Repository Analysis

commixproject/commix

Automated All-in-One OS Command Injection Exploitation Tool

45.8 Strong AI signal View on GitHub

Analysis Overview

This report presents the forensic synthetic code analysis of commixproject/commix, a Python project with 5,782 GitHub stars. SynthScan v2.0 examined 27,182 lines of code across 131 source files, recording 780 pattern matches distributed across 13 syntactic categories. The overall adjusted score of 45.8 places this repository in the Strong AI signal band.

The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).

45.8
Adjusted Score
45.8
Raw Score
100%
Time Factor
2026-07-13
Last Push
5.8K
Stars
Python
Language
27.2K
Lines of Code
131
Files
780
Pattern Hits
2026-07-14
Scan Date
0.84
HC Hit Rate

What These Metrics Mean

Adjusted Score
Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score
The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor
The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits
Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate
High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files
Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.

No multi-scan history yet — run the scanner again to build trend data.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 0HIGH 110MEDIUM 23LOW 647

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 780 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Cross-File Repetition107 hits · 535 pts
SeverityFileLineSnippetContext
HIGHsetup.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHcommix.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/compat.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/convert.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/main.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/testing.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/shells/bind_tcp.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/shells/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/shells/reverse_tcp.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/randomcase.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/sleep2usleep.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/backslashes.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/rev.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/hexencode.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/sleep2timeout.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/xforwardedfor.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/space2plus.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/printf2echo.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/multiplespaces.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/uninitializedvariable.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/slash2env.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/caret.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/doublequotes.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/backticks.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/space2htab.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/dollaratsigns.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/space2ifs.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/space2vtab.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/base64encode.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/nested.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/tamper/singlequotes.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/proxy.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/redirection.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/tor.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/authentication.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/parameters.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/headers.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/requests/requests.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/modules/modules_handler.