Overview

Every step speaks a protocol. That protocol is the step’s identity, and it decides three things: what the step sends, which properties the step can use, and what shape the target takes.

A solution can mix protocols freely. One attack might start with a TLS handshake, follow with an HTTP request, and end with a read from the host. Each step result shows the protocol it used.

On a step

tls malformed-heartbeat
  meaning: send a heartbeat request claiming a payload length with zero payload bytes
  send: 1803030003014000
  recv: 70000
  assert: regex "18030[123]40"

The fields that apply depend on the protocol. http and https read encoding, payload, path, and headers; the byte-session protocols (tcp, tls, ssh, ftp, smtp, ldap, redis, mysql, postgresql, smb, telnet, and dns and snmp over UDP) plus websocket read send, recv, recv_until, and timeout; process reads command and cwd; file reads op, path, and data. Each protocol page below details its own fields. See Steps for the full step form and the authoring guide for worked scenarios.

The supported protocols

These are the identities the runtime handles today, grouped by use. Each links to its page with the full field detail.

Web and application

Identity	Protocol	Target
http	Hypertext Transfer Protocol	base URL
https	HTTP over TLS	base URL
websocket	WebSocket Protocol	base URL

Transport, encryption, and security

Identity	Protocol	Target
tcp	Transmission Control Protocol	host:port
tls	Transport Layer Security	host:port
ssh	Secure Shell	host:port

Remote access and file sharing

Identity	Protocol	Target
telnet	Telnet Protocol	host:port
ftp	File Transfer Protocol	host:port
smb	Server Message Block	host:port

Mail and directory

Identity	Protocol	Target
smtp	Simple Mail Transfer Protocol	host:port
ldap	Lightweight Directory Access Protocol	host:port

Network services and databases

Identity	Protocol	Target
dns	Domain Name System	host:port
snmp	Simple Network Management Protocol	host:port
redis	Redis Serialization Protocol	host:port
mysql	MySQL Client/Server Protocol	host:port
postgresql	PostgreSQL Wire Protocol	host:port

Host

Host-level identities. They are not protocols; they name the operator’s own host as the surface.

Identity	Protocol	Target
process		ignored
file		ignored