# Curl

> Use for HTTP, HTTPS, and data-transfer validation during authorized pentests. Trigger on controlled request replay, header inspection, API debugging, and limited staging or retrieval checks against approved endpoints.

- Skill: `timsonner/curl` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/curl`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/curl/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/curl

---


# Curl

## Purpose

Use this skill for low-overhead HTTP, HTTPS, or data-transfer validation against approved endpoints.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

## Use When

- Need to inspect headers, status codes, or API responses.
- Need a simple CLI replay path for a request or limited retrieval check.
- Need a repeatable retest for a web or transfer path.

## Avoid When

- Request replay would exceed the approved state or data boundary.
- Endpoint scope or auth context is unclear.

## Inputs

- Approved URL or API path
- Headers, auth context, and method constraints
- Output and evidence handling requirements

## Procedure

1. Start with the simplest request that answers the question.
2. Keep methods, headers, and body scope minimal.
3. Record exact request details used for the proof.
4. Avoid broader crawling or transfer behavior unless approved.
5. Preserve the exact request path for retest.

## Command Syntax

Replace sample URLs with approved in-scope endpoints.

```bash
# Check response headers
curl -I https://portal.contoso.com

# GET request with verbose output
curl -v https://portal.contoso.com

# Follow redirects
curl -L https://portal.contoso.com -o contoso-response.html

# POST with JSON body
curl -X POST https://api.contoso.com/v1/login -H "Content-Type: application/json" -d '{"username":"admin","password":"test"}'

# Authenticated GET
curl -H "Authorization: Bearer <token>" https://api.contoso.com/v1/users

# Test SSRF endpoint
curl "https://portal.contoso.com/fetch?url=http://169.254.169.254/latest/meta-data/"

# Proxy through Burp Suite
curl -x http://127.0.0.1:8080 -k https://portal.contoso.com

# Download a file
curl -o tool.exe http://10.10.10.1/tool.exe
```

## Evidence to Capture

- Response behavior tied to the tested path
- Exact method, headers, and URL used
- Minimal proof needed for remediation

## Safety Boundaries

- Keep requests narrowly aligned to the approved objective.
- Avoid unnecessary data transfer or state changes.