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/modules/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/modules/shellshock/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/injections/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/injections/blind/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/injections/blind/techniques/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…/injections/blind/techniques/time_based/tb_payloads.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…ore/injections/blind/techniques/time_based/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…e/injections/blind/techniques/time_based/tb_handler.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…/injections/blind/techniques/time_based/tb_injector.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGHsrc/core/injections/results_based/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…c/core/injections/results_based/techniques/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…ections/results_based/techniques/classic/cb_handler.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…njections/results_based/techniques/classic/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…ctions/results_based/techniques/classic/cb_injector.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…ctions/results_based/techniques/classic/cb_payloads.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…ons/results_based/techniques/eval_based/eb_injector.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
HIGH…ctions/results_based/techniques/eval_based/__init__.py0this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancsSTRING
47 more matches not shown…
Unused Imports244 hits · 225 pts
SeverityFileLineSnippetContext
LOWcommix.py31CODE
LOWsrc/core/main.py24CODE
LOWsrc/core/main.py25CODE
LOWsrc/core/main.py36CODE
LOWsrc/core/main.py38CODE
LOWsrc/core/main.py38CODE
LOWsrc/core/main.py38CODE
LOWsrc/core/main.py45CODE
LOWsrc/core/testing.py16CODE
LOWsrc/core/testing.py18CODE
LOWsrc/core/shells/bind_tcp.py17CODE
LOWsrc/core/shells/bind_tcp.py18CODE
LOWsrc/core/shells/bind_tcp.py19CODE
LOWsrc/core/shells/bind_tcp.py20CODE
LOWsrc/core/shells/bind_tcp.py27CODE
LOWsrc/core/shells/bind_tcp.py27CODE
LOWsrc/core/shells/reverse_tcp.py17CODE
LOWsrc/core/shells/reverse_tcp.py18CODE
LOWsrc/core/shells/reverse_tcp.py19CODE
LOWsrc/core/shells/reverse_tcp.py32CODE
LOWsrc/core/shells/reverse_tcp.py32CODE
LOWsrc/core/tamper/sleep2usleep.py17CODE
LOWsrc/core/tamper/sleep2usleep.py18CODE
LOWsrc/core/tamper/sleep2usleep.py20CODE
LOWsrc/core/tamper/backslashes.py17CODE
LOWsrc/core/tamper/hexencode.py16CODE
LOWsrc/core/tamper/sleep2timeout.py17CODE
LOWsrc/core/tamper/sleep2timeout.py18CODE
LOWsrc/core/tamper/sleep2timeout.py20CODE
LOWsrc/core/tamper/slash2env.py16CODE
LOWsrc/core/tamper/slash2env.py17CODE
LOWsrc/core/tamper/caret.py17CODE
LOWsrc/core/tamper/caret.py18CODE
LOWsrc/core/tamper/base64encode.py16CODE
LOWsrc/core/tamper/nested.py16CODE
LOWsrc/core/tamper/nested.py17CODE
LOWsrc/core/requests/proxy.py16CODE
LOWsrc/core/requests/proxy.py17CODE
LOWsrc/core/requests/proxy.py20CODE
LOWsrc/core/requests/proxy.py22CODE
LOWsrc/core/requests/proxy.py24CODE
LOWsrc/core/requests/proxy.py24CODE
LOWsrc/core/requests/proxy.py24CODE
LOWsrc/core/requests/proxy.py24CODE
LOWsrc/core/requests/proxy.py25CODE
LOWsrc/core/requests/redirection.py16CODE
LOWsrc/core/requests/redirection.py17CODE
LOWsrc/core/requests/redirection.py18CODE
LOWsrc/core/requests/redirection.py19CODE
LOWsrc/core/requests/redirection.py24CODE
LOWsrc/core/requests/redirection.py30CODE
LOWsrc/core/requests/redirection.py33CODE
LOWsrc/core/requests/redirection.py33CODE
LOWsrc/core/requests/redirection.py33CODE
LOWsrc/core/requests/redirection.py33CODE
LOWsrc/core/requests/redirection.py21CODE
LOWsrc/core/requests/redirection.py23CODE
LOWsrc/core/requests/tor.py17CODE
LOWsrc/core/requests/tor.py19CODE
LOWsrc/core/requests/tor.py22CODE
184 more matches not shown…
Redundant / Tautological Comments110 hits · 180 pts
SeverityFileLineSnippetContext
LOWsrc/core/main.py633 # Check if defined "--list-tampers" option.COMMENT
LOWsrc/core/main.py642 # Check if defined "--ignore-dependencies" option.COMMENT
