Asserts

An assert is the pass or fail test on a step’s response. It is how the runtime decides whether the attack worked. Each step can carry one; a step without an assert never fails.

There are five kinds of test.

contains: does the response contain this text?

assert: contains "0e000000"

Passes when the response contains the exact text. Use it when a specific marker proves the attack worked. For tcp, tls, and websocket steps the response is read as hex, so the marker is hex too; 0e000000 is the TLS ServerHelloDone message. For http and https the response is the full exchange: the status line and headers of every response in the redirect chain, then the body, so a marker in a redirect Location header is assertable.

regex: does the response match this pattern?

assert: regex "18030[123]40"

Passes when the response matches a pattern. Patterns are more flexible than exact text: this one matches 18030140 or 18030240, either TLS version. Use a pattern when the response varies a little but stays recognizable.

flag: is there a flag in the response?

assert: flag

Passes when the response contains a flag-shaped string such as FLAG{...}. Use it when the attack should reach a flag file, as in a capture-the-flag lab.

oob: did the target phone home?

assert: oob "hit"

Passes when the target contacted an out-of-band listener that the run started. Use it for attacks that exfiltrate a value out of band, like Log4Shell: the target makes a request back to a listener we control, and the test checks that the callback arrived.

empty: did the target stop responding?

assert: empty

Passes when the response is empty, which happens when the target never answers. Use it for denial of service: send the crashing payload, then confirm the service is gone by checking that a follow-up request gets nothing back.

A note on each test

Every assert can carry a note line: a plain-language explanation of what passing means. The runtime prints it with the step result, so a reader sees why the step mattered.

assert: contains "49"
note: the renderer evaluated the template

The authoring guide shows each assert in a real scenario.