Commix

Commix tests your inputs for command injection — cases where user data reaches the operating system — and, when it finds one, confirms the flaw by demonstrating controlled command execution.

Confirmation of any command-injection point, the parameter and technique involved, and evidence of the level of access it grants.

Command injection can hand an attacker control of your server itself, not just your data. Confirming whether any input reaches the shell is critical, and this does it precisely.