LOWsrc/core/main.py646 # Check if defined "--update" option.COMMENT
LOWsrc/core/main.py650 # Check if defined "--install" option.COMMENT
LOWsrc/core/main.py655 # Check if defined "--purge" option.COMMENT
LOWsrc/core/main.py870 # Check if ".git" exists and check for updated version!COMMENT
LOWsrc/core/main.py874 # Check if option is "--url" for single url test.COMMENT
LOWsrc/core/main.py882 # Check if defined character used for splitting parameter values.COMMENT
LOWsrc/core/main.py886 # Check if defined character used for splitting parameter values.COMMENT
LOWsrc/core/main.py145 # Check if defined any HTTP Proxy (--proxy option).COMMENT
LOWsrc/core/main.py262 # Check if http / httpsCOMMENT
LOWsrc/core/main.py429 # Check if defined character used for splitting cookie values.COMMENT
LOWsrc/core/main.py464 # Check if specified wrong injection techniqueCOMMENT
LOWsrc/core/main.py467 # Check if used the ',' separatorCOMMENT
LOWsrc/core/main.py508 # Check if defined "--url" or "-m" option.COMMENT
LOWsrc/core/main.py584 # Check if defined "--version" option.COMMENT
LOWsrc/core/main.py597 # Check if specified wrong alternative shellCOMMENT
LOWsrc/core/main.py689 # Check if defined "--proxy" option.COMMENT
LOWsrc/core/main.py714 # Check if defined Tor (--tor option).COMMENT
LOWsrc/core/main.py731 # Check if defined "--auth-cred" and/or '--auth-type'.COMMENT
LOWsrc/core/main.py753 # Check if defined "--abort-code" option.COMMENT
LOWsrc/core/main.py762 # Check if defined "--ignore-code" option.COMMENT
LOWsrc/core/main.py774 # Check if defined "--wizard" option.COMMENT
LOWsrc/core/main.py813 # Check if defined "--timesec" option.COMMENT
LOWsrc/core/main.py901 # Check if option is "-m" for multiple urls test.COMMENT
LOWsrc/core/main.py923 # Check if option "--crawl" is enabled.COMMENT
LOWsrc/core/requests/authentication.py59 # Check if defined extra headers.COMMENT
LOWsrc/core/requests/authentication.py116 # Check if verbose mode onCOMMENT
LOWsrc/core/requests/authentication.py136 # Check if defined any HTTP Proxy (--proxy option).COMMENT
LOWsrc/core/requests/parameters.py106 # Check if single parameter is supplied.COMMENT
LOWsrc/core/requests/parameters.py108 # Check if defined the INJECT_TAGCOMMENT
LOWsrc/core/requests/parameters.py128 # Check if multiple parameters are supplied without the "INJECT_HERE" tag.COMMENT
LOWsrc/core/requests/parameters.py133 # Check if defined the "INJECT_HERE" tagCOMMENT
LOWsrc/core/requests/parameters.py233 # Check if parameters are empty or meaninglessCOMMENT
LOWsrc/core/requests/parameters.py298 # Check if JSON Object.COMMENT
LOWsrc/core/requests/parameters.py306 # Check if XML Object.COMMENT
LOWsrc/core/requests/parameters.py347 # Check if single parameter is supplied.COMMENT
LOWsrc/core/requests/parameters.py398 # Check if multiple parameters are supplied without the "INJECT_HERE" tag.COMMENT
LOWsrc/core/requests/parameters.py406 # Check if not defined the "INJECT_HERE" tag in parameterCOMMENT
LOWsrc/core/requests/parameters.py572 # Check if defined "--prefix" option.COMMENT
LOWsrc/core/requests/parameters.py603 # Check if defined "--suffix" option.COMMENT
LOWsrc/core/requests/parameters.py643 # Check if single paramerter is supplied.COMMENT
LOWsrc/core/requests/parameters.py654 # Check if defined the INJECT_TAGCOMMENT
LOWsrc/core/requests/parameters.py669 # Check if multiple parameters are supplied.COMMENT
LOWsrc/core/requests/parameters.py675 # Check if not defined the "INJECT_HERE" tag in parameterCOMMENT
LOWsrc/core/requests/headers.py318 # Check if defined any Cookie HTTP header.COMMENT
LOWsrc/core/requests/headers.py322 # Check if defined any User-Agent HTTP header.COMMENT
LOWsrc/core/requests/headers.py326 # Check if defined any Referer HTTP header.COMMENT
LOWsrc/core/requests/headers.py330 # Check if defined any Host HTTP header.COMMENT
LOWsrc/core/requests/headers.py357 # Check if defined any HTTP Authentication credentials.COMMENT
LOWsrc/core/requests/headers.py395 # Check if defined any extra HTTP headers.COMMENT
LOWsrc/core/requests/headers.py442 # Check if it is a custom header injection.COMMENT
