510CODE
LOWsrc/core/requests/parameters.py597CODE
LOWsrc/core/requests/parameters.py661CODE
LOWsrc/core/requests/parameters.py722CODE
LOWsrc/core/requests/headers.py128CODE
LOWsrc/core/requests/headers.py370CODE
LOWsrc/core/requests/requests.py112CODE
LOWsrc/core/requests/requests.py166CODE
LOWsrc/core/requests/requests.py370CODE
LOWsrc/core/requests/requests.py822CODE
LOWsrc/core/requests/requests.py937CODE
LOWsrc/core/requests/requests.py1010CODE
LOWsrc/core/requests/requests.py1069CODE
LOWsrc/core/modules/shellshock/shellshock.py91CODE
LOWsrc/core/modules/shellshock/shellshock.py183CODE
LOWsrc/core/modules/shellshock/shellshock.py210CODE
LOWsrc/core/modules/shellshock/shellshock.py237CODE
LOWsrc/core/modules/shellshock/shellshock.py275CODE
LOWsrc/core/modules/shellshock/shellshock.py521CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py28CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py86CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py180CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py244CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py304CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py366CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py422CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py497CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py563CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py619CODE
LOW…e/injections/blind/techniques/time_based/tb_handler.py35CODE
LOWsrc/core/injections/controller/shell_options.py63CODE
LOWsrc/core/injections/controller/shell_options.py95CODE
LOWsrc/core/injections/controller/shell_options.py127CODE
LOWsrc/core/injections/controller/controller.py172CODE
LOWsrc/core/injections/controller/controller.py217CODE
LOWsrc/core/injections/controller/controller.py272CODE
LOWsrc/core/injections/controller/controller.py344CODE
LOWsrc/core/injections/controller/controller.py487CODE
LOWsrc/core/injections/controller/controller.py927CODE
LOWsrc/core/injections/controller/controller.py964CODE
LOWsrc/core/injections/controller/controller.py1129CODE
112 more matches not shown…
Excessive Try-Catch Wrapping73 hits · 78 pts
SeverityFileLineSnippetContext
MEDIUMsrc/core/main.py410def main(filename, url, http_request_method):CODE
LOWsrc/core/main.py733 except Exception as ex:CODE
LOWsrc/core/main.py169 except Exception as err_msg:CODE
LOWsrc/core/main.py244 except Exception as err_msg:CODE
LOWsrc/core/main.py969 except Exception as e:CODE
LOWsrc/core/testing.py44 except Exception as e:CODE
LOWsrc/core/requests/proxy.py44 except Exception as err_msg:CODE
MEDIUMsrc/core/requests/proxy.py31def use_proxy(request):CODE
LOWsrc/core/requests/tor.py52 except Exception:CODE
LOWsrc/core/requests/authentication.py73 except Exception as err_msg:CODE
MEDIUMsrc/core/requests/parameters.py236def register_custom_injection_marker(vuln_parameter, value_with_marker):CODE
MEDIUMsrc/core/requests/parameters.py305def is_empty_json_object(s):CODE
MEDIUMsrc/core/requests/parameters.py353def json_int_check(parameter, value):CODE
LOWsrc/core/requests/parameters.py242 except Exception:CODE
LOWsrc/core/requests/parameters.py282 except Exception:CODE
LOWsrc/core/requests/parameters.py308 except Exception:CODE
LOWsrc/core/requests/parameters.py326 except Exception:CODE
LOWsrc/core/requests/parameters.py356 except Exception:CODE
LOWsrc/core/requests/parameters.py368 except Exception:CODE
LOWsrc/core/requests/parameters.py606 except Exception:CODE
LOWsrc/core/requests/headers.py308 except Exception:CODE
MEDIUMsrc/core/requests/headers.py180def http_open(self, req):CODE
MEDIUMsrc/core/requests/requests.py112def crawler_request(url, http_request_method):CODE
MEDIUMsrc/core/requests/requests.py983def technology_identification(response):CODE
LOWsrc/core/requests/requests.py160 except Exception:CODE
LOWsrc/core/requests/requests.py100 except Exception:CODE
LOWsrc/core/requests/requests.py314 except Exception as err_msg:CODE
LOWsrc/core/requests/requests.py523 except Exception as err_msg:CODE
