Attack surface mapping: find what your own app exposes

Your attack surface is everything a visitor can reach: pages, login flows, API endpoints, open ports and the services behind them. You cannot test what you have not found, so mapping it comes before any vulnerability check.

The articles here show how to list the endpoints of your own web app and record the authentication each one checks, how to scan the open ports of your own server, and which reconnaissance tools HackerGPT runs for each step. The worked examples run against CyberGym, a legal practice target.

AppMap crawls your app into a state graph of pages, logins and dead ends, lists every API endpoint with the auth it requires, and exports the map to Postman or OpenAPI.

Articles

• Map a web app's attack surface before you test it

  Before you test your own app, map what is actually exposed: the page states behind each login, every API endpoint, and the auth each one expects. A worked example on CyberGym.

• Scanning & Reconnaissance Tools

  Master the mechanics of network reconnaissance. Learn how to operationalize subdomain enumeration, Nmap scanning, and service fingerprinting for effective exposure management.

• How to check the open ports on your own server, by hand or with an AI agent

  Find out which ports your own server exposes to the internet: the scan types that matter, what SYN and connect scans each tell you, and the real output of a scan of CyberGym.