# Asserts

> How the runtime decides whether an attack worked: the pass or fail test on each response.

An assert is the pass or fail test on a step's response. It is how the runtime decides whether the attack worked. Each step can carry one; a step without an `expect` never fails.

There are five kinds of test.

## contains: does the response contain this text?

```text
expect "0e000000" in the response
```

Passes when the response contains the exact text. Use it when a specific marker proves the attack worked. For `tcp`, `tls`, and `websocket` steps the response is read as hex, so the marker is hex too; `0e000000` is the TLS ServerHelloDone message. For `http` and `https` the response is the full exchange: the status line and headers of every response in the redirect chain, then the body, so a marker in a redirect `Location` header is assertable.

## regex: does the response match this pattern?

```text
expect the response to match "18030[123]40"
```

Passes when the response matches a pattern. Patterns are more flexible than exact text: this one matches `18030140` or `18030240`, either TLS version. Use a pattern when the response varies a little but stays recognizable.

## flag: is there a flag in the response?

```text
expect a flag
```

Passes when the response contains a flag-shaped string such as `FLAG{...}`. Use it when the attack should reach a flag file, as in a capture-the-flag lab.

## oob: did the target phone home?

```text
expect the target to call back "hit"
```

Passes when the target contacted an out-of-band listener that the run started. Use it for attacks that exfiltrate a value out of band, like Log4Shell: the target makes a request back to a listener we control, and the test checks that the callback arrived. When the callback is an HTTP POST whose body carries exfiltrated data (a command output, a token), the report line for the step shows that body:

```text
forge  PASS  oob "/result/exm" body "command\goldendivider"
```

## empty: did the target stop responding?

```text
expect no response
```

Passes when the response is empty, which happens when the target never answers. Use it for denial of service: send the crashing payload, then confirm the service is gone by checking that a follow-up request gets nothing back.

A `#` comment next to an expect explains what passing means; comment lines never affect the run.

```text
expect "49" in the response
# the renderer evaluated the template
```

The [authoring guide](/docs/guides/authoring/) shows each assert in a real scenario.