LOWsrc/core/requests/requests.py952 # Check if defined "--verbose" option.COMMENT
LOWsrc/core/requests/requests.py957 # Check if defined cookie with "INJECT_HERE" tagCOMMENT
LOWsrc/core/requests/requests.py962 # Check if defined custom header with "INJECT_HERE" tagCOMMENT
LOWsrc/core/requests/requests.py967 # Check if defined user-agent with "INJECT_HERE" tagCOMMENT
LOWsrc/core/requests/requests.py972 # Check if defined referer with "INJECT_HERE" tagCOMMENT
LOWsrc/core/requests/requests.py977 # Check if defined host with "INJECT_HERE" tagCOMMENT
LOWsrc/core/requests/requests.py71 # Check if defined POST dataCOMMENT
LOWsrc/core/requests/requests.py109 # Check if defined POST dataCOMMENT
50 more matches not shown…
Deep Nesting164 hits · 130 pts
SeverityFileLineSnippetContext
LOWsrc/core/main.py136CODE
LOWsrc/core/main.py345CODE
LOWsrc/core/testing.py24CODE
LOWsrc/core/shells/bind_tcp.py32CODE
LOWsrc/core/shells/bind_tcp.py93CODE
LOWsrc/core/shells/bind_tcp.py302CODE
LOWsrc/core/shells/bind_tcp.py345CODE
LOWsrc/core/shells/reverse_tcp.py37CODE
LOWsrc/core/shells/reverse_tcp.py99CODE
LOWsrc/core/shells/reverse_tcp.py478CODE
LOWsrc/core/shells/reverse_tcp.py522CODE
LOWsrc/core/tamper/randomcase.py29CODE
LOWsrc/core/tamper/rev.py30CODE
LOWsrc/core/tamper/space2ifs.py32CODE
LOWsrc/core/tamper/space2vtab.py30CODE
LOWsrc/core/requests/redirection.py56CODE
LOWsrc/core/requests/authentication.py71CODE
LOWsrc/core/requests/authentication.py104CODE
LOWsrc/core/requests/parameters.py41CODE
LOWsrc/core/requests/parameters.py180CODE
LOWsrc/core/requests/parameters.py221CODE
LOWsrc/core/requests/parameters.py466CODE
LOWsrc/core/requests/parameters.py538CODE
LOWsrc/core/requests/parameters.py615CODE
LOWsrc/core/requests/parameters.py724CODE
LOWsrc/core/requests/headers.py119CODE
LOWsrc/core/requests/headers.py314CODE
LOWsrc/core/requests/requests.py69CODE
LOWsrc/core/requests/requests.py102CODE
LOWsrc/core/requests/requests.py290CODE
LOWsrc/core/requests/requests.py708CODE
LOWsrc/core/requests/requests.py814CODE
LOWsrc/core/requests/requests.py885CODE
LOWsrc/core/requests/requests.py944CODE
LOWsrc/core/modules/shellshock/shellshock.py91CODE
LOWsrc/core/modules/shellshock/shellshock.py183CODE
LOWsrc/core/modules/shellshock/shellshock.py211CODE
LOWsrc/core/modules/shellshock/shellshock.py239CODE
LOWsrc/core/modules/shellshock/shellshock.py277CODE
LOWsrc/core/modules/shellshock/shellshock.py516CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py27CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py91CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py157CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py227CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py291CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py366CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py433CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py493CODE
LOW…e/injections/blind/techniques/time_based/tb_handler.py35CODE
LOWsrc/core/injections/controller/shell_options.py63CODE
LOWsrc/core/injections/controller/shell_options.py96CODE
LOWsrc/core/injections/controller/shell_options.py130CODE
LOWsrc/core/injections/controller/controller.py147CODE
LOWsrc/core/injections/controller/controller.py193CODE
LOWsrc/core/injections/controller/controller.py248CODE
LOWsrc/core/injections/controller/controller.py313CODE
LOWsrc/core/injections/controller/controller.py682CODE
LOWsrc/core/injections/controller/controller.py869CODE
LOWsrc/core/injections/controller/handler.py76CODE
LOWsrc/core/injections/controller/handler.py172CODE
104 more matches not shown…
Excessive Try-Catch Wrapping55 hits · 57 pts
SeverityFileLineSnippetContext
MEDIUMsrc/core/main.py345def main(filename, url, http_request_method):CODE
LOWsrc/core/main.py164 except Exception as err_msg:CODE
LOWsrc/core/main.py231 except Exception as err_msg:CODE
LOWsrc/core/main.py622 except Exception as ex:CODE
LOWsrc/core/main.py836 except Exception as e:CODE
LOWsrc/core/testing.py44 except Exception as e:CODE
LOWsrc/core/requests/proxy.py43 except Exception as err_msg:CODE
