TIPS - Curl

Introduction

This article lists a few ways to call curl, depending on your need.

Curl calls

Curl with verbose result

Curl option: -v (or --verbose).

Fake the DNS resolution

Use case:

• your website is behind a WAF and the FQDN resolves to it instead of the web server directly (the origin).
• your website is behind a reverse proxy, but you want to access the underlying web service with appropriate host header in your request.

curl --resolve <my.domain>:443:<IP> https://<my.domain>[/<my_uri>]

Add a request header

Curl option: -H (or --header).

Sample call:

curl -IL -H '<header name>:<header value>' https://<URL to curl>

Only request response headers

Curl option: -I

See previous sample.

Don't check SSL certificate

This option may be useful in some situations:

• SSL deep inspection on the path, recyphering being done with a self-signed certificate or a cert emitted by a CA not present in your local CA store.
• Test a WAF or reverse proxy configuration not totally ready regarding SSL configuration.

Curl option: -k (or --insecure).

Sample:

curl -k https://<IP> -I -v --header 'Host:<the real hostname your request for>'