Curl

cURL — HTTP Client Reference

Ctrl+F: -d POST · -H header · -u auth · -o output · -k insecure · -I head

curl transfers data to/from URLs — download files, send POST/JSON, test APIs, probe WebSockets, route through Burp.

Install: sudo apt install curl (Kali: preinstalled) · Installation - Kali Setup

---

Syntax

Usage: curl [options...] <url>

curl [options] URL
curl -X POST -d "user=admin" http://TARGET/login

---

📌 1) Quick flag reference (curl --help)

Short	Long	Description
-d	--data <data>	HTTP POST data
-f	--fail	Fail silently on HTTP errors (no body output)
-I	--head	Show document info / headers only (HEAD request)
-H	--header <header/@file>	Pass custom header(s) to server
-h	--help <subject>	Get help for commands / categories
-o	--output <file>	Write to file instead of stdout
-O	--remote-name	Save using remote filename
-i	--show-headers	Include response headers in output
-s	--silent	Silent mode (no progress meter)
-T	--upload-file <file>	Transfer local FILE to destination
-u	--user <user:password>	Server user and password (Basic auth)
-A	--user-agent <name>	Send User-Agent header
-v	--verbose	Verbose — full request/response debug
-V	--version	Show version and quit

This is not the full help menu — curl splits options into categories.

Help categories

curl --help              # Summary (flags above)
curl --help category     # Overview of categories
curl --help all          # Every option
curl --help [option]     # Docs for one flag, e.g. curl --help -d

Categories: auth, connection, curl, deprecated, dns, file, ftp, global, http, imap, ldap, output, pop3, post, proxy, scp, sftp, smtp, ssh, telnet, tftp, timeout, tls, upload, verbose

---

📌 2) Common OSCP examples

2.1 Basic GET

curl http://TARGET/
curl -s http://TARGET/page.php?id=1          # silent
curl -i http://TARGET/                       # show response headers
curl -I http://TARGET/                       # HEAD — headers only
curl -v http://TARGET/                       # verbose debug
curl -f http://TARGET/missing                # fail on 404 (no body)

2.2 POST data

curl -X POST -d "user=admin&pass=test" http://TARGET/login.php
curl -d "user=admin&pass=test" http://TARGET/login.php    # -X POST implied by -d

2.3 Custom headers (-H)

# Empty POST body (some APIs require explicit zero length)
curl -X POST -H 'Content-Length: 0' http://TARGET/api/trigger
 
# Common bypass / vhost / auth headers
curl -H "X-Forwarded-For: 127.0.0.1" http://TARGET/admin
curl -H "X-Original-URL: /admin" http://TARGET/
curl -H "Host: internal.vhost.local" http://TARGET/
curl -H "Referer: http://TARGET/admin" http://TARGET/login
curl -H "Origin: http://TARGET" http://TARGET/api
curl -H "Authorization: Bearer TOKEN" http://TARGET/api
curl -H "Cookie: session=abc123" http://TARGET/dashboard
 
# Content types
curl -H "Content-Type: application/json" -d '{"id":1}' http://TARGET/api
curl -H "Content-Type: application/x-www-form-urlencoded" -d "a=1" http://TARGET/
curl -H "Content-Type: text/xml" -d @payload.xml http://TARGET/
 
# Read headers from file
curl -H "@headers.txt" http://TARGET/

2.4 POST data (-d / --data)

# URL-encoded form (default)
curl -d "user=admin&pass=test" http://TARGET/login.php
curl --data "user=admin&pass=test" http://TARGET/login.php
curl -X POST -d "user=admin&pass=test" http://TARGET/login.php
 
# From file
curl -d @postbody.txt http://TARGET/login.php
 
# Raw bytes (no URL encoding)
curl --data-binary @shell.bin http://TARGET/upload
curl --data-binary $'user=admin&pass=p@ss w0rd!' http://TARGET/login
 
# URL-encode one field
curl --data-urlencode "query=SELECT * FROM users" http://TARGET/search
 
# Append -d fields to URL as GET query string
curl -G --data "id=1" --data "page=2" http://TARGET/search.php
# → http://TARGET/search.php?id=1&page=2
 
# JSON body
curl -X POST -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"test"}' http://TARGET/api/login

2.5 Download / save output

curl -o local.txt http://TARGET/file.txt
curl -O http://TARGET/backup.zip             # remote filename
curl -O https://TARGET/file1 -O https://TARGET/file2
curl -C - -O http://TARGET/large.zip         # resume

2.6 Upload file

curl -T localfile.txt ftp://TARGET/upload/
curl -T shell.php http://TARGET/upload --user user:pass
curl -F "file=@localfile.txt" http://TARGET/upload    # multipart form

Multipart POST — file + extra form fields (e.g. filename):

curl -v -X POST \
  -F "file=@/home/phill/Desktop/boxes/pg/amaterasu/enum/external/test.txt" \
  -F "filename=test.txt" \
  http://192.168.134.249:33414/file-upload