MEDIUMsrc/core/requests/proxy.py30def use_proxy(request):CODE
LOWsrc/core/requests/tor.py52 except Exception:CODE
LOWsrc/core/requests/authentication.py65 except Exception as err_msg:CODE
MEDIUMsrc/core/requests/authentication.py40def authentication_process(http_request_method):CODE
MEDIUMsrc/core/requests/parameters.py227def is_empty_json_str(s):CODE
LOWsrc/core/requests/parameters.py201 except Exception:CODE
LOWsrc/core/requests/parameters.py230 except Exception:CODE
LOWsrc/core/requests/parameters.py504 except Exception:CODE
LOWsrc/core/requests/parameters.py523 except Exception:CODE
LOWsrc/core/requests/parameters.py739 except Exception:CODE
LOWsrc/core/requests/headers.py261 except Exception:CODE
MEDIUMsrc/core/requests/requests.py69def crawler_request(url, http_request_method):CODE
MEDIUMsrc/core/requests/requests.py860def technology_identification(response):CODE
LOWsrc/core/requests/requests.py56 except Exception:CODE
LOWsrc/core/requests/requests.py253 except Exception as err_msg:CODE
LOWsrc/core/requests/requests.py424 except Exception as err_msg:CODE
LOWsrc/core/requests/requests.py429 except Exception as err_msg:CODE
LOWsrc/core/requests/requests.py520 except Exception as err_msg:CODE
LOWsrc/core/requests/requests.py563 except Exception as err_msg:CODE
LOWsrc/core/requests/requests.py606 except Exception as err_msg:CODE
LOWsrc/core/requests/requests.py649 except Exception as err_msg:CODE
LOWsrc/core/requests/requests.py695 except Exception as err_msg:CODE
LOWsrc/core/requests/requests.py774 except Exception as e:CODE
LOWsrc/core/requests/requests.py876 except Exception:CODE
MEDIUMsrc/core/injections/controller/checks.py484def tab_autocompleter():CODE
MEDIUMsrc/core/injections/controller/checks.py577def value_inside_boundaries(parameter, http_request_method):CODE
MEDIUMsrc/core/injections/controller/checks.py679def process_page_content(response, action):CODE
LOWsrc/core/injections/controller/checks.py341 except Exception as e:CODE
LOWsrc/core/injections/controller/checks.py570 except Exception as e:CODE
LOWsrc/core/injections/controller/checks.py619 except Exception as e:CODE
LOWsrc/core/injections/controller/checks.py1809 except Exception:CODE
LOWsrc/core/injections/controller/checks.py1826 except Exception:CODE
LOWsrc/core/injections/controller/checks.py2040 except Exception:CODE
LOWsrc/core/injections/controller/checks.py2182 except Exception:CODE
LOWsrc/utils/update.py105 except Exception as err_msg:CODE
LOWsrc/utils/update.py181 except Exception as err_msg:CODE
LOWsrc/utils/common.py52 except Exception as err_msg:CODE
MEDIUMsrc/utils/common.py47def safe_input(message):CODE
MEDIUMsrc/utils/session_handler.py110def clear(url):CODE
MEDIUMsrc/utils/session_handler.py147def import_injection_points(url, technique, injection_type, filename, separator,CODE
LOWsrc/utils/session_handler.py139 except Exception as e:CODE
LOWsrc/utils/session_handler.py337 except Exception:CODE
LOWsrc/utils/install.py33 except Exception as e:CODE
LOWsrc/utils/install.py100 except Exception as e:CODE
LOWsrc/utils/install.py113 except Exception as e:CODE
LOWsrc/utils/crawler.py280 except Exception as e: # for non-HTML files and non-valid linksCODE
MEDIUMsrc/utils/crawler.py104def store_crawling(output_href):CODE
LOWsrc/thirdparty/beautifulsoup/beautifulsoup.py1852 except Exception as e:CODE
Hyper-Verbose Identifiers51 hits · 42 pts
SeverityFileLineSnippetContext
LOWsrc/core/main.py337def check_value_inside_boundaries(url, http_request_method):CODE
LOWsrc/core/tamper/uninitializedvariable.py38 def add_uninitialized_variable(payload):CODE
LOWsrc/core/requests/parameters.py754def specify_header_injection_parameter(header_value, header_name):CODE
LOWsrc/core/requests/parameters.py783def specify_user_agent_parameter(user_agent):CODE
LOWsrc/core/requests/parameters.py789def specify_referer_parameter(referer):CODE
LOWsrc/core/requests/parameters.py801def specify_custom_header_parameter(custom_header_value):CODE
LOWsrc/core/requests/requests.py784def application_identification(url):CODE
LOWsrc/core/requests/requests.py860def technology_identification(response):CODE
