R-CUR
curl
Transfer data to or from a URL — the default way to probe HTTP, APIs, and TLS by hand.
OVERVIEW
curl (curl.se) is the standard command-line client for URLs: HTTP and HTTPS first, plus FTP, SMTP, and a long list of other schemes. In an engagement it is the fastest way to see what a single request actually returns — status line, headers, redirects, and body — and to replay that request with cookies, a bearer token, or a custom method.
`curl -sSI` is the usual first look at a live web target: headers only, including the redirect chain. `-v` shows the TLS handshake; `--http1.1` / `--http2` pins the protocol; `-d` / `-T` sends a body. Because it is in every distro and most Windows builds, it is also what you use on a jump host that has no Burp.
USE CASES
Practical use cases
- 01
Pulling response headers and the redirect chain from a confirmed URL.
- 02
Replaying an API call with a token or cookie obtained in scope.
- 03
Checking TLS protocol and certificate details with -v against a single host.
- 04
Saving a raw response body as evidence without a browser in the loop.
QUICK START
When you need one exact HTTP request — headers, method, body, or TLS details — without standing up a proxy or a scanner.
- Confirm the URL is inside the authorized scope.
- Fetch headers only first so you see status, redirects, and server tokens.
- Follow with a full GET if the headers look in-scope, and save the body if it is evidence.
- Add cookies, a method, or a body only for the specific request you intend to document.
curl -sSI https://www.target.example/BEFORE YOU RUN IT
What to check before running it
A tight loop of curl against one host is just as noisy as a small scanner — cap concurrency and stay inside the agreed rate.
-k skips TLS verification; use it only when the broken certificate is the finding, not as a default.
Request bodies and cookies can contain secrets; keep -d payloads and saved responses out of shared shell history where you can.