metasploit-cursor-harness: Skill for Cursor

Web Application Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Load tier-3 vuln skills for payloads once a class is confirmed (see routing table below).

When to Use

• Web application in scope with HTTP/HTTPS services
• After hacktricks-methodology identifies web ports (80, 443, 8080, 8443)
• Before diving into specific vuln skills (sqli, xss, ssrf, etc.)

Methodology

Task Progress:
- [ ] Map attack surface (endpoints, params, auth, tech stack)
- [ ] Classify input sinks (DB, shell, template, redirect, file, SSRF)
- [ ] Route to vuln skill; test with low-impact probes first
- [ ] Escalate only with evidence; document request/response proof

Phase 1: Surface mapping

Discovery

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/http/http_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 443, "SSL": true}
)
msf_run_auxiliary_module(
  module_name="auxiliary/scanner/http/dir_scanner",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 443, "SSL": true, "PATH": "/admin", "DICTIONARY": "/usr/share/wordlists/dirb/common.txt"}
)
msf_db_nmap(
  engagement_id="<id>",
  targets="<target>",
  nmap_args="-sV -sC -p 80,443,8080"
)

CLI fallback:

ffuf -u https://target/FUZZ -w /path/wordlist.txt -mc 200,301,302,403
feroxbuster -u https://target -x js,html,json,php,asp
whatweb https://target
nuclei -u https://target -tags exposure,misconfig

Burp workflow notes

MSF: No direct module; use CLI/Burp.

CLI fallback:

1. Configure browser proxy to Burp (127.0.0.1:8080)
2. Browse target; let Burp build site map (Target > Site map)
3. Right-click > Scan (passive then active if ROE permits)
4. Send interesting requests to Repeater for manual mutation
5. Use Intruder for fuzzing (rate-limit per ROE)
6. Extensions: Autorize (authZ), Param Miner (hidden params), JWT Editor
7. Export evidence: right-click > Copy to file (request/response)