DEV Community: Daniel J

curlhub.sh Curl Based CLI Dev Tools

Daniel J — Fri, 31 Jul 2026 18:40:00 +0000

A suite of developer tools you run with the curl you already have: UUIDs, hashes, JSON End-points, JWTs, JSON, QR, File Transfers and more. Nothing to install, and no signup required. "curl curlhub.sh" to see list of commands or visit https://curlhub.sh to view all tools full details and soon contribute.

root@web01:~# curl curlhub.sh
curlhub.sh  —  CLI-first developer utilities
Zero-setup tools you curl straight from the terminal.

Generators
  /uuid      RFC 4122 v4 UUID.
  /pass      High-entropy password / API key / token. CLI: server-side CSPRNG over TLS; web: client-side. Never logged. (https)

Utilities
  /qr        ANSI/UTF-8 QR code from ?data. Nothing stored server-side; use HTTPS or pipe stdin for sensitive payloads (a ?data= value appears in request URLs).

Encoding
  /b64       Base64 encode / decode. (https)
  /hash      MD5 / SHA-1 / SHA-256 / SHA-512 of input. (https)

Developer
  /json      Validate + prettify + colorize JSON. (https)
  /jwt       Decode & pretty-print JWT header/payload. No verify; token never logged. (https)
  /status    Explain an HTTP status code + troubleshooting.
  /cron      Translate a cron expression to English + next run times.
  /ua        Parse the User-Agent you sent (browser / OS / engine / device).
  /headers   Echo the request headers you sent (+ the edge view). Your own request, not a remote audit.
  /hook      Webhook inspector: mint a temp endpoint, inspect incoming HTTP. (https)

Text & Logs
  /md        Render Markdown to colorized ANSI (safe, bounded parser). (https)
  /p         Pastebin: pipe text/logs to a short URL (plaintext in terminal, highlighted on web). (https)

Network
  /cidr      Subnet / CIDR math: range, netmask, broadcast, host count.
  /ip        Your public IP (thin). Geo/ASN live at worldip.io.
  /whois     Domain registration / registrar / dates (public OSINT; rate-limited + cached).

Security
  /ssl       Decode a PEM certificate or CSR you paste (expiry, issuer, SANs, key). No outbound connection. (https)

File Transfer
  /u         Ephemeral file drop (<=100 MB). ANSI QR; auto-purge after 1 download or TTL. (https)

Docs
  /man       Community CLI cheat-sheet wiki (read-only over CLI).

Family
  /port      Port scan of your own IP → hands off to qsa.sh.
  /scan      Vulnerability / threat scan of your IP → hands off to qsa.sh.
  /urlscan   Multi-egress URL scan → hands off to whack.sh.

Details: curl curlhub.sh/help/<tool>   ·   Spec: curl curlhub.sh/spec
Family:  qsa.sh (audit your IP) · whack.sh (scan a URL) · worldip.io (IP intel)

Please feel free to leave a comment with feedback, feature requests, etc.

Whack.sh - Multi-egress URL Threat Scanner

Daniel J — Fri, 31 Jul 2026 17:50:09 +0000

Traffic Direction Systems (TDS) have become a massive headache for analysts. By fingerprinting IPs, attackers can dynamically route traffic—hiding malicious payloads from security tools while successfully targeting residential, mobile, or specific ASNs.

The problem? Almost every URL scanner out there uses datacenter-based egress IPs. Attackers know this, so they block or cloak against datacenter ranges.

I ran into this wall while investigating malware distributed via a lapsed corporate domain. The standard scanners were returning clean results or blocked pages, but my home connection was still being served malware. Doing the analysis manually was a massive bottleneck, so I built a solution: whack.sh.

What it does: Whack allows you to scan any URL simultaneously through multiple egress options: Datacenter, Residential, Mobile, VPN, and even BYO IP. It then diffs the captures (HAR files) to expose the cloaking, TDS routing, phishing, and malware that traditional datacenter-only scanners miss.
The Origin & Investigation: I’ve been working on this for over a month and have already run over 150,000 scans of known threat URLs. The early MVP was basic but proved the concept: diffing HAR files of the exact same URL across different categorized ASNs immediately exposed the evasion tactics.

I actually reported my initial findings on this specific threat to the FBI IC3 on Monday, June 15th. Three days later, IC3 pushed out a PSA specifically regarding TDS. (I’ll be publishing a few in-depth articles on my company's site detailing these findings in the coming weeks).

Under the Hood (TDS-over-TDS): One of the most interesting things the tool exposed during this process is that TDS isn't just happening at the redirect layer. I found several instances of TDS-over-TDS (redirect layer + payload delivery layer). Malicious actors are using real-time API calls or compressed local IP intelligence to serve entirely different payloads based on the exact environment (e.g., Windows vs. Mobile/Android/Chrome vs. Mobile/iOS/Safari).

Community Integration: I want this data to be useful to the broader community, so any threats found by whack.sh are automatically published to Abuse.ch: https://bazaar.abuse.ch/user/42023/

I’m putting the final polish on the site and planning to officially launch on or before August 4th. In the meantime, I would love to hear your thoughts on the concept! What features would you want to see, or what specific evasion tactics would you want to test against it when it goes live?

qsa.sh – An instant external security scan of your IP via curl

Daniel J — Thu, 30 Jul 2026 20:45:00 +0000

qsa.sh to give you an instant, outside-in security scan of your own public IP straight from your terminal.
You can run it like this:

curl qsa.sh

What it does: It triggers a real external port and vulnerability scan (using open-source tools like naabu, nmap + vulners, and nuclei) of the public IP you're connecting from, streamed live back to your terminal in about 30 seconds.

How it handles safety & consent:

Only your IP: There is no target input field. You cannot point it at anyone else.

The 15-second abort window: When you run the command, it prints your detected IP and gives you a 15-second grace period (Ctrl-C) to abort before anything is actually scanned.

Refusals: Known CGNAT, mobile-carrier, and detected VPN/Tor/IPv6 origins are refused outright.

Zero retention: The results are entirely ephemeral and streamed live—nothing is written to disk.

Curious to hear what people think.