Scope and ethics
Use it against targets you own
Exploitmatic is an offensive-security tool. It replays attack techniques against targets. Use it only against systems you own or are authorized to test.
Replica workflow
Refine the solution against a local replica of the vulnerable surface, then verify against an authorized target. A result from a replica is a hypothesis refinement. A result from an authorized target is a finding.
Host scope
Host-level steps (process, file) reach into the operator's own host. They are not gated: the runtime runs on your machine because you started it. A sandboxed scanner cannot reach this scope at all.
Honest findings
The runtime prints what was sent and received; it does not claim a target is secure. The wording is verified against corpus, never secure. Solutions stay deterministic where possible, with honest reproducibility stats for probabilistic solutions, never a false finding.
Two stages, two kinds of results
The workflow has two stages: build a local replica of the vulnerable surface, refine the solution against it, then verify against an authorized target. A solution refined in a replica before the strike is more likely to work when it matters, and the runtime prints what was sent and received so the result is checkable, not claimed.
License
The runtime is AGPL-3.0. The attack solutions (the .txt files) in the solutions repository are Apache-2.0.
Start with a replica
Refine a solution against a local vulnerable container, then verify it against an authorized target.