curl Converter

Convert Copy as cURL into sqlmap -r, ffuf, Python, fetch and more.

Convert browser Copy as cURL into a curl command with clickable SOCKS5 / UA / -v flags, a sqlmap -r request file, sqlmap / ffuf commands, plus Python requests, fetch, axios, Go, PowerShell, HTTPie, wget and JSON. Parsing and conversion run in your browser; cookies and tokens are never uploaded.

How to use

  1. In DevTools → Network, right-click a request → Copy as cURL, and paste it on the left.
  2. The default output is a sqlmap -r txt. Click a parameter name for -p; edit the chip value to rewrite request.txt (the pasted curl stays). If you already know the DBMS, pin Oracle / MySQL (--dbms), then pick a scene to check a flag set. Download request.txt.
  3. To replay as curl or via a proxy: pick curl, then check SOCKS5 / switch UA / -v. Editing chip values rewrites the command on the right.
  4. Switch the format chip to ffuf, Python, fetch, etc. when you need those instead.

FAQ

Why does https still need --force-ssl?
A sqlmap -r file is a raw HTTP message and does not record TLS. The Host header has no scheme either. For https targets add --force-ssl, or write Host as host:443. This tool also prints the command with --force-ssl when the curl URL was https.
Why must Host be the first header?
sqlmap treats the line after the request line as Host. If Host is further down, parsing fails (sqlmap#5358). This tool always writes Host first.
Why does sqlmap still send its own User-Agent?
sqlmap’s default UA is sqlmap/x.x. It keeps yours only if the -r file has User-Agent, or you pass --user-agent. Copy as cURL often omits that header. This tool writes the original UA into request.txt and the command, and fills in a browser UA when curl had none.
I flipped is_test and retested — still clean. Why?
sqlmap’s session key is host + path + parameter name, not sibling values. A field already tested with is_test=1 is skipped after you change it to 0. Editing a chip value rewrites request.txt; still pick the Retest scene for --flush-session. Clicking the name only sets -p.
Where does DNS resolve when curl uses SOCKS5?
The SOCKS5 chip adds --socks5-hostname, so DNS is resolved by the proxy, not locally. Clash mixed port is Clash :7890; the address field below can change host:port.
Are my cookies or tokens uploaded?
No. Parsing and conversion run in your browser. The page makes no network request and does not write the command to the URL or localStorage. Refreshing clears it.

Related tools