metasploit-cursor-harness: Skill for Cursor

Metasploit Reconnaissance

When to Use

• Initial target mapping after network scan
• Searching Metasploit modules for specific CVEs or services
• Correlating Nexpose/nmap results with Metasploit module coverage
• Querying hosts, services, vulns, and credentials from msfdb

Prerequisites

• Metasploit RPC running (check with msf_status)
• msfdb initialized with scan data (imported via msf_db_import or msf_db_nmap)
• Targets in scope/scope-master.txt

Tool Inventory

Read-only: msf_status, msf_host_info, msf_service_info, msf_vulnerability_info, msf_note_info, msf_credential_info, msf_loot_info, msf_search_modules, msf_module_info, msf_get_lab_network, msf_list_workspaces

Action (engagement_id required): msf_db_nmap, msf_db_import, msf_create_workspace, msf_set_workspace, msf_run_auxiliary_module

Workflow

Step 1: Verify connectivity

MSF MCP (preferred):

msf_status()

CLI fallback:

wsl -e bash -lc "msfconsole -q -x 'version; exit'"

Step 2: Lab network and workspace setup

MSF MCP (preferred):

msf_get_lab_network()
msf_list_workspaces()
msf_create_workspace(
  engagement_id="<id>",
  workspace_name="engagement-<id>"
)
msf_set_workspace(
  engagement_id="<id>",
  workspace_name="engagement-<id>"
)

CLI fallback:

wsl -e bash -lc "msfconsole -q -x 'workspace -a engagement-<id>; workspace engagement-<id>; exit'"

Step 3: Network scan and import

Resolve scan ports deterministically:

1. msf_get_lab_network() -> use port_map keys as scan targets
2. Else use engagements/{id}/targets.yaml port list if defined
3. Else default: -p 21,22,23,25,53,80,110,111,135,139,143,443,445,993,995,1433,1521,2049,3306,3389,5432,5900,5985,6667,8080,8443,9667
4. Only use -p- (all ports) if the user explicitly requests a full port scan

MSF MCP (preferred):

msf_db_nmap(
  engagement_id="<id>",
  targets="<target>",
  nmap_args="-sV --open -T4 -p <ports_from_above>"
)