Hi Peter. Somehow, the online manual weren't updated correctly. Fixed that one.
The exploit.log is used by Hiawatha to write requests which contain a possible exploit. You can use this to see if your website contains a vulnerability you aren't aware of. The location of the file can be changed via the ExploitLogfile option:
ExploitLogfile = /path/to/file.log