如何正确解压并查看curl POST请求返回的压缩响应？

问题描述 #

我通过curl命令向某网站API发送POST请求，已抓包获取请求头与请求体。执行curl命令后，响应保存至output.txt，但文件内容为乱码。根据请求头，响应可能采用gzip、deflate或Brotli压缩。我尝试用brotli、inflate、zcat、gzip -d等命令解压均失败，请问如何正确解压查看内容？

抓包获取的请求信息 #

url = https://www.my_site.com/api/register

Accept: */*
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.5
Alt-Used: www.my_site.com
Connection: keep-alive
Content-Length: 134
content-type: application/json
Cookie: cf_clearance=uvzZt00yfK5h2O_SEVu2YPNL.5cJT9AnkYJr9YhwhoU-1706709249-1-AUHiOWO+oTJ91OHoTxQWgHVGPNkJF+yqyHbsLFotZWuDb2Uivu/a/ETDZP5fupnkUX6z9mt/+nRhMTEZ7jPmT5c=
Host: www.my_site.com
Origin: https://www.my_site.com
Referer: https://www.my_site.com/?ref=bJsbQYkc
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (X11; Linux aarch64; rv:109.0) Gecko/20100101 Firefox/115.0

Body:
{"username":"my_phone_no","password":"xGxfUu4ljy9yR8n","captcha":"hF5X","ref":"bJsbQYkc","phone":"my_phone_no","rand":"9142","opt":"hF5X"}

执行的curl命令 #

curl -X POST https://www.my_site.com/api/register \
-H "Accept: */*" \
-H "Accept-Encoding: gzip, deflate, br" \
-H "Accept-Language: en-US,en;q=0.5" \
-H "Alt-Used: www.my_site.com" \
-H "Connection: keep-alive" \
-H "Content-Length: 134" \
-H "Content-Type: application/json" \
-H "Cookie: cf_clearance=uvzZt00yfK5h2O_SEVu2YPNL.5cJT9AnkYJr9YhwhoU-1706709249-1-AUHiOWO+oTJ91OHoTxQWgHVGPNkJF+yqyHbsLFotZWuDb2Uivu/a/ETDZP5fupnkUX6z9mt/+nRhMTEZ7jPmT5c=" \
-H "Host: www.supercharles.day" \
-H "Origin: https://www.my_site.com" \
-H "Referer: https://www.my_site.com/?ref=bJsbQYkc" \
-H "Sec-Fetch-Dest: empty" \
-H "Sec-Fetch-Mode: cors" \
-H "Sec-Fetch-Site: same-origin" \
-H "User-Agent: Mozilla/5.0 (X11; Linux aarch64; rv:109.0) Gecko/20100101 Firefox/115.0" \
-d '{"username":"my_phone_no","password":"xGxfUu4ljy9yR8n","captcha":"hF5X","ref":"bJsbQYkc","phone":"my_phone_no","rand":"9142","opt":"hF5X"}' \
-o output.txt

乱码输出 #

┌──(kali㉿localhost)-[~]
└─$ cat output.txt
�#��ړ�Y��>��!S�K�)�*�sQ⚆a)�{��ה��ˑ7���$�|HVJ9.ǫ�p�}9���

尝试过的解压命令及错误 #

┌──(kali㉿localhost)-[~]
└─$ brotli -d output.txt
input file [output.txt] suffix mismatch

┌──(kali㉿localhost)-[~]
└─$ inflate output.txt
Usage: inflate [OPTIONS] START END [AMOUNT]
Try 'inflate --help' for help.
Error: Invalid value for 'START': 'output.txt' is not a valid integer.

┌──(kali㉿localhost)-[~]
└─$ zcat output.txt
gzip: output.txt: not in gzip format

┌──(kali㉿localhost)-[~]
└─$ gzip -d output.txt
gzip: output.txt: unknown suffix -- ignored

解决方案 #

方法1：让curl自动处理压缩（最简单） #

curl本身支持自动识别并解压gzip、deflate、Brotli格式的响应，只需添加--compressed参数即可，无需手动后续解压。同时注意修复原命令中Host头写错的问题（抓包Host为www.my_site.com，原命令写为www.supercharles.day），修改后的命令如下：

curl -X POST https://www.my_site.com/api/register \
-H "Accept: */*" \
-H "Accept-Encoding: gzip, deflate, br" \
-H "Accept-Language: en-US,en;q=0.5" \
-H "Alt-Used: www.my_site.com" \
-H "Connection: keep-alive" \
-H "Content-Length: 134" \
-H "Content-Type: application/json" \
-H "Cookie: cf_clearance=uvzZt00yfK5h2O_SEVu2YPNL.5cJT9AnkYJr9YhwhoU-1706709249-1-AUHiOWO+oTJ91OHoTxQWgHVGPNkJF+yqyHbsLFotZWuDb2Uivu/a/ETDZP5fupnkUX6z9mt/+nRhMTEZ7jPmT5c=" \
-H "Host: www.my_site.com" \
-H "Origin: https://www.my_site.com" \
-H "Referer: https://www.my_site.com/?ref=bJsbQYkc" \
-H "Sec-Fetch-Dest: empty" \
-H "Sec-Fetch-Mode: cors" \
-H "Sec-Fetch-Site: same-origin" \
-H "User-Agent: Mozilla/5.0 (X11; Linux aarch64; rv:109.0) Gecko/20100101 Firefox/115.0" \
-d '{"username":"my_phone_no","password":"xGxfUu4ljy9yR8n","captcha":"hF5X","ref":"bJsbQYkc","phone":"my_phone_no","rand":"9142","opt":"hF5X"}' \
--compressed \
-o output.txt

执行后output.txt将直接保存解压后的明文内容。

方法2：手动判断压缩格式并解压（针对已保存的output.txt） #

如果已有乱码的output.txt，可按以下步骤处理：

1. 判断压缩格式：用file命令识别文件类型：

file output.txt

输出会明确显示压缩格式，例如：

• Brotli压缩：output.txt: Brotli compressed data
• gzip压缩：output.txt: gzip compressed data
• deflate压缩：output.txt: zlib compressed data

2. 对应解压：

• Brotli格式：指定输出文件或修改后缀后解压：

  # 指定输出文件
  brotli -d output.txt -o output_decompressed.txt
  # 或修改后缀后解压
  mv output.txt output.txt.br
  brotli -d output.txt.br
  

• gzip格式：指定输出文件或修改后缀后解压：

  gzip -d output.txt -c > output_decompressed.txt
  # 或修改后缀后解压
  mv output.txt output.txt.gz
  gzip -d output.txt.gz
  

• deflate(zlib)格式：用zlib-flate命令解压：

  zlib-flate -uncompress < output.txt > output_decompressed.txt
  

内容的提问来源于stack exchange，提问作者Favour