Skip to content

https

The https identity: HTTP over TLS. Every directive and what is required.

https is HTTP over TLS (RFC 2818). It uses the http directives: a method directive (get/post) plus with the header, with the cookie, capture, and expect. The target is a base URL with an https:// scheme. The http identity also covers both schemes, so a plain http solution works against an https target; https exists so a solution can name the secure scheme explicitly.

Example

https reflect
  get with "REFLECTED_7x7"
  # send a unique marker and confirm it comes back over TLS
  expect "REFLECTED_7x7" in the response

Give exploit research a common language.

Bring a PoC, a writeup, or an AI-generated draft into an Exploitmatic solution: inspect it, validate it, and replay it against a target you own. The runtime and the corpus are open source.

Read the docs Why Exploitmatic?