> For the complete documentation index, see [llms.txt](https://docs.hackjiji.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hackjiji.org/web-pentesting/curl-cheatsheet.md).

# cUrl cheatsheet

## cUrl Cheatsheet

```bash
# download a file from a remote server and save it locally
curl -s -O https://raw.githubusercontent.com/danielmiessler/SecLists/56a39ab9a70a89b56d66dad8bdffb887fba1260e/Passwords/2023-200_most_used_passwords.txt

# Read entry
curl http://<SERVER_IP>:<PORT>/api.php/city/london

# Read all entries - add the "-s" flag to reduce cluttering the response with unnecessary data
curl -s http://<SERVER_IP>:<PORT>/api.php/city/ | jq

#Filter output with jq on a specific endpoint and value
curl -X 'GET'   'http://94.237.53.81:43876/api/v2/suppliers'   -H 'accept: application/json'   
| jq '.suppliers[] | select(.securityQuestion != "SupplierDidNotProvideYet")'

# Create (add) entry
curl -X POST http://<SERVER_IP>:<PORT>/api.php/city/ -d '{"city_name":"HTB_City", "country_name":"HTB"}' -H 'Content-Type: application/json'

# Update (modify) entry
curl -X PUT http://<SERVER_IP>:<PORT>/api.php/city/london -d '{"city_name":"New_HTB_City", "country_name":"HTB"}' -H 'Content-Type: application/json'

# Delete entry
curl -X DELETE http://<SERVER_IP>:<PORT>/api.php/city/New_HTB_City
```

```bash
# Set custom headers for API requests
curl -H "Authorization: Bearer <TOKEN>" http://<SERVER_IP>:<PORT>/api.php/city/london

# Use a specific HTTP method with custom headers
curl -X PATCH http://<SERVER_IP>:<PORT>/api.php/city/london -H "Authorization: Bearer <TOKEN>" -H 'Content-Type: application/json' -d '{"city_name":"Updated_City"}'

# Perform an API request with error handling and verbose mode
curl -v --fail-http http://<SERVER_IP>:<PORT>/api.php/city/london || echo "Request failed"

# Download a file from the API
curl -o output_file.txt http://<SERVER_IP>:<PORT>/api.php/file.txt
```

<table><thead><tr><th width="369">Command</th><th>Info</th></tr></thead><tbody><tr><td><code>curl site.com</code></td><td><p><a href="https://curl.haxx.se/">cURL</a> (client URL) is a command-line tool and library that primarily supports HTTP along with many other protocols. This makes it a good candidate for scripts as well as automation, making it essential for sending various types of web requests from the command line, which is necessary for many types of web penetration tests.</p><p><br><br></p></td></tr><tr><td><p></p><pre class="language-shell-session"><code class="lang-shell-session"><a data-footnote-ref href="#user-content-fn-1">curl -O inlanefreight.com/index.html</a>
</code></pre></td><td>-O will download the index.html page</td></tr><tr><td><code>curl -o filename site.com/path</code></td><td>-o with the -o option we can specify a filename</td></tr><tr><td><code>curl -h</code></td><td>display th help message</td></tr><tr><td><code>curl --help all</code></td><td>display the full help page</td></tr><tr><td><pre><code><strong>curl -k https://inlanefreight.com
</strong></code></pre></td><td>-k allows you to skip the SSL veriifcation if you are testing a local webapp that does not yt contain a valid SSL cert</td></tr><tr><td><code>curl site.com -vvv</code></td><td>use -v verbose mode to show the http request and response headers</td></tr><tr><td><p>curl <code>-I</code> site.com</p><p><code>curl -i site.com</code> </p></td><td><code>-I</code> sends a <code>HEAD</code> request, while <code>-i</code> sends any request we specify and prints the headers as well. Head is very powerfull and allows us to request the metadata of a resoures like availability size, links without downloading it.</td></tr><tr><td><code>curl -i https://inlanefreight.com -A 'Jiji' -vvv</code></td><td><code>-A</code> modifies the user agent to a custom value</td></tr></tbody></table>

## cUrl fo API

| **Command**                                                                                                                                             | **Description**       |
| ------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
| `curl http://<SERVER_IP>:<PORT>/api.php/city/london`                                                                                                    | Read entry            |
| `curl -s http://<SERVER_IP>:<PORT>/api.php/city/ \| jq`                                                                                                 | Read all entries      |
| `curl -X POST http://<SERVER_IP>:<PORT>/api.php/city/ -d '{"city_name":"HTB_City", "country_name":"HTB"}' -H 'Content-Type: application/json'`          | Create (add) entry    |
| `curl -X PUT http://<SERVER_IP>:<PORT>/api.php/city/london -d '{"city_name":"New_HTB_City", "country_name":"HTB"}' -H 'Content-Type: application/json'` | Update (modify) entry |
| `curl -X DELETE http://<SERVER_IP>:<PORT>/api.php/city/New_HTB_City`                                                                                    | Delete entry          |

[^1]: