# Exploitmatic

> Exploitmatic replays a documented attack from a plain text file, runs an assertion on every step, and prints a verified result. Open source, AGPLv3, portable binary.

Exploitmatic is an offensive-security tool and proof-of-concept runner. A solution is a plain text `.txt` file that describes an attack step by step: header lines name the attack, each block after that is one step (an identity and a name, `key: value` lines, and an assert), and the runtime replays the steps against one target, evaluates each assert, and prints one line per step plus a result. It is not a scanner. The runtime implements eighteen protocols (http, https, websocket, tls, tcp, ssh, ftp, smtp, dns, ldap, redis, mysql, postgresql, smb, telnet, snmp, process, file). Solutions are data, never code: no template engine, no arbitrary-code supply chain. The format is plain text so a human can read it and an LLM can write it. Use it only against targets you own or are authorized to test.

## Pages

- [Home](https://exploitmatic.com/): Landing page with a live Heartbleed demo and the value proposition.
- [Features](https://exploitmatic.com/features/): What Exploitmatic is, what it is not, outcomes, design principles, and host steps.
- [How it works](https://exploitmatic.com/how-it-works/): The plain text solution format, a worked Heartbleed example, and what a run reports.
- [Getting started](https://exploitmatic.com/getting-started/): Install the binary from the releases page and run your first replay.
- [Blog](https://exploitmatic.com/blog/): Writeups, protocol deep dives, and design posts. RSS at /rss.xml.
- [FAQ](https://exploitmatic.com/faq/): Answers to common questions about installing, running, and writing solutions.
- [Scope and ethics](https://exploitmatic.com/scope/): Authorized use, the replica workflow, and honest findings.
- [License](https://exploitmatic.com/license/): Dual licensing: AGPLv3 runtime, Apache 2.0 solution corpus.
- [Privacy](https://exploitmatic.com/privacy/): The runtime phones nothing home; the site tracks nothing.
- [Terms](https://exploitmatic.com/terms/): Authorized use only, open source, no warranty, no liability.

## External links

- [Documentation](https://exploitmatic.com/docs/): Full user documentation: installation, CLI reference, the solution format and grammar, and the verified corpus.
- [Runtime repository](https://github.com/exploitmatic/exploitmatic): Source, releases, and the AGPLv3 license.
- [Solution corpus](https://github.com/exploitmatic/solutions): Verified attack solutions as data, Apache 2.0.
- [RSS feed](https://exploitmatic.com/rss.xml): Blog posts as RSS.

## Key facts

- Command: `exploitmatic <solution.txt> <target> [flags]`
- Exit codes: 0 verified, 2 not verified, 1 error.
- Flags: `-param`, `-flag-path`, `-timeout`, `-oob-host`, `-oob-port`.
- Assert types: `contains`, `regex`, `flag`, `oob`, `empty`.
- Portable binary, no installer, no toolchain, no dependencies to install.
- Licensing: runtime AGPLv3 (commercial license available), corpus Apache 2.0.