LOW…/injections/blind/techniques/time_based/tb_payloads.py227def cmd_execution_alter_shell(separator, cmd, output_length, timesec, http_request_method):CODE
LOW…ctions/results_based/techniques/classic/cb_payloads.py129def cmd_execution_alter_shell(separator, TAG, cmd):CODE
LOW…ons/results_based/techniques/eval_based/eb_payloads.py199def cmd_execution_alter_shell(separator, TAG, cmd):CODE
LOWsrc/core/injections/controller/controller.py74def init_http_header_injection_status():CODE
LOWsrc/core/injections/controller/controller.py83def init_cookie_injection_status():CODE
LOWsrc/core/injections/controller/controller.py89def check_for_stored_sessions(url, check_parameter, http_request_method):CODE
LOWsrc/core/injections/controller/controller.py147def command_injection_heuristic_basic(url, http_request_method, check_parameter, the_type, header_name, inject_http_headCODE
LOWsrc/core/injections/controller/controller.py193def code_injections_heuristic_basic(url, http_request_method, check_parameter, the_type, header_name, inject_http_headerCODE
LOWsrc/core/injections/controller/controller.py231def classic_command_injection_technique(url, timesec, filename, http_request_method):CODE
LOWsrc/core/injections/controller/controller.py248def dynamic_code_evaluation_technique(url, timesec, filename, http_request_method):CODE
LOWsrc/core/injections/controller/controller.py266def timebased_command_injection_technique(url, timesec, filename, http_request_method, url_time_response):CODE
LOWsrc/core/injections/controller/controller.py283def filebased_command_injection_technique(url, timesec, filename, http_request_method, url_time_response):CODE
LOWsrc/core/injections/controller/controller.py300def check_parameter_in_http_header(check_parameter):CODE
LOWsrc/core/injections/controller/controller.py532def filtered_testable_parameters():CODE
LOWsrc/core/injections/controller/handler.py429def do_results_based_proccess(url, timesec, filename, http_request_method, injection_type, technique):CODE
LOWsrc/core/injections/controller/checks.py1412def enable_all_enumeration_options():CODE
LOWsrc/core/injections/controller/checks.py98def injection_techniques_status():CODE
LOWsrc/core/injections/controller/checks.py183def process_custom_injection_data(data):CODE
LOWsrc/core/injections/controller/checks.py205def custom_injection_marker_character(url, http_request_method):CODE
LOWsrc/core/injections/controller/checks.py567def get_value_value_inside_boundaries(value):CODE
LOWsrc/core/injections/controller/checks.py627def ignore_anticsrf_parameter(parameter):CODE
LOWsrc/core/injections/controller/checks.py639def ignore_google_analytics_cookie(cookie):CODE
LOWsrc/core/injections/controller/checks.py649def sanitize_payload_newlines(payload):CODE
LOWsrc/core/injections/controller/checks.py779def check_for_false_positive_result(false_positive_warning):CODE
LOWsrc/core/injections/controller/checks.py918def procced_with_file_based_technique():CODE
LOWsrc/core/injections/controller/checks.py937def check_reverse_tcp_options(reverse_tcp_option):CODE
LOWsrc/core/injections/controller/checks.py1313def error_loading_session_file():CODE
LOWsrc/core/injections/controller/checks.py1332def time_delay_recommendation():CODE
LOWsrc/core/injections/controller/checks.py1340def time_delay_due_to_unstable_request(timesec):CODE
LOWsrc/core/injections/controller/checks.py1391def identified_http_auth_type(auth_type):CODE
LOWsrc/core/injections/controller/checks.py1437def check_provided_parameters():CODE
LOWsrc/core/injections/controller/checks.py1891def perform_payload_modification(payload):CODE
LOWsrc/core/injections/controller/checks.py2615def remove_command_substitution(cmd):CODE
LOWsrc/core/injections/controller/checks.py2752def define_vulnerable_http_header(http_header_name):CODE
LOWsrc/core/injections/controller/checks.py2814def identified_vulnerable_param(url, technique, injection_type, vuln_parameter, payload, http_request_method, filename, CODE
LOWsrc/core/injections/controller/checks.py3016def time_related_export_injection_results(cmd, separator, output, check_exec_time):CODE
