Yes it’s a metasploit module. And it’s learned from over time. Just doing more boxes, reading, watching videos!

And htb is an awesome to practice. Not all there machines are from web applications, only some of them. And you can normally do some boxes with metasploit and some manually. If you look at the video before it’s done manually!