Exploitmatic documentation
Install the runtime, write a solution in plain text, and replay a documented attack. Reference, guides, and the verified corpus.
Exploitmatic gives exploit research a common language. Exploit knowledge arrives as Python, C, Ruby, shell, notebooks, and AI agents; Exploitmatic brings it into one plain text representation, a solution file, that a human reads like a checklist and an LLM can write. The runtime validates the file, replays each step against one target, and prints a verified or not verified result. The product story and announcements live on the website; this section is the reference.
Get the program and run your first replay.
UsageEvery argument and flag, and how to read the result.
Solutions overviewWhat a solution file is, with a worked Heartbleed example.
Format referenceThe whole grammar on one page, for authors and LLMs.
Authoring guideBuild a solution from scratch, stage by stage.
Verified corpusWhat ships with the program and what each solution proves.
Start here
New to Exploitmatic? Take the path in order.
- Why Exploitmatic? - what it is and what it is not
- Installation - download the binary and verify it runs
- Solutions overview - read the worked example
- Usage - run your first replay against a target you own
- Scope and ethics - when and how to use an attack replay
Reference
- Steps - what a step holds, and the per-identity fields
- Variables - values that change between steps
- Asserts - the pass or fail tests
- Identity - the protocols the runtime implements
- Format reference - the whole grammar on one page
- FAQ - quick answers
Contribute
- Authoring solutions - write your own solution files
- Solutions - the verified corpus and how to add to it
- Development - build the runtime and run the tests