LOWsrc/core/requests/requests.py528 except Exception as err_msg:CODE
LOWsrc/core/requests/requests.py625 except Exception as err_msg:CODE
LOWsrc/core/requests/requests.py671 except Exception as err_msg:CODE
LOWsrc/core/requests/requests.py717 except Exception as err_msg:CODE
LOWsrc/core/requests/requests.py763 except Exception as err_msg:CODE
LOWsrc/core/requests/requests.py809 except Exception as err_msg:CODE
LOWsrc/core/requests/requests.py890 except Exception as e:CODE
LOWsrc/core/requests/requests.py1001 except Exception:CODE
MEDIUMsrc/core/injections/controller/controller.py858def has_stored_session(check_param):CODE
LOWsrc/core/injections/controller/controller.py395 except Exception:CODE
LOWsrc/core/injections/controller/controller.py459 except Exception:CODE
LOWsrc/core/injections/controller/controller.py861 except Exception:CODE
MEDIUMsrc/core/injections/controller/handler.py78def pseudo_terminal_shell(injector, separator, maxlen, TAG, cmd, prefix, suffix,CODE
LOWsrc/core/injections/controller/handler.py225 except Exception:CODE
LOWsrc/core/injections/controller/handler.py474 except Exception:CODE
LOWsrc/core/injections/controller/handler.py754 except Exception:CODE
MEDIUMsrc/core/injections/controller/checks.py645def tab_autocompleter():CODE
MEDIUMsrc/core/injections/controller/checks.py855def process_page_content(response, action):CODE
MEDIUMsrc/core/injections/controller/checks.py2226def perform_payload_modification(payload):CODE
LOWsrc/core/injections/controller/checks.py380 except Exception as e:CODE
LOWsrc/core/injections/controller/checks.py795 except Exception as e:CODE
LOWsrc/core/injections/controller/checks.py2120 except Exception:CODE
LOWsrc/core/injections/controller/checks.py2138 except Exception:CODE
LOWsrc/core/injections/controller/checks.py2213 except Exception as err:CODE
LOWsrc/core/injections/controller/checks.py2280 except Exception:CODE
LOWsrc/core/injections/controller/checks.py2420 except Exception:CODE
LOWsrc/utils/update.py105 except Exception as err_msg:CODE
LOWsrc/utils/update.py183 except Exception as err_msg:CODE
LOWsrc/utils/common.py54 except Exception as err_msg:CODE
MEDIUMsrc/utils/common.py47def safe_input(message):CODE
MEDIUMsrc/utils/session_handler.py149def clear(url):CODE
MEDIUMsrc/utils/session_handler.py188def import_injection_points(url, technique, injection_type, filename, separator,CODE
13 more matches not shown…
Hyper-Verbose Identifiers76 hits · 64 pts
SeverityFileLineSnippetContext
LOWsrc/core/main.py402def check_value_inside_boundaries(url, http_request_method):CODE
LOWsrc/core/tamper/uninitializedvariable.py41 def add_uninitialized_variable(payload):CODE
LOWsrc/core/requests/stability.py26def reset_connection_error_budget():CODE
LOWsrc/core/requests/stability.py32def should_retry_connection_error(err):CODE
LOWsrc/core/requests/stability.py44def connection_error_budget_exhausted():CODE
LOWsrc/core/requests/parameters.py236def register_custom_injection_marker(vuln_parameter, value_with_marker):CODE
LOWsrc/core/requests/parameters.py391def configure_post_data_format(parameter, http_request_method):CODE
LOWsrc/core/requests/parameters.py68def extract_vuln_param_from_pairs(text, delimiter, strip_leading_space=False, check_base64_padding=False):CODE
LOWsrc/core/requests/parameters.py275def json_nested_leaf_candidates(fragment, full_parameter):CODE
LOWsrc/core/requests/parameters.py454def handle_single_post_parameter(parameter, multi_parameters, http_request_method):CODE
LOWsrc/core/requests/parameters.py510def handle_multiple_post_parameters(parameter, multi_parameters, http_request_method):CODE
LOWsrc/core/requests/parameters.py825def specify_header_injection_parameter(header_value, header_name):CODE
LOWsrc/core/requests/parameters.py848def specify_user_agent_parameter(user_agent):CODE
LOWsrc/core/requests/parameters.py854def specify_referer_parameter(referer):CODE
LOWsrc/core/requests/parameters.py866def specify_custom_header_parameter(custom_header_value):CODE
LOWsrc/core/requests/requests.py166def _measure_response_time_with_auth_handling(url, http_request_method):CODE
