AppMap: see the whole attack surface of your web app
AppMap crawls your app into a state graph of pages, login screens and dead ends, lists the API endpoints it reaches with the auth each one requires, and exports the result to Postman or OpenAPI in one click.
What it does
You cannot test an endpoint you never found, or reason about an authorization bug on a page you did not know existed. AppMap is the first step before testing: an inventory of what your app actually exposes.
A modern web app is not a list of URLs. The same route can render one way to a visitor and another to a signed-in user, and behind the pages sit the API calls that move the data. AppMap records both: the states of the app as a graph, and the endpoints behind them with the authentication each one expects.
The map is not a vulnerability report. It tells you where to look; the testing that follows, by you or by HackerGPT, decides what is actually wrong.
How it works
Point it at your app
Give AppMap the URL of a site you own or have written permission to test. No site of your own yet? Use CyberGym, the legal practice target.
It crawls the app into a state graph
Pages, login screens and dead ends become nodes in a graph, and the actions that move between them become edges, so the login boundary is visible rather than implied.
It lists the API endpoints and their auth
Each endpoint it reaches is listed with what it requires: nothing, a session, or more. That auth column is where access-control bugs tend to show up.
Export and test against it
Export the map to Postman or OpenAPI in one click, replay requests, test each endpoint deliberately, and run AppMap again after the next release.
Who it is for
- Site and app owners. Indie founders and small SaaS teams who want to see what their app exposes before someone else looks.
- Pentesters. A recon starting point: the states and endpoints of an in-scope app, exported to the tools you already use.
- Learners. See how a real web app is put together, page by page and endpoint by endpoint, on your own site or on CyberGym.
What you get
- A state graph of your app: pages, login screens and dead ends, and how they connect
- A list of the API endpoints AppMap reached, each with the authentication it requires
- A one-click export to a Postman collection or an OpenAPI description
- An inventory to test against and to regenerate after each release
Legal targets only
Test only sites you own or have written permission to test. To practise without one, use CyberGym, a legal, deliberately vulnerable target. Practise on CyberGym.
FAQ
What is AppMap?
AppMap is the part of HackerGPT that maps a web app. It crawls the app into a state graph of pages, login screens and dead ends, lists the API endpoints it reaches with the authentication each one requires, and exports the result to Postman or OpenAPI.
Does AppMap find every endpoint?
No map does. Endpoints the interface never calls, pages that appear only after a specific action and admin-only functions can stay hidden from a crawl. Treat the map as an inventory to test against, and as a record of what has not been reached yet.
Is AppMap a vulnerability scanner?
AppMap's job is the map: what is there and what each endpoint requires. Finding out what is actually wrong is the testing that comes next, which you can do yourself or with HackerGPT. Findings are findings; a clean map is not a statement that the app is secure.
Which export formats does AppMap support?
A Postman collection, to replay and modify requests, and an OpenAPI description, to compare against the API you meant to build. Both are one click.
Can I run AppMap on any website?
Only on a site you own or have written permission to test. Mapping someone else's app without permission is unauthorised access, whatever the intent. To practise, use CyberGym at cybergym.hackergpt.app, a deliberately vulnerable target published for exactly that.