Skip to content
[ 18 protocols ] [ portable binary ]

Turn plain text into an attack .

Exploitmatic replays a documented attack from a plain text file, runs an assertion on every step, and prints the result. No scanner. No template engine. Portable binary.

Get started How it works Read the docs

Open source · AGPLv3 · Run it only against targets you own or are authorized to test

exploitmatic heartbleed-mem-leak.txt 127.0.0.1:8443

Exploitmatic replays Heartbleed (CVE-2014-0160) against a vulnerable OpenSSL server and prints 2/2 verified.

How it works

A documented attack, replayed and verified

Exploitation comes first, and the verification is what proves it worked.

01

Write a solution

A plain text file describes the attack, step by step. A human reads it like a checklist; an LLM can write it from the same grammar.

02

Replay it

Point the runtime at one target. It speaks the protocol, sends each payload, reads the response, and keeps the session alive across steps.

03

Verify the result

Every step ends with an assert. The runtime prints one line per step and a result: verified when the attack worked, not verified when it did not.

A solution is plain text

Read it like a checklist

Header lines name the attack. Each block after that is one step: an identity and a name, then key: value lines, then an assert, the pass or fail test. No code to write, no markup to learn.

This is the real Heartbleed solution from the corpus. The full corpus, the grammar, and the authoring guide live in the documentation.

How the format works
heartbleed-mem-leak.txt text 
id: openssl/heartbleed-mem-leak
summary: CVE-2014-0160 Heartbleed
ref: CVE-2014-0160

tls clienthello-heartbeat
  send: 1603030125010001210303...
  recv_until: 0e000000
  recv: 65536
  assert: contains "0e000000"

tls malformed-heartbeat
  send: 1803030003014000
  recv: 70000
  assert: regex "18030[123]40"

Features

What you get

A PoC runner, not a scanner: replay a known technique against one target and get an honest, derived result.

Eighteen protocols

HTTP, HTTPS, WebSocket, TLS, TCP, SSH, FTP, SMTP, DNS, LDAP, Redis, MySQL, PostgreSQL, SMB, Telnet, SNMP, plus process and file steps on your host.

Plain text, no YAML

Line-based files: one instruction per line, comments with #, strict validation at load. No aliases, no anchors, no YAML CVEs.

Data, never code

A solution is bytes in, bytes out, and tests over the response. No template engine, no injected interpreter, no arbitrary-code supply chain.

Built for LLMs

A closed grammar, a deterministic runtime, and clean result lines. Describe an attack, let an LLM draft the file, review it, run it.

Portable binary

A portable binary with no dependencies to install. Download it from the releases page and run it. No installer, no toolchain.

Out-of-band callbacks

A built-in OOB listener catches the callback behind Log4Shell-style attacks, and capture lets a solution follow server-assigned values.

Protocols

Eighteen protocols, one grammar

The identity of a step is the protocol it speaks, from the IANA/STIX vocabulary. These are the eighteen found most often in real exploits.

See the full feature list

Blog

From the blog

Writeups, protocol deep dives, and the ideas behind attacks written down as data.

plasma plasma 
###%%%%%%%###**+++==---:::::::---===++******
%%@@@@@@@@@%%%##**++==----::::::---===+++**#
%%%@@@@@@@@@@@%%##**++===----------====+++**
**####%%%%%%%###**+===-------------=====++++
=====++++++++===-::.     ...:::-----=======+
:::::::::::::::...        ...:::----========
::...........           ....::---===+++++***
==------::::::..........:::--===++**###%%%%%
#######*****++++==========+++**##%%@@@@@@@@@
designformatllm

Attacks as data: why a plain text format beats a script

Exploitmatic formalizes the hand-rolled replay script with a grammar. A solution is data, never code: no supply chain, a deterministic run, and a result that comes from the tests.

Read post
heartbeat heartbeat 
                                            
                                            
                                            
                                            
:::-=@@@@@-::::::=@@@@@@@@@@@@@@@@@@@@@@@@@@
:=-.      .@    @                           
            -*+-
replicaheartbleedtls

Build a vulnerable Heartbleed lab in minutes

A local Docker replica of OpenSSL 1.0.1c with nginx, and a replay of the Heartbleed solution that prints 2/2 verified.

Read post
tunnel tunnel 
...:::::.........:::::...       .::-------::
==--:..     ..:--==+++==--:::::::..::::---=-
-:::::-====--:.  ..:--:.   .:-=++++=-:..  ..
   .:--==-----====-=#%*==*#*+-:. ..::::.    
   .:--::.  .:-===-:. ==+*###*=--:-==+==-::.
::::-=+++=-::..::-+#%+=+#%*=:.   .:--=--:...
-:.....:::::::::---::    .:--====--:..     .
:::..     ..:-==++==--::::-------::.....::::
  ..:::-----:::::...        ..::---====--::.
protocolsidentitydesign

Eighteen protocols, one grammar

A step's identity is the protocol it speaks, from the IANA/STIX vocabulary. A closed grammar keeps every protocol expressible as the same plain text shape.

Read post

All posts

FAQ

Quick answers

Is Exploitmatic a scanner?

No. It replays one documented attack against one target. It does not crawl, discover, or sweep a network.

Do I need to know how to program?

No. A solution is a plain text file, one instruction per line, with # comments and name: value lines.

Can I describe an attack in natural language?

Yes, through an LLM. The runtime takes a .txt file only, and that is the point: the file is exact, reviewable, and deterministic.

All questions and answers

Write attacks down. Verify them.

Download the binary, point it at a target you own, and get a verified result. The corpus is open and the format is plain text.

Get started Read the docs