curl
curl is an open-source command-line tool and network transfer library that supports data transfer over dozens of network protocols, including HTTP, HTTPS, FTP, and SMTP. It is widely used for sending network requests, uploading and downloading files, and debugging APIs. It provides cross-platform support, and its underlying library, libcurl, can be called by multiple programming languages and applications, making it a foundational tool in network development and operations.
Timeline (last 90 days)
A curl | bash one-click install script using an unupdated certificate store may pull back tampered code; an unupdated Node environment running npm install may introduce malicious packages, leading to API key leaks.
In the video, ThePrimeagen demonstrated that curl could still retrieve content from a site blocked by the browser, and said, 'I didn't even know I was being man-in-the-middled.'
System-level trust stores (such as ca-certificates.crt or cert.pem) do not automatically sync browsers' certificate revocation updates, and a large number of tools including curl, git, Python, Perl, Ruby and OpenSSL rely on this file.
The Chrome browser explicitly refuses to access websites using eMudra's problematic certificates, while the command-line tool curl retrieves the content normally without any warning and without blocking.
NSS is the Network Security Services library maintained by Mozilla, which contains the root certificate trust list shared by the browser and many open-source software programs, and tools such as curl and Python directly rely on NSS's trust store.
After learning of the vulnerability, Mozilla took three days to update its certificate trust list (NSS), and this list is relied upon by a large number of open-source projects such as curl and Python.
Developers should check whether the certificate stores in CI/CD pipelines and container base images have been updated in sync.
The macOS command-line argument limit is about 1 MB (ARG_MAX), so curl uses -d @- to read the request body from stdin, and jq uses --rawfile together with process substitution to handle large file output.
Using the command curl -s https://your-site.com | wc -c, if the response is only a few hundred bytes you have an empty shell, and if it reaches several thousand bytes or more the content is in the HTML.
GoRoute offers two installation methods: via a curl script and via npx goroute.
37 more timeline events
All Facts (20)
最近一次被评为HIGH级别的curl CVE（CVE-2023-38545）发布于2023年10月
95%Unverifiedcurl诞生于1998年，由Daniel Stenberg以一个名为httpget的小工具为起点发展而来
95%Unverifiedcurl和Python requests库的TLS握手签名与Chrome浏览器截然不同，容易被反爬系统识别
90%Unverifiedcurl项目将每个选项拆分为独立的.d文件，存放在docs/cmdline-opts/目录下，由构建脚本自动聚合生成最终的man page和网站文档
90%Unverifiedcurl有超过240个命令行选项
90%UnverifiedAndroid系统、macOS、几乎所有Linux发行版均内置curl
90%Unverifiedcurl支持多达30余种网络协议，包括HTTP、HTTPS、FTP、SMTP、IMAP等
85%Unverifiednpm、pip、curl等CLI工具同样依赖环境变量而非系统代理API来获取代理设置
85%Unverified全球超过100亿台设备上运行着curl
75%UnverifiedThe curl project operates a bug bounty program through the HackerOne platform.
60%UnverifiedCurl has been installed more than 20 billion times and runs on virtually every smartphone, tablet, car, television, game console, and server.
60%UnverifiedDaniel Stenberg has maintained curl for more than 25 years.
60%UnverifiedThe Chrome browser explicitly refuses to access websites using eMudra's problematic certificates, while the command-line tool curl retrieves the content normally without any warning and without blocking.
50%UnverifiedIn the video, ThePrimeagen demonstrated that curl could still retrieve content from a site blocked by the browser, and said, 'I didn't even know I was being man-in-the-middled.'
50%UnverifiedSystem-level trust stores (such as ca-certificates.crt or cert.pem) do not automatically sync browsers' certificate revocation updates, and a large number of tools including curl, git, Python, Perl, Ruby and OpenSSL rely on this file.
50%UnverifiedNSS is the Network Security Services library maintained by Mozilla, which contains the root certificate trust list shared by the browser and many open-source software programs, and tools such as curl and Python directly rely on NSS's trust store.
50%UnverifiedDevelopers should check whether the certificate stores in CI/CD pipelines and container base images have been updated in sync.
50%UnverifiedThe macOS command-line argument limit is about 1 MB (ARG_MAX), so curl uses -d @- to read the request body from stdin, and jq uses --rawfile together with process substitution to handle large file output.
50%UnverifiedUsing the command curl -s https://your-site.com | wc -c, if the response is only a few hundred bytes you have an empty shell, and if it reaches several thousand bytes or more the content is in the HTML.
50%UnverifiedGoRoute offers two installation methods: via a curl script and via npx goroute.
50%