Skip to content
recurl_ $install

← home · use cases · # security

Security researchers and appsec engineers

Security-testing your own properties

# the problem

You need to check how your own WAF and bot-management rules respond to browser-grade fingerprints versus a plain client — and you need both signals cleanly, without maintaining a fleet of profile binaries.

# what recurl does

Point recurl at your own property to exercise the impersonation and JS-preflight layers with real browser JA3/JA4 fingerprints, then flip --recurl-strict to disable all fallback and capture exactly what upstream curl saw. Two runs, one binary, a clean before/after on your own bot rules.

# how to do it

Step by step

  1. 1

    Run recurl --recurl-debug <your-url> to see how your WAF responds as escalation proceeds.

  2. 2

    Force a specific browser with --recurl-impersonate chrome (or firefox/safari/edge) to test individual fingerprints.

  3. 3

    Run recurl --recurl-strict <your-url> for the pure plain-curl baseline with no escalation.

  4. 4

    Compare the two traces to validate that your bot rules behave as intended.

# authorised use

This use case is for properties you own or are explicitly authorised to test. recurl does not bypass authentication and carries the same ethical scope as curl itself.

Related

See the escalation architecture, browse more use cases, or follow a guide.

$ install Read the FAQ →