LOWsrc/core/requests/requests.py148def quick_response_time_sample(url, http_request_method):CODE
LOWsrc/core/requests/requests.py345def _finish_response_time_estimate(diff, timesec):CODE
LOWsrc/core/requests/requests.py900def application_identification(url, response=None):CODE
LOWsrc/core/requests/requests.py983def technology_identification(response):CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py244def cmd_execution_alter_shell(separator, cmd, output_length, timesec, http_request_method):CODE
LOW…ctions/results_based/techniques/classic/cb_payloads.py129def cmd_execution_alter_shell(separator, TAG, cmd):CODE
LOW…ons/results_based/techniques/eval_based/eb_payloads.py199def cmd_execution_alter_shell(separator, TAG, cmd):CODE
LOWsrc/core/injections/controller/controller.py94def init_http_header_injection_status():CODE
LOWsrc/core/injections/controller/controller.py103def init_cookie_injection_status():CODE
LOWsrc/core/injections/controller/controller.py109def check_for_stored_sessions(url, check_parameter, http_request_method):CODE
LOWsrc/core/injections/controller/controller.py172def command_injection_heuristic_basic(url, http_request_method, check_parameter, the_type, header_name, inject_http_headCODE
LOWsrc/core/injections/controller/controller.py217def code_injections_heuristic_basic(url, http_request_method, check_parameter, the_type, header_name, inject_http_headerCODE
LOWsrc/core/injections/controller/controller.py255def classic_command_injection_technique(url, timesec, filename, http_request_method):CODE
LOWsrc/core/injections/controller/controller.py272def dynamic_code_evaluation_technique(url, timesec, filename, http_request_method):CODE
LOWsrc/core/injections/controller/controller.py290def timebased_command_injection_technique(url, timesec, filename, http_request_method, url_time_response):CODE
LOWsrc/core/injections/controller/controller.py307def filebased_command_injection_technique(url, timesec, filename, http_request_method, url_time_response):CODE
LOWsrc/core/injections/controller/controller.py331def check_parameter_in_http_header(check_parameter):CODE
LOWsrc/core/injections/controller/controller.py406def attempt_skip_testable_value(url, http_request_method, check_parameter):CODE
LOWsrc/core/injections/controller/controller.py767def filtered_testable_parameters():CODE
LOWsrc/core/injections/controller/handler.py192def probe_skip_testable_value_post_detection(separator, timesec, http_request_method, url, vuln_parameter, whitespace, uCODE
LOWsrc/core/injections/controller/handler.py531def do_results_based_proccess(url, timesec, filename, http_request_method, injection_type, technique):CODE
LOWsrc/core/injections/controller/checks.py1660def enable_all_enumeration_options():CODE
LOWsrc/core/injections/controller/checks.py1801def tamper_dep_eval_incompatible(tamper_name):CODE
LOWsrc/core/injections/controller/checks.py1806def tamper_dep_time_related_only(tamper_name):CODE
LOWsrc/core/injections/controller/checks.py1811def tamper_dep_alter_shell_incompatible(tamper_name):CODE
LOWsrc/core/injections/controller/checks.py1818def tamper_restore_ignored_words(payload, obf_char):CODE
LOWsrc/core/injections/controller/checks.py125def injection_techniques_status():CODE
LOWsrc/core/injections/controller/checks.py216def process_custom_injection_data(data):CODE
LOWsrc/core/injections/controller/checks.py238def custom_injection_marker_character(url, http_request_method):CODE
LOWsrc/core/injections/controller/checks.py451def handle_detection_interrupt(filename, url):CODE
LOWsrc/core/injections/controller/checks.py521def handle_exploitation_interrupt(filename, url):CODE
LOWsrc/core/injections/controller/checks.py803def ignore_anticsrf_parameter(parameter):CODE
LOWsrc/core/injections/controller/checks.py815def ignore_google_analytics_cookie(cookie):CODE
LOWsrc/core/injections/controller/checks.py825def sanitize_payload_newlines(payload):CODE
LOWsrc/core/injections/controller/checks.py975def check_for_false_positive_result(false_positive_warning):CODE
