Question 1

Do I need to know how to program?

Accepted Answer

No. A solution is a plain text file: header lines carry identity and reference, and each step is an identity and a name followed by English directives and an expect line. The authoring guide walks you from a one-step file to a full attack.

Question 2

Who is Exploitmatic for?

Accepted Answer

Security researchers, analysts, penetration testers, red teams, CTF players, engineers who regression-test patches, and builders of AI-agent workflows. If your job is replaying a known attack and proving it worked, that is the gap it fills.

Question 3

Is Exploitmatic an exploit framework?

Accepted Answer

No. There is no console and no module library. A solution is a data file that the runtime reads; nothing gets loaded or executed from the file. The trade is intentional: a text file is reviewable and diffable where a console session is not.

Question 4

Is Exploitmatic free?

Accepted Answer

Yes. The runtime and the solution corpus are open source under the Apache License 2.0. The binary is downloaded from the releases page.

Question 5

Is Exploitmatic a scanner?

Accepted Answer

No. It replays one documented attack against one target. It does not crawl, discover, or sweep a network. It is a verified replay of a known technique, not a discovery tool.

Question 6

How is Exploitmatic different from a hand-written replay script?

Accepted Answer

A replay script is ad hoc and different on every team. Exploitmatic formalizes it with one grammar, and the file is data, not code: reviewable, diffable, and writable by an LLM. The same file that verifies a vulnerable build regression-tests the fixed one.

Question 7

What are Exploitmatic's limitations?

Accepted Answer

It is not a scanner and one run is one target. It replays known attacks; it does not fuzz or find new ones. To check many hosts, loop the command line in a shell.

Question 8

Can I use Exploitmatic in CI to regression-test a patch?

Accepted Answer

Yes. That is the dual-use property: a solution that verifies a vulnerability on a vulnerable build is the same file that regression-tests the patch on a fixed build. The result line is a clean gate for a pipeline.

Question 9

Does Exploitmatic have a GUI?

Accepted Answer

Yes. Running exploitmatic with no arguments opens the desktop workbench, where you write solutions, replay them, and read the result, with the runtime and an MCP server running inside the app. Pass --cli or a subcommand for the command line, so scripts and CI can still drive it.

Question 10

What can I run it against?

Accepted Answer

Only systems you own or are authorized to test. The replica workflow applies: refine against a local replica first, then verify against an authorized target.

Question 11

What does the runtime print?

Accepted Answer

One line per step, then a result line. Each step line shows the step name, whether the test passed, and which test ran. There is no artifact file; the console output is the result.

Question 12

Why a plain text format and not JSON?

Accepted Answer

So the file reads like a checklist, not markup. There is no syntax to remember, comments are allowed, and diffs stay clean. The format stays strict where it matters: the runtime validates required fields and hex at load time and refuses to run a bad file.

Question 13

What are host steps?

Accepted Answer

Steps that run commands or read files on your own machine, such as reading the flag file a lab writes. They run like any other step; the tool runs on your host.

Question 14

Can I describe an attack in natural language?

Accepted Answer

Yes, through an LLM. The runtime itself takes a .txt file only, and that is the point: the file is exact, reviewable, and deterministic. Describe the attack in your own words, have an LLM draft the file, review it, then run it.

Question 15

Can I write my own solutions?

Accepted Answer

Yes. Start with the worked example, use the corpus as reference implementations, and verify each solution against a vulnerable replica before you contribute it.

Question 16

Is it open source?

Accepted Answer

Yes. The runtime and the solution corpus are Apache-2.0. The runtime is a portable binary downloaded from the releases page.

Quick answers

Give exploit research a common language.