While most scanners guess which parameters are exploitable, commix confirms by actively exploiting them.
Detection is where most scanners stop and your afternoon starts. Parameters, cookies and headers are probed until one of them executes. That injection point becomes an interactive shell for post-exploitation.
An injection point is not enough. An application hosted on Windows will never fall to a payload designed for Linux. That is why an active fingerprint comes first, and every payload is shaped to the operating system it identifies.
Access denied is not a verdict. Multiple tamper scripts rebuild the payload: encoding, casing, whitespace, shell substitution. Chain them until the WAF sees nothing worth blocking. It logs the request; you get a shell.
Nothing coming back does not mean nothing ran. Results-based techniques read the output when it comes back; boolean-based ones read it in how the page answers, time-based ones clock it in the delay, and out-of-band callbacks reach interactsh over HTTP or plain DNS.
Getting a shell is only the start. Read and write files, enumerate users, password hashes, privileges and system info, or take the lot in one pass. Whatever the web user reaches, you reach.
A finding you have to manually prove is half a finding. Every supported technique confirms by executing, and every injection point is re-tested for false positives before it is reported.
No module list is ever complete. Write your own modules and bend commix to the job in front of you - the core is already there, and a module is plain Python that reuses it, not a framework to learn.
Not every scan has someone watching it. A REST API creates, configures and runs them over HTTP - built for automation and CI, not just a terminal.
One parameter was never the limit. Feed it a bulk file, a proxy log, a sitemap or a live crawl, and every request in it is tested in turn - one run instead of one-by-one.
Free is not a trial. There is no pro edition to upsell you - it ships under GPLv3, everything you need is in the repo, and the git log goes back to 2014.