curlLOLBIN
Cliente HTTP para probar payloads (traversal, webshells, RCE).
Binario legítimo del sistema (LOLBIN): no es una herramienta ofensiva, pero un atacante lo aprovecha porque suele estar ya instalado y levantar menos sospechas que subir una herramienta propia.
Cliente HTTP de línea de comandos, imprescindible para probar la web a mano: enviar parámetros, cabeceras y cookies, subir ficheros y disparar payloads de LFI, traversal, XXE, SSRF o webshells. La opción --path-as-is evita que normalice las rutas con ../.
Familia Acceso, shells y transferencia
Flags --path-as-is -s -X -d -H
Conceptos Local File Inclusion (LFI) & Path Traversal, File Upload to RCE, OS Command Injection
Cheatsheet LFI / traversal / RFI
Instalación
sudo apt install -y curlComandos útiles
Aparece en
Algunas máquinas donde se documenta su uso; no es una lista exhaustiva.
- AdmirerHackTheBox
- AlertHackTheBox
- AmaterasuProving Grounds Play
- AmbassadorHackTheBox
- ApexProving Grounds Practice
- ArcticHackTheBox
- AuthByProving Grounds Practice
- BackdoorHackTheBox
- BackendHackTheBox
- BartHackTheBox
- BastardHackTheBox
- BigPivotingDockerLabs
- BountyHackTheBox
- BountyHunterHackTheBox
- BuffHackTheBox
- BullyboxProving Grounds Practice
- BuscaloveDockerLabs
- Cereal 1VulnHub
- ChemistryHackTheBox
- ChocolateLoversDockerLabs
- ClueProving Grounds Practice
- CockpitProving Grounds Practice
- ConsolelogDockerLabs
- DevelHackTheBox
- DomainDockerLabs
- DVR4Proving Grounds Practice
- FanatasticProving Grounds Practice
- FishProving Grounds Practice
- GrannyHackTheBox
- GreenHornHackTheBox
- HawatProving Grounds Practice
- HealHackTheBox
- HeistHackTheBox
- HetemitProving Grounds Practice
- HokkaidoProving Grounds Practice
- HunitProving Grounds Practice
- Infovore 1VulnHub
- InstantHackTheBox
- LaboratoryHackTheBox
- LinkVortexHackTheBox
- LolyProving Grounds Play
- MailingHackTheBox
- MantisProving Grounds Practice
- MiceProving Grounds Practice
- MonsterProving Grounds Practice
- MzeeavProving Grounds Practice
- NagoyaProving Grounds Practice
- NickelProving Grounds Practice
- NukemProving Grounds Practice
- OpenSourceHackTheBox
- PandoraHackTheBox
- PayDayProving Grounds Practice
- PebblesProving Grounds Practice
- PelicanProving Grounds Practice
- PermXHackTheBox
- PhotobombHackTheBox
- PsychoDockerLabs
- ReadysProving Grounds Practice
- RedPandaHackTheBox
- ResourceHackTheBox
- ScrutinyProving Grounds Practice
- ServmonHackTheBox
- SickOs 1.2VulnHub
- SightlessHackTheBox
- SlortProving Grounds Practice
- SnookumsProving Grounds Practice
- SpiderSocietyProving Grounds Practice
- SPXProving Grounds Practice
- SquashedHackTheBox
- SquidProving Grounds Practice
- SwagShopHackTheBox
- Symfonos 1 & 2VulnHub
- Symfonos 3VulnHub
- Symfonos 5VulnHub
- Symfonos 6VulnHub
- TrickHackTheBox
- TricksterHackTheBox
- VmdakProving Grounds Practice
- Vulnerable Lab (1 · 4 · 5)VulnHub
- WallpaperHubProving Grounds Practice
- WorkaholicProving Grounds Practice
- XposedAPIProving Grounds Practice
- YummyHackTheBox
- ZabProving Grounds Practice
- ZenPhotoProving Grounds Practice
- ZipperProving Grounds Practice