Installation

You need three things to use Exploitmatic: the program, a solution file, and a target you own or are authorized to test. You do not need to know how to program.

Pre-1.0 compatibility. Exploitmatic is released, but it is still pre-1.0, so full backward compatibility is not guaranteed until v1.0.0. Every release is a tagged binary on the releases page, and the changelog calls out breaking changes before you upgrade.

Get the program

Download the executable for your platform from the releases page. Each release ships one static binary per platform; there is no installer and no runtime dependency.

Rename it to exploitmatic (keep the .exe on Windows) and, on Linux and macOS, make it executable:

chmod +x exploitmatic

Put it on your PATH, or run it from the download folder. The first run may warn that the binary is unsigned: on Windows choose More info, then Run anyway; on macOS allow it in System Settings, Privacy and Security.

Check the install

Run the program with no arguments. It opens the desktop workbench, the GUI: a window for writing solutions, replaying them, and reading the result, with the runtime and an MCP server running in-app.

To use the command line instead, pass --cli. With no subcommand, --cli prints the help:

exploitmatic --cli

To check the version directly:

exploitmatic --version

A first run

The corpus ships verified solutions in the solutions/ folder. Replay the Heartbleed solution against a target on port 8443:

exploitmatic solutions/openssl-heartbleed-mem-leak.txt example.com:8443

What the command means:

• solutions/openssl-heartbleed-mem-leak.txt is the solution file, the attack to replay
• example.com:8443 is the target, a TLS server on port 8443

The program prints one line per step and a result: for each step, what it sent, what it received, and whether the step passed. When every step passes, the run is verified.

Next steps

• Usage: every argument and flag, and how to read the result
• The solution format: what a solution file is, in plain language
• Why Exploitmatic?: what the program is for and what it produces