FAQ

Short answers to the questions that come up most. Each one links to the page that goes deeper.

Do I need to know how to program?

No. A solution is a plain text file, one instruction per line. Lines that start with # are comments, and everything else is a name: value line. The authoring guide walks you from a one-step file to a full attack, and every stage ends with a checkpoint.

Is Exploitmatic a scanner?

No. It replays one documented attack against one target. It does not crawl, discover, or sweep a network. Think of it as a verified replay of a known technique, not a discovery tool.

What can I run it against?

Only systems you own or are authorized to test. See Scope and ethics for the rules, including the replica workflow: refine against a local replica first, then verify against an authorized target.

What does the runtime print?

One line per step, then a result line. Each step line shows the step name, whether the test passed, and which test ran. There is no artifact file; the console output is the result.

Why a plain text format and not JSON?

So the file reads like a checklist, not markup. There is no syntax to remember, comments are allowed, and diffs stay clean. The format stays strict where it matters: the runtime validates required fields and hex at load time and refuses to run a bad file.

What are host steps?

Steps that run commands or read files on your own machine, such as reading the flag file a lab writes. They run like any other step; the tool runs on your host. See Usage.

Can I describe an attack in natural language?

Yes, through an LLM. The runtime itself takes a .txt file only, and that is the point: the file is exact, reviewable, and deterministic. Describe the attack in your own words, have an LLM draft the .txt file from the format reference, review the file, then run it.

Can I write my own solutions?

Yes. Start with the authoring guide, read the worked example in Solutions overview, and use the solutions as reference implementations.