SPA-aware · OS-fingerprinted · WAF-adaptive · OOB-verified · Zero false positives
CMDmap is a high-fidelity, autonomous command injection detector built for modern web targets. It pairs a SPA-aware crawler with a 5-tier injection engine that auto-escalates from direct output tests through timing-based blind detection to OOB callbacks — stopping only when execution is confirmed or all vectors are exhausted.
Every finding is verified, timestamped, and delivered with a ready-to-run curl PoC.
- 5-Tier Injection Engine — Direct output → Time-blind → Redirect → OOB → Adaptive bypass
- Adaptive WAF Evasion — IFS/tab/brace, base64-wrap, hex,
dd-timing, ANSI-C quoting, variable concat - Self-Hosted OOB Listener — Blind CMDi confirmed without external collaborator
- 4-Stage False Positive Elimination — Type detection, reflection filtering, error context analysis
- Post-Exploitation File Read — Auto-attempts
/etc/passwdorwin.iniafter confirmed injection - Authenticated Scanning — Cookie, Bearer token, or automated form login
- Extensible Payload System — Drop
.txtfiles intopayloads/custom/to extend coverage
git clone https://github.com/project-hellhound/cmdmap.git
cd cmdmap
chmod +x install.sh
./install.shRequires Python 3.10+. Creates an isolated virtualenv and links cmdmap globally.
# Manual install
pip install -e .
# Initialize external payload directory
cmdmap --init-payloads
# Basic scan
cmdmap https://target.com/api/v1/ping
# Authenticated scan
cmdmap https://target.com/admin/ --cookie "session=abc123"
# Bearer token
cmdmap https://target.com/api/ --header "Authorization: Bearer <token>"
# Form login
cmdmap https://target.com/dashboard \
--login-url https://target.com/login \
--login-user admin --login-pass admin123
# Custom OOB collaborator
cmdmap https://target.com/ --collab https://your.interactsh.server
# Verbose
cmdmap https://target.com/ --verbose| Flag | Description |
|---|---|
--cookie |
Session cookie or Authorization header |
--header |
Custom HTTP header (Key: Value) |
--threads |
Concurrent threads (default: 10) |
--collab |
External OOB collaborator URL |
--login-url |
Login endpoint for authenticated scans |
--login-user / --login-pass |
Login credentials |
--spider-json |
Import pre-crawled endpoints from JSON |
--force-os |
Override OS detection (linux | windows) |
--time-thresh |
Timing threshold in seconds (default: 6.0) |
--json |
JSON output path (auto-generated if omitted) |
--init-payloads |
Create payload directory scaffold and exit |
--verbose |
Enable debug logging |
| Type | Confidence |
|---|---|
DIRECT OUTPUT — system command output in response |
100% |
BLIND:TIME-DELAY — statistically validated timing delay |
95% |
OOB — DNS or HTTP callback confirmed |
100% |
REDIRECT — file write + web readback verified |
90% |
CMDmap is the command injection agent in the Hellhound Pentest Framework and the CyArt VAPT platform.
- Preserved
+space bypass: Added custom parameter encoding in GET/POST requests that preserves the literal+character, allowing it to bypass percent-encoding blocks and be decoded as space by target backends (e.g. PHP). - Subshell/substitution payloads: Added space-bypass command substitution payloads (such as
$(sleep${IFS}10)and$(sleep+10)) to default list and Tier 5. - WAF timing bypass logic: Refactored Tier 2 fast-bail logic so WAF space-filtering blocks do not terminate the entire separator family, allowing space-bypass payloads to execute.
For authorized security testing only. Licensed under GPLv3.
