Features
A PoC runner, not a scanner
Exploitmatic replays one documented attack against one target. It does not crawl a network or sweep a fleet. The result tells you whether the attack worked.
One attack, one target
Exploitmatic is not a scanner. It does not crawl a network or sweep a fleet. You point it at one target with one documented attack, and the result tells you whether the attack worked. To run the same attack across many hosts, loop it in a shell.
It is a proof-of-concept runner: it turns a documented attack into a repeatable exploit run, and the verification is the built-in proof. It is also dual-use, so the same solution that verifies a vulnerability on a vulnerable build regression-tests a patch on a fixed build.
Outcomes
What a finished solution produces
Each one is a real example in the corpus.
Replay a memory leak
Run the Heartbleed solution against a TLS server and get a clear verified or not verified result.
Probe a reflection point
Send a marker into a web application and check it comes back, the first step of many template and injection attacks.
Read the flag
Read the flag file a lab writes, the finish line of a capture-the-flag exercise, with a flag assert.
Catch an OOB callback
Watch the out-of-band listener for the callback behind Log4Shell-style attacks and assert on what arrives.
Design
Why plain text
The format and the runtime are the product: no template engine, no dependency tree, no arbitrary-code supply chain.
Solutions are data, never code
A solution is hex in, hex out, and asserts over the response. Consumers never execute anything from a solution, so the corpus has no arbitrary-code supply chain: no template engine, no injected interpreter.
Plain text, no YAML
Line-based, one instruction per line, comments with #, validated at load. No aliases, no anchors, no YAML CVEs.
Deterministic and LLM-friendly
A file an LLM writes is exactly what runs, and the result lines give it a clean signal to fix and retry. A human reads a solution like a checklist.
Portable binary
A portable binary with no dependencies to install. No installer, no toolchain; run it anywhere.
Asserts
The pass or fail test
Every step ends with an assert: a substring check, a regex, a flag extract, an out-of-band callback, or an empty response for crash verification. The result comes from the tests, never from the file.
Host steps
Steps that touch your machine
process and file steps run commands and read or write files on your machine. This is the reach a sandboxed scanner does not have.
Ready to write your first solution?
The corpus is open and the format is plain text. Install the binary, pick a target you own, and replay a documented attack.