The --write-out (-w) flag in cURL is incredibly powerful and versatile, especially when used by penetration testers. It allows users to extract specific information from the request/response cycle after a transfer has completed. Here's an expanded explanation of how it works and why it's so valuable:
Basic Usage
The -w flag takes a format string where you can specify various pieces of data that cURL will output upon completion. For example, %{http_code} gives you the HTTP status code.
bash1curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8080
This command:
- Runs silently (
-s). - Discards the body of the response (
-o /dev/null). - Outputs only the HTTP status code.
Useful Variables for Pentesters
Here's a more comprehensive list of variables that are particularly useful in penetration testing:
-
HTTP Status Code:
%{http_code}: Returns the HTTP status code (e.g., 200, 404).
-
Response Headers:
%{response_header_size}: Size of the response headers
Read the full article at InfoSec Write-ups - Medium
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.

![[AINews] The Unreasonable Effectiveness of Closing the Loop](/_next/image?url=https%3A%2F%2Fmedia.nemati.ai%2Fmedia%2Fblog%2Fimages%2Farticles%2F600e22851bc7453b.webp&w=3840&q=75)



