# Overview

> The protocol a step speaks, and the full vocabulary the runtime understands.

Every step speaks a protocol. That protocol is the step's `identity`, and it decides three things: what the step sends, which directives the step can use, and what shape the target takes.

A solution can mix protocols freely. One attack might start with a TLS handshake, follow with an HTTP request, and end with a read from the host. Each step result shows the protocol it used.

## On a step

```text
tls malformed-heartbeat
  # send a heartbeat request claiming a payload length with zero payload bytes
  send hex "1803030003014000"
  receive 70000 bytes
  expect the response to match "18030[123]40"
```

The directives that apply depend on the protocol. `http` and `https` take a method directive (`get`/`post`, plus `with the header`, `with the cookie`, `expect`, `capture`); the byte-session protocols (`tcp`, `tls`, `ssh`, `ftp`, `smtp`, `ldap`, `redis`, `mysql`, `postgresql`, `smb`, `telnet`, and `dns` and `snmp` over UDP) plus `websocket` take `send`, `receive`, `receive until`, and `timeout`; `process` takes `run`; `file` takes `read` or `write`. Each protocol page below details its own directives. See [Steps](/docs/solution/steps/) for the full step form and the [authoring guide](/docs/guides/authoring/) for worked scenarios.

## The supported protocols

These are the identities the runtime handles today, grouped by use. Each links to its page with the full directive detail.

### Web and application

| Identity | Protocol | Target |
| --- | --- | --- |
| [`http`](/docs/solution/identity/http/) | Hypertext Transfer Protocol | base URL |
| [`https`](/docs/solution/identity/https/) | HTTP over TLS | base URL |
| [`websocket`](/docs/solution/identity/websocket/) | WebSocket Protocol | base URL |

### Transport, encryption, and security

| Identity | Protocol | Target |
| --- | --- | --- |
| [`tcp`](/docs/solution/identity/tcp/) | Transmission Control Protocol | `host:port` |
| [`tls`](/docs/solution/identity/tls/) | Transport Layer Security | `host:port` |
| [`ssh`](/docs/solution/identity/ssh/) | Secure Shell | `host:port` |

### Remote access and file sharing

| Identity | Protocol | Target |
| --- | --- | --- |
| [`telnet`](/docs/solution/identity/telnet/) | Telnet Protocol | `host:port` |
| [`ftp`](/docs/solution/identity/ftp/) | File Transfer Protocol | `host:port` |
| [`smb`](/docs/solution/identity/smb/) | Server Message Block | `host:port` |

### Mail and directory

| Identity | Protocol | Target |
| --- | --- | --- |
| [`smtp`](/docs/solution/identity/smtp/) | Simple Mail Transfer Protocol | `host:port` |
| [`ldap`](/docs/solution/identity/ldap/) | Lightweight Directory Access Protocol | `host:port` |

### Network services and databases

| Identity | Protocol | Target |
| --- | --- | --- |
| [`dns`](/docs/solution/identity/dns/) | Domain Name System | `host:port` |
| [`snmp`](/docs/solution/identity/snmp/) | Simple Network Management Protocol | `host:port` |
| [`redis`](/docs/solution/identity/redis/) | Redis Serialization Protocol | `host:port` |
| [`mysql`](/docs/solution/identity/mysql/) | MySQL Client/Server Protocol | `host:port` |
| [`postgresql`](/docs/solution/identity/postgresql/) | PostgreSQL Wire Protocol | `host:port` |

### Host

Host-level identities. They are not protocols; they name the operator's own host as the surface.

| Identity | Protocol | Target |
| --- | --- | --- |
| [`process`](/docs/solution/identity/process/) | | ignored |
| [`file`](/docs/solution/identity/file/) | | ignored |