Overview

The protocol a step speaks, and the full vocabulary the runtime understands.

Every step speaks a protocol. That protocol is the step’s identity, and it decides three things: what the step sends, which directives the step can use, and what shape the target takes.

A solution can mix protocols freely. One attack might start with a TLS handshake, follow with an HTTP request, and end with a read from the host. Each step result shows the protocol it used.

On a step

tls malformed-heartbeat
  # send a heartbeat request claiming a payload length with zero payload bytes
  send hex "1803030003014000"
  receive 70000 bytes
  expect the response to match "18030[123]40"

The directives that apply depend on the protocol. http and https take a method directive (get/post, plus with the header, with the cookie, expect, capture); the byte-session protocols (tcp, tls, ssh, ftp, smtp, ldap, redis, mysql, postgresql, smb, telnet, and dns and snmp over UDP) plus websocket take send, receive, receive until, and timeout; process takes run; file takes read or write. Each protocol page below details its own directives. See Steps for the full step form and the authoring guide for worked scenarios.

The supported protocols

These are the identities the runtime handles today, grouped by use. Each links to its page with the full directive detail.

Web and application

Identity	Protocol	Target
`http`	Hypertext Transfer Protocol	base URL
`https`	HTTP over TLS	base URL
`websocket`	WebSocket Protocol	base URL

Transport, encryption, and security

Identity	Protocol	Target
`tcp`	Transmission Control Protocol	`host:port`
`tls`	Transport Layer Security	`host:port`
`ssh`	Secure Shell	`host:port`

Identity	Protocol	Target
`telnet`	Telnet Protocol	`host:port`
`ftp`	File Transfer Protocol	`host:port`
`smb`	Server Message Block	`host:port`

Mail and directory

Identity	Protocol	Target
`smtp`	Simple Mail Transfer Protocol	`host:port`
`ldap`	Lightweight Directory Access Protocol	`host:port`

Network services and databases

Identity	Protocol	Target
`dns`	Domain Name System	`host:port`
`snmp`	Simple Network Management Protocol	`host:port`
`redis`	Redis Serialization Protocol	`host:port`
`mysql`	MySQL Client/Server Protocol	`host:port`
`postgresql`	PostgreSQL Wire Protocol	`host:port`

Host

Host-level identities. They are not protocols; they name the operator’s own host as the surface.

Identity	Protocol	Target
`process`		ignored
`file`		ignored