Curl Cheat Sheet

Curl is the tool for talking to an API or web endpoint directly, without a browser or Burp Suite in the way — useful when you know exactly what request you want to send and just need to send it.

Red Team / Offensive Use

Curl earns its place for quick, scriptable HTTP interaction: testing an API endpoint's behavior, checking for verbose error messages or security headers without loading a full browser, or automating repeated requests as part of a larger script (a loop testing IDs against an endpoint, for example). It's also the fastest way to confirm what Burp Suite's Repeater already showed you, from the command line, without leaving a terminal.

Established Cheatsheet

Official curl cheat sheet — maintained by the curl project itself, the most reliably current reference for flags and syntax.

PWNMI's Top 5 Use Cases

• curl -I https://target.com — headers only; a fast way to check response headers and security header presence (or absence) without pulling the full body
• curl -X POST -H "Content-Type: application/json" -d '{"key":"value"}' https://target.com/api — send a JSON POST request; the basic shape for testing an API endpoint directly
• curl -v https://target.com — verbose mode, shows the full request and response including headers — useful when something's behaving unexpectedly and you need to see exactly what's being sent
• curl -s -o /dev/null -w "%{http_code}\n" https://target.com/path — print only the HTTP status code; useful in a loop checking many paths/IDs quickly
• curl -H "Authorization: Bearer <token>" https://target.com/api — authenticated request with a bearer token, the common pattern for testing API auth

Next step

For anything beyond a handful of one-off requests, Burp Suite's Repeater is usually faster to iterate in — curl is for scripting and quick checks, Repeater is for exploration.