LOWsrc/core/injections/controller/checks.py1113def procced_with_file_based_technique():CODE
LOWsrc/core/injections/controller/checks.py1132def check_reverse_tcp_options(reverse_tcp_option):CODE
LOWsrc/core/injections/controller/checks.py1480def error_loading_session_file():CODE
LOWsrc/core/injections/controller/checks.py1499def time_delay_due_to_unstable_request(timesec):CODE
LOWsrc/core/injections/controller/checks.py1553def record_baseline_response_time(exec_time):CODE
LOWsrc/core/injections/controller/checks.py1561def warm_up_response_baseline(url, http_request_method):CODE
LOWsrc/core/injections/controller/checks.py1639def identified_http_auth_type(auth_type):CODE
LOWsrc/core/injections/controller/checks.py1685def check_provided_parameters():CODE
LOWsrc/core/injections/controller/checks.py2070def decoded_text_is_plausible(text):CODE
16 more matches not shown…
Self-Referential Comments9 hits · 32 pts
SeverityFileLineSnippetContext
MEDIUMsrc/core/main.py456 # Define the level of tests to perform.COMMENT
MEDIUMsrc/core/main.py703 # Define the level of verbosity.COMMENT
MEDIUMsrc/core/main.py993 # Define the local path where Metasploit Framework is installed.COMMENT
MEDIUMsrc/core/requests/authentication.py114 # Define the HTTP authentication type.COMMENT
MEDIUMsrc/core/requests/authentication.py120 # Define the authentication wordlists for usernames / passwords.COMMENT
MEDIUMsrc/core/requests/parameters.py249 # Define the vulnerable parameterCOMMENT
MEDIUMsrc/utils/logs.py83 # Create the logs filenameCOMMENT
MEDIUMsrc/utils/session_handler.py169 # Create a comma-separated string of ids to keepCOMMENT
MEDIUMsrc/utils/session_handler.py194 # Create the table if it does not existCOMMENT
AI Structural Patterns24 hits · 19 pts
SeverityFileLineSnippetContext
LOWsrc/core/requests/parameters.py44CODE
LOWsrc/utils/settings.py108CODE
LOWsrc/utils/settings.py113CODE
LOWsrc/utils/settings.py118CODE
LOWsrc/utils/settings.py123CODE
LOWsrc/utils/settings.py128CODE
LOWsrc/utils/settings.py133CODE
LOWsrc/utils/settings.py148CODE
LOWsrc/utils/settings.py153CODE
LOWsrc/utils/settings.py158CODE
LOWsrc/utils/settings.py163CODE
LOWsrc/utils/settings.py168CODE
LOWsrc/utils/settings.py173CODE
LOWsrc/utils/settings.py178CODE
LOWsrc/utils/settings.py183CODE
LOWsrc/utils/settings.py188CODE
LOWsrc/utils/settings.py192CODE
LOWsrc/utils/settings.py197CODE
LOWsrc/utils/settings.py202CODE
LOWsrc/utils/settings.py207CODE
LOWsrc/utils/settings.py212CODE
LOWsrc/utils/settings.py217CODE
LOWsrc/utils/settings.py222CODE
LOWsrc/thirdparty/beautifulsoup/beautifulsoup.py1103CODE
Cross-Language Confusion3 hits · 15 pts
SeverityFileLineSnippetContext
HIGHsrc/utils/update.py41 process = subprocess.Popen("git reset --hard HEAD && git clean -fd && git pull", shell=True, stdout=subprocess.PIPE,CODE
HIGHsrc/utils/requirements.py26 subprocess.Popen(requirement, stdout=null, stderr=null)CODE
HIGHsrc/utils/settings.py1099JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]*"|\d+|true|false|null).*\}\s*(\]\s*)*\Z'CODE
Over-Commented Block5 hits · 5 pts
SeverityFileLineSnippetContext
LOW…ons/results_based/techniques/eval_based/eb_injector.py41# eofCOMMENT
LOWsrc/thirdparty/beautifulsoup/beautifulsoup.py741 # we enclose it in single quotes.COMMENT
LOWsrc/thirdparty/beautifulsoup/beautifulsoup.py1441 # reference or an HTML entity reference. Nonetheless,COMMENT
LOWsrc/thirdparty/beautifulsoup/beautifulsoup.py1741 passCOMMENT
LOWsrc/thirdparty/six/__init__.py1# Copyright (c) 2010-2020 Benjamin PetersonCOMMENT
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMsrc/thirdparty/beautifulsoup/beautifulsoup.py1458 # haven't already gone through a supposedly comprehensiveCOMMENT
Modern Structural Boilerplate1 hit · 1 pts
SeverityFileLineSnippetContext
LOWsrc/utils/sgmllib.py22__all__ = ["SGMLParser", "SGMLParseError"]CODE
Overly Generic Function Names1 hit · 0 pts
SeverityFileLineSnippetContext
LOWsrc/core/injections/controller/checks.py2383def process_data(data_type, http_request_method):CODE