URL Debugging & Security Testing Commands
1. Basic Header Inspection
Command:
curl -I https://example.comExample Response:
HTTP/2 200
date: Thu, 20 Mar 2025 07:14:30 GMT
content-type: text/html; charset=UTF-8
server: nginx
cache-control: max-age=3600
strict-transport-security: max-age=31536000; includeSubDomains; preloadWhat to Check:
- Status Code (200, 301, 403, 404, 500, etc.)
- Content Type (text/html, application/json, etc.)
- Server (nginx, Apache, cloudflare, etc.)
- Cache-Control, HSTS, CSP headers
2. Checking Redirects
Command:
curl -IL https://example.comExample Response:
HTTP/1.1 301 Moved Permanently
Location: https://www.example.com/What to Check:
- Ensure HTTPS redirect is in place
- Check if multiple redirects exist
3. Checking CORS Headers
Command:
curl -I -H "Origin: https://test.com" https://example.comExample Response:
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONSWhat to Check:
- If CORS is properly configured
- Avoid
Access-Control-Allow-Origin: *for security
4. Checking Cache Headers
Command:
curl -I https://example.comExample Response:
cache-control: public, max-age=86400
age: 1720
cf-cache-status: HITWhat to Check:
- Ensure cache rules are properly applied
- Check
cf-cache-status(HIT, MISS, EXPIRED)
5. Checking Content Security Policy (CSP)
Command:
curl -I https://example.com | grep -i "content-security-policy"Example Response:
content-security-policy: default-src 'self'; script-src 'self' https://trusted.comWhat to Check:
- Ensure only trusted sources are allowed
- Prevent
unsafe-inlinefor scripts
6. Checking HSTS (Strict Transport Security)
Command:
curl -I https://example.com | grep -i "strict-transport-security"Example Response:
strict-transport-security: max-age=31536000; includeSubDomains; preloadWhat to Check:
- Ensure HSTS is enforced to prevent MITM attacks
7. Checking Remote IP & Server Details
Command:
curl --resolve example.com:443:93.184.216.34 -I https://example.comExample Response:
HTTP/2 200What to Check:
- Verify correct IP resolution
- Ensure DNS records are updated
8. Checking TLS Certificate Information
Command:
curl --insecure -v https://example.comExample Response:
* Connected to example.com (93.184.216.34) port 443 (#0)
* SSL certificate verify ok.What to Check:
- Ensure SSL certificate is valid
- Check if issued by a trusted CA
9. Checking Response Time & Performance
Command:
curl -o /dev/null -s -w "%{time_total}\n" https://example.comExample Response:
0.320What to Check:
- Ensure response time is optimized (< 1s preferred)
- Identify potential server lag
10. Checking HTTP Methods Allowed
Command:
curl -X OPTIONS -I https://example.comExample Response:
allow: GET, POST, OPTIONSWhat to Check:
- Ensure
PUT,DELETEare restricted unless required - Limit exposure of unnecessary HTTP methods
11. Checking Open Ports
Command:
nmap -p 80,443 example.comExample Response:
PORT STATE SERVICE
80/tcp open http
443/tcp open httpsWhat to Check:
- Ensure only necessary ports are open
- Close unused ports to reduce attack surface
12. Checking Who Owns the Domain
Command:
whois example.comExample Response:
Registrant: Example Corp
Registrar: Namecheap
Expiration Date: 2026-01-01What to Check:
- Ensure domain ownership is correct
- Check expiration dates to avoid downtime
13. Checking Live HTTP Requests in Real-Time
Command:
tail -f /var/log/nginx/access.logExample Response:
192.168.1.1 - - [20/Mar/2025:07:14:30 +0000] "GET /index.html HTTP/2" 200 1024What to Check:
- Monitor real-time traffic for anomalies
- Identify suspicious requests
14. Checking Server-Side Compression
Command:
curl -I --compressed https://example.comExample Response:
content-encoding: gzipWhat to Check:
- Ensure GZIP/Brotli compression is enabled for performance
15. Checking Remote Server Details
Command:
curl -v https://example.comExample Response:
* Connected to example.com (93.184.216.34) port 443 (#0)What to Check:
- Confirm server IP & handshake details
- Identify potential issues in SSL handshake
Conclusion
These commands cover security testing, debugging, and performance checks for URLs. Use them to diagnose issues related to HTTP headers, caching, CORS, CSP, HSTS, SSL, and more. 🚀