curl
Named by 69 kept items in this workspace.
39 items name it under tools, 17 under affected products and 13 under classification.technologies.
The items that name it 69
Queries ifconfig.me and https://api.ipify.org for the victim's public IP
bug bounty program ended January 2026
use-after-free in HTTP/2 upload handling, found by Luna Tong
run by ARTEX worker agents; also seen as an attacker user agent
used to test the two incident-site hosts dv-g3b-emudhra.we-have-a-problem.com and dv-g3b-aaa-emudhra.we-have-a-problem.com; SSL error with HTTP 000 is the desired result
Mentioned as a standard tool that restricts null bytes in headers, so the gRPC message had to be assembled manually
several AI tools prompted roughly 200–300 bug fixes over the preceding eight to ten months, reported by Daniel Stenberg in May, before curl received its first Mythos report
fetching the session cookie from /oauth2authorize
used within the malicious workflow to POST stolen secrets/credentials to the attacker's C2 over plain HTTP
CVE-2026-9545, CVE-2026-13608
call GitHub API and npm registry
Used to inspect HTTP response headers (curl -I target.com) and send custom/malicious HTTP requests (curl -i -X CUSTOMVERB) to fingerprint a WAF by its behavior
no specific version or vulnerability count given
Legitimate open-source software abused via DLL sideloading (libcurl.dll)
Shut down its bug bounty program at the end of January due to low-quality, often AI-generated reports; later reopened HackerOne for vulnerability reports without restoring bounty payments
Downloads the Ubuntu cloud image and checksum files
Used via cmd.exe by the first rogue ScreenConnect client to retrieve and install the second malicious ScreenConnect client
Used by BlueMoon's post-exploitation shellcode to download and execute actor-provided executables (e.g. msgbox.exe) outside the renderer sandbox.
SMTP EXPN recipient CRLF injection
Used by some observed scripts to retrieve additional payload content
Used by the malicious payload to contact GitHub and release-assets.githubusercontent.com and to download the Bun executable
Used to call JFrog Access APIs to create the OIDC integration and identity mapping and to validate the exchange.
9 CVEs in 2025, 36 through 2026-06-24, 15 of 36 AI-marked
Used both to build/send exploit requests (SVG upload, crawler-fetch trigger) and inside pipe-prefixed payload commands to exfiltrate command output to an out-of-band collector.
Used by the malware for payload delivery (curl -kfsSL) with certificate validation disabled
audited as part of Patch the Planet
Local HTTP request tool orchestrated by BountyForge
open source project reporting security issues at 4 to 5 times its 2024 rate, more than once per day on average; stopped accepting vulnerability reports for July
used to probe the unauthenticated gRPC endpoint of the repo-server
open-source project covered by Patch the Planet week one
Used in the reproduction steps to send unauthenticated JSON-RPC tool call requests to the vulnerable MCP server
Used by the malicious build.rs to POST exfiltrated data to the attacker's Sentry ingest endpoint
Open source project whose maintainers described AI-driven contributions negatively
heavily audited/fuzzed codebase; AI tools found bugs, most reported by Mythos were false positives
Used to fetch the raw SKILL.md master entry or download the offline ZIP distribution
git master branch, specific recent commit; 178K lines of code analyzed in src/ and lib/ subdirectories by Mythos scan
HTTP client utility included in the base Docker image
HTTP request tool for API practice
Used by MacSync (as a LOOBin - 'Living off the orchard binary') to POST the stolen data archive to the attacker's C2 server.
Used to query ifconfig[.]me to check the victim machine's external IP address
Command used by the injection to instruct Claude to upload the victim's largest file to the attacker's API key/account
Used by threat actor in two customer incidents to target an external resource
Used by the malicious script to fetch a new copy of the 'update' binary to /tmp
CLI tool used within the PHP backdoor to fetch HTTP headers from a shortened URL and to download a second-stage payload
Used in the example request that calls the backgroundMigrations.retry endpoint with auth cookies
Used by the attacker to manually craft requests to the Azure device code and OAuth token API endpoints
Used by the investigators to test SOCKS5 proxy connectivity through the microsocks binary
Used to query the ThreatFox API for AsyncRAT IOC data.
Used with smtp:// scheme to manually send raw SMTP mail (MAIL FROM/RCPT TO/DATA) to craft the phishing email
Command-line file transfer tool; new rules for file upload to file sharing sites and NTLM hash leak via NTLM authentication
used in reproduction steps to send HTTP/JSON-RPC requests to the vulnerable /mcp endpoint and Publish proxy
used in the proof of concept to send unauthenticated JSON-RPC requests to the /tools and /mcp endpoints
used in the proof-of-concept to open the SSE connection and send tool calls
one of 78 projects with CVEs credited to AISLE's analyzer; example of a mature open-source project covered by HoF-Bench's underlying CVE set
Used by Claude (via Bash) to directly fetch the malicious website content and follow a redirect to a ZIP archive
In every workspace you can read 71
Security
All technologies in this workspace.