Flag	Meaning
-v	Verbose — see request headers + response
-X POST	Explicit POST (optional when using -F)
-F "file=@path"	Multipart field file — @ = read from local path
-F "filename=test.txt"	Second form field sent with upload

Generic template:

curl -v -X POST \
  -F "file=@/path/to/localfile.txt" \
  -F "filename=localfile.txt" \
  http://TARGET:PORT/file-upload

→ File Upload Bypass · Burp Suite

2.7 Authentication

curl -u username:password https://TARGET/
curl -u admin http://TARGET/                 # prompt for password
curl --ntlm -u domain\\user:pass http://TARGET/

2.8 Send JSON

curl -X POST -H "Content-Type: application/json" -d '{"key":"value"}' https://TARGET/api

2.9 Cookies

curl --cookie "session=abc123" http://TARGET/
curl -c cookies.txt http://TARGET/login      # save jar
curl -b cookies.txt http://TARGET/admin      # send jar

2.10 User-Agent & proxy

curl -A "Mozilla/5.0" http://TARGET/
curl -x http://127.0.0.1:8080 http://TARGET/   # Burp
curl -k https://TARGET/                        # ignore bad TLS cert

2.11 Timing / limits

curl -o /dev/null -s -w "Time: %{time_total}\n" https://TARGET/
curl --max-time 10 http://TARGET/
curl --limit-rate 500K http://TARGET/large.zip

2.12 WebSocket handshake (curl 7.86+)

curl can open ws:// / wss:// (experimental) — confirm endpoint alive and inspect 101 Switching Protocols before Burp Suite or SQLMap bridge.

curl --include --no-buffer -N ws://TARGET:PORT/path
curl -k --include --no-buffer -N wss://TARGET/path
curl --include --no-buffer -N ws://TARGET/ws \
  -H "Sec-WebSocket-Protocol: json" \
  --data '{"id":"1"}'

Use curl for WS	Use something else for
Confirm port/path responds	Interactive chat → wscat / websocat
Quick handshake + headers	SQLi automation → SQLMap + HTTP bridge
Scriptable one-shot probe	Edit/replay frames → Burp Suite

---

📌 3) Extended options (by category)

Connection

Flag	Description
-A, --user-agent <name>	User-Agent header
-x, --proxy <host:port>	HTTP/S proxy
-U, --proxy-user <user:pass>	Proxy authentication
--limit-rate <speed>	Cap transfer speed
--max-time <sec>	Max total time
--connect-timeout <sec>	Max connect time
-k, --insecure	Skip TLS cert verification

Request

Flag	Description
-X, --request <METHOD>	GET, POST, PUT, DELETE
-H, --header <header>	Custom header
-d, --data <data>	POST body (urlencoded)
--data-binary <data>	Raw binary POST body
-F, --form <name=content>	Multipart form (file=@path)
-T, --upload-file <file>	Upload file (FTP/SCP etc.)
-G, --get	Append -d data to URL (GET)
-I, --head	HEAD request

Authentication

Flag	Description
-u, --user <user:password>	Basic auth
--anyauth	Pick auth method
--digest	Digest auth
--ntlm	NTLM auth
--negotiate	GSS-Negotiate

Cookies

Flag	Description
-b, --cookie <data|file>	Send cookies
-c, --cookie-jar <file>	Save cookies to file
-j, --junk-session-cookies	Ignore session cookies from jar

Output

Flag	Description
-o, --output <file>	Write body to file
-O, --remote-name	Save as remote filename
-s, --silent	No progress / errors to stderr
-S, --show-error	Show errors even with -s
-f, --fail	HTTP ≥400 → exit 22, no body
-L, --location	Follow redirects
-i, --include	Include response headers in output
--compressed	Request gzip/deflate

Debugging

Flag	Description
-v, --verbose	Verbose
-V, --version	Version
-h, --help	Help
--trace <file>	Full trace log
--trace-ascii <file>	ASCII trace

curl --help all
curl --help post
curl --help -d

---

📌 Quick cheat sheet

curl -s http://TARGET/
curl -X POST -H 'Content-Length: 0' http://TARGET/api
curl -H "X-Forwarded-For: 127.0.0.1" http://TARGET/
curl -d "user=a&pass=b" http://TARGET/login
curl --data-binary @file.bin http://TARGET/
curl -H "Cookie: id=1" http://TARGET/
curl -u user:pass http://TARGET/
curl -o out.txt http://TARGET/file
curl -O http://TARGET/file.zip
curl -k https://TARGET/
curl -x http://127.0.0.1:8080 http://TARGET/
curl -A "Mozilla/5.0" http://TARGET/
curl -v http://TARGET/

---

Related Tools

• Burp Suite
• SQLMap
• Python
• Netcat
• FTP
• File Transfer

Related Notes

• Basic Commands
• Networking
• Gobuster
• Initial foothold
• Linux Tools
• Training