# HTTP Request Builder

URL: https://phishdestroy.io/developer-tools/http-request-builder
Category: General dev
Where it runs: Runs locally (nothing you enter is uploaded)

Write an HTTP request as a curl command or a fetch() call without sending it, for example to document where a phishing kit posts the form data it collects.

## Example input

Form endpoint as curl

```
https://example.com/api/collect.php
```

With the default GET method and Content-Type header the result is curl -X GET 'https://example.com/api/collect.php' -H 'Content-Type: application/json'. Choose POST and add a body to reproduce a form submission.

## FAQ

### What goes into the curl command?

The method after -X, the URL in single quotes, one -H flag for every header line that contains a colon and, for any method except GET, the body after -d. The fetch() button writes the same request as JavaScript.

### Are quotes and special characters escaped?

No. Values are placed inside single quotes exactly as typed, so a single quote in the URL, a header or the body breaks the shell command; replace it with '\'' first. The fetch() version wraps the body in JSON.stringify(), so it only works for a JSON body.

### Does the tool send the request or upload anything?

No. It only writes text in your browser: nothing is sent to the URL and nothing is uploaded. If you replay a phishing kit's endpoint yourself, do it from an isolated machine.

## Related tools

- [URL Parser](https://phishdestroy.io/developer-tools/url-parser)
- [Query String Builder](https://phishdestroy.io/developer-tools/query-string-builder)
- [URL Encoder / Decoder](https://phishdestroy.io/developer-tools/url-encoder-decoder)
- [Basic Auth Header Generator / Decoder](https://phishdestroy.io/developer-tools/basic-auth-header)
- [HTTP Headers Reference](https://phishdestroy.io/developer-tools/http-headers-reference)

All tools: https://phishdestroy.io/developer-tools