pentest-knowledge-base

name	pentest-knowledge-base
description	Routes pentest tasks to the correct harness skill based on engagement type, target platform, discovered services, or vulnerability class. Use when choosing which skill to load for a specific testing scenario.

Pentest Knowledge Base

Skill router for the Metasploit Cursor Harness. Each skill is self-contained with internalized technique knowledge.

By engagement type

Scenario	Skill
Web application	web-app-pentest
Active Directory / domain	internal-ad-pentest
Windows host (non-domain)	windows-pentest
Linux host	linux-pentest
macOS host	macos-pentest
Cloud (AWS/Azure/GCP)	cloud-pentest
Containers / DevOps / CI-CD	container-devops-pentest
Mobile apps	mobile-pentest
AI/LLM apps	ai-llm-pentest
Database access	database-pentest
Wireless networks	wifi-pentest
Binary targets	binary-exploit-pentest
Reverse engineering	reversing-pentest
Forensic analysis	forensics-pentest
Hardware / physical	hardware-pentest
Blockchain / smart contracts	blockchain-pentest

By discovered port

Port	Skill	Service
21	ftp-pentest	FTP
22	ssh-pentest	SSH
23	telnet-pentest	Telnet
25/587	smtp-pentest	SMTP
53	dns-pentest	DNS
139/445	smb-pentest	SMB
161	snmp-pentest	SNMP
389/636	ldap-pentest	LDAP
1433	database-pentest	MSSQL
2049	nfs-pentest	NFS
3306	database-pentest	MySQL
3389	rdp-pentest	RDP
5432	database-pentest	PostgreSQL
5900	vnc-pentest	VNC
5985/5986	winrm-pentest	WinRM
11211	memcache-pentest	Memcached
80/443	web-app-pentest	HTTP/S

Additional ports for DB/cache

Port	Skill	Service
27017	nosql-injection-pentest, database-pentest	MongoDB
6379	database-pentest	Redis
9200	database-pentest	Elasticsearch
8080/8443	web-app-pentest, hacktricks-methodology	HTTP alt / app servers
1433	database-pentest	MSSQL
3306	database-pentest	MySQL
5432	database-pentest	PostgreSQL

By vulnerability signal

Signal	Skill
SQL errors, ' breaks query	sqli-pentest
Reflected/stored HTML/JS	xss-pentest
URL fetch, webhooks, PDF gen	ssrf-pentest
Template syntax {{, ${	ssti-pentest
XML/SOAP/SVG input	xxe-pentest
Shell metacharacters	cmdi-pentest
Serialized objects, ViewState	deserialization-pentest
page=, ../, path params	lfi-pentest
File upload forms	upload-pentest
Sequential/predictable IDs	idor-pentest
JWT eyJ tokens	jwt-pentest
GraphQL endpoint	graphql-pentest
Front/back-end proxy desync	request-smuggling-pentest
LLM chatbot, AI features	prompt-injection-pentest
MongoDB $gt/$ne operators	nosql-injection-pentest

MSF Module Discovery

When a vuln signal or service is found, use msf_search_modules before improvising:

msf_search_modules(query="<service or CVE>")
msf_module_info(type="auxiliary", name="<module_path>")

This skill does not execute techniques. Always load the target skill's dual-track workflow for operational steps. Every exploit path requires msf_module_check before msf_run_exploit per harness ROE.

Exploit Phase Routing

Before any exploitation, the agent must:

1. Load msf-exploit-chain for the full check-then-exploit workflow
2. Pass SG4.1 reviewer gate (mandatory)
3. Run msf_module_check before msf_run_exploit
4. Include engagement_id on every action tool call

By workflow phase

Phase	Skills
Setup / ROE	msf-harness, pentest-workflow
Recon	msf-recon, then service skills by port
Modeling	methodology-cheatsheets
Exploitation	msf-exploit-chain, then vuln skills by class
Post-exploit	msf-post, then platform skills (windows/linux/macos)
Pivoting	pivoting-pentest
Evasion / OPSEC	red-team-evasion
Persistence	persistence-pentest
Initial access	initial-access-pentest
Reporting	reporting-pentest

Skill catalog

57 skills across 5 tiers. See skill-catalog.yaml for full listing.

python .cursor/skills/pentest-knowledge-base/scripts/generate-skills.py --list

Related skills

• pentest-workflow - phase/gate orchestration
• msf-harness - MCP tool surface and setup
• msf-recon - reconnaissance workflow
• msf-exploit-chain - exploit workflow
• msf-post - post-exploitation workflow
• methodology-cheatsheets - cross-cutting methodology and shell references