LOWsrc/core/injections/controller/checks.py3058def windows_only_attack_vector():CODE
LOW…ections/semiblind/techniques/file_based/fb_payloads.py105def cmd_execution_alter_shell(separator, cmd, OUTPUT_TEXTFILE):CODE
LOW…ns/semiblind/techniques/tempfile_based/tfb_payloads.py259def cmd_execution_alter_shell(separator, cmd, j, OUTPUT_TEXTFILE, timesec, http_request_method):CODE
LOWsrc/utils/session_handler.py273def check_stored_injection_points(url, check_parameter, http_request_method):CODE
LOWsrc/utils/settings.py105def print_legal_disclaimer_msg(legal_disclaimer_msg):CODE
LOWsrc/utils/settings.py188def print_http_response_content(content):CODE
LOWsrc/thirdparty/flatten_json/flatten_json.py14def check_if_numbers_are_consecutive(list_):CODE
Self-Referential Comments9 hits · 30 pts
SeverityFileLineSnippetContext
MEDIUMsrc/core/main.py381 # Define the level of tests to perform.COMMENT
MEDIUMsrc/core/main.py604 # Define the level of verbosity.COMMENT
MEDIUMsrc/core/main.py855 # Define the local path where Metasploit Framework is installed.COMMENT
MEDIUMsrc/core/requests/authentication.py106 # Define the HTTP authentication type.COMMENT
MEDIUMsrc/core/requests/authentication.py108 # Define the authentication wordlists for usernames / passwords.COMMENT
MEDIUMsrc/core/requests/parameters.py181 # Define the vulnerable parameterCOMMENT
MEDIUMsrc/utils/logs.py83 # Create the logs filenameCOMMENT
MEDIUMsrc/utils/session_handler.py127 # Create a comma-separated string of ids to keepCOMMENT
MEDIUMsrc/utils/session_handler.py153 # Create the table if it does not existCOMMENT
AI Structural Patterns27 hits · 20 pts
SeverityFileLineSnippetContext
LOWsrc/core/requests/parameters.py48CODE
LOWsrc/core/requests/parameters.py623CODE
LOWsrc/core/requests/requests.py939CODE
LOWsrc/utils/settings.py107CODE
LOWsrc/utils/settings.py112CODE
LOWsrc/utils/settings.py117CODE
LOWsrc/utils/settings.py122CODE
LOWsrc/utils/settings.py127CODE
LOWsrc/utils/settings.py132CODE
LOWsrc/utils/settings.py137CODE
LOWsrc/utils/settings.py142CODE
LOWsrc/utils/settings.py147CODE
LOWsrc/utils/settings.py152CODE
LOWsrc/utils/settings.py157CODE
LOWsrc/utils/settings.py162CODE
LOWsrc/utils/settings.py167CODE
LOWsrc/utils/settings.py172CODE
LOWsrc/utils/settings.py177CODE
LOWsrc/utils/settings.py181CODE
LOWsrc/utils/settings.py185CODE
LOWsrc/utils/settings.py190CODE
LOWsrc/utils/settings.py195CODE
LOWsrc/utils/settings.py200CODE
LOWsrc/utils/settings.py205CODE
LOWsrc/utils/settings.py210CODE
LOWsrc/utils/settings.py215CODE
LOWsrc/thirdparty/beautifulsoup/beautifulsoup.py1100CODE
Cross-Language Confusion3 hits · 15 pts
SeverityFileLineSnippetContext
HIGHsrc/utils/update.py40 process = subprocess.Popen("git reset --hard HEAD && git clean -fd && git pull", shell=True, stdout=subprocess.PIPE,CODE
HIGHsrc/utils/requirements.py26 subprocess.Popen(requirement, stdout=null, stderr=null)CODE
HIGHsrc/utils/settings.py1020JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]*"|\d+|true|false|null).*\}\s*(\]\s*)*\Z'CODE
Over-Commented Block7 hits · 7 pts
SeverityFileLineSnippetContext
LOW…ons/results_based/techniques/eval_based/eb_injector.py41# eofCOMMENT
LOWsrc/core/injections/controller/injector.py581# eofCOMMENT
LOWsrc/utils/crawler.py341# eofCOMMENT
LOWsrc/thirdparty/beautifulsoup/beautifulsoup.py741 # you modify an attribute value after parsingCOMMENT
LOWsrc/thirdparty/beautifulsoup/beautifulsoup.py1441 #COMMENT
LOWsrc/thirdparty/beautifulsoup/beautifulsoup.py1741COMMENT
LOWsrc/thirdparty/six/__init__.py1# Copyright (c) 2010-2020 Benjamin PetersonCOMMENT
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMsrc/thirdparty/beautifulsoup/beautifulsoup.py1455 # haven't already gone through a supposedly comprehensiveCOMMENT
Modern Structural Boilerplate1 hit · 1 pts
SeverityFileLineSnippetContext
LOWsrc/utils/sgmllib.py22__all__ = ["SGMLParser", "SGMLParseError"]CODE
Overly Generic Function Names1 hit · 0 pts
SeverityFileLineSnippetContext
LOWsrc/core/injections/controller/checks.py2150def process_data(data_type, http_request_method):CODE