Asserts

An assert is the pass or fail test on a step’s response. It is how the runtime decides whether the attack worked. Each step can carry one; a step without an expect never fails.

There are five kinds of test.

contains: does the response contain this text?

expect "0e000000" in the response

Passes when the response contains the exact text. Use it when a specific marker proves the attack worked. For tcp, tls, and websocket steps the response is read as hex, so the marker is hex too; 0e000000 is the TLS ServerHelloDone message. For http and https the response is the full exchange: the status line and headers of every response in the redirect chain, then the body, so a marker in a redirect Location header is assertable.

regex: does the response match this pattern?

expect the response to match "18030[123]40"

Passes when the response matches a pattern. Patterns are more flexible than exact text: this one matches 18030140 or 18030240, either TLS version. Use a pattern when the response varies a little but stays recognizable.

flag: is there a flag in the response?

expect a flag

Passes when the response contains a flag-shaped string such as FLAG{...}. Use it when the attack should reach a flag file, as in a capture-the-flag lab.

oob: did the target phone home?

expect the target to call back "hit"

Passes when the target contacted an out-of-band listener that the run started. Use it for attacks that exfiltrate a value out of band, like Log4Shell: the target makes a request back to a listener we control, and the test checks that the callback arrived. When the callback is an HTTP POST whose body carries exfiltrated data (a command output, a token), the report line for the step shows that body:

forge  PASS  oob "/result/exm" body "command\goldendivider"

empty: did the target stop responding?

expect no response

Passes when the response is empty, which happens when the target never answers. Use it for denial of service: send the crashing payload, then confirm the service is gone by checking that a follow-up request gets nothing back.

A # comment next to an expect explains what passing means; comment lines never affect the run.

expect "49" in the response
# the renderer evaluated the template

The authoring guide shows each assert in a real scenario.