Detecting double blind injection about commix HOT 2 CLOSED

Hey @mmetince thanks for the nice comments. :)
I think that your assumption about the reliability of commix against the "double blind injection" is not quite correct. I' ve tested commix against the following piece of code

<?php
    # Execute command!
    $addr = $_GET['addr'];
    if(isset($addr)){
      exec("/bin/ping -c 4 ".$addr."> /dev/null &", $output, $return);
      if (!$return) {
        echo "The ip ".$addr." seems to be up and running!";
      }else{
        echo "The ip ".$addr." seems to be down!";
      }
    }
?>

As you can see on the following screenshot commix is able to identify and exploit the above vulnerable code.

If you think that there is a case where commix is not so effective, please paste the code and i 'll check it out.

Thanks,

from commix.

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related issues.

from commix.