# CTF Mode: run a CTF on your own website

Canonical: https://hackergpt.org/features/ctf-mode/

Point CTF Mode at your own website and HackerGPT works through it the way a CTF player would, step by step, explaining every move. It also helps you solve the CTF challenges you bring.

## What it does

Most people learn offensive security on synthetic labs, then face a real application and find the gap between knowing a technique and applying it. CTF Mode closes that gap on a target that matters to you: your own site, or CyberGym when you do not have one.

Instead of answering in the abstract, HackerGPT works the target. It drives a headless browser, watches the HTTP traffic going in and out, sends probing requests and adjusts what it tries next to how the application actually responds. Every step comes with the reasoning behind it, so you learn the method, not just the result.

CTF Mode is also there for the CTF challenges you bring: work through a challenge with HackerGPT and see why each step makes sense.

## How it works

1. ### Choose a legal target

   Your own website, a site you have written permission to test, CyberGym, or a CTF challenge you are entered in.

2. ### Say what to look for

   Ask a focused question, for example to check the search function of your site for injection, or hand it the challenge description.

3. ### It works the target in a headless browser

   HackerGPT maps the part of the app in question, sends probing requests and reads the responses and the traffic, explaining each move as it goes.

4. ### Steer it while it works

   Send more context or a correction while it is still working, without stopping the run. What it has learned about the target is kept in the Memory tab.

5. ### Keep what worked

   Inputs that made the application behave unexpectedly are saved in the Payloads section, so you can retrieve, change and replay those requests.

## Who it is for

- **CTF players.** Work through a challenge with an assistant that explains its reasoning, so the next challenge goes faster without it.
- **Students and learners.** Learn attack techniques on a real application rather than a slide, with each step explained, on your own site or on CyberGym.
- **Site owners.** See how someone working a CTF would approach your own website, and what to fix in what they find.

## What you get

- A step-by-step walkthrough of the target, with the reasoning behind each move
- A Payloads section holding the requests that made the application behave unexpectedly, ready to replay
- A Memory tab that keeps what was learned about the target across the session
- The ability to steer the work mid-run instead of starting over
- For findings on your own site, an explanation of how the attack works and how to fix it

## Legal targets only

Test only sites you own or have written permission to test. To practise without one, use CyberGym, a legal, deliberately vulnerable target. [Practise on CyberGym](https://cybergym.hackergpt.app).

## FAQ

### What does “run a CTF on your own website” mean?

It means treating your own site as the target of a capture-the-flag exercise: HackerGPT works through it the way a CTF player would, step by step, and explains each move. You learn the techniques on an application you know, and you see what an attacker would see.

### Can I use CTF Mode on any website?

No. Use it only on a site you own, a site you have written permission to test, or a CTF challenge you are entered in. To practise without a site of your own, use CyberGym at cybergym.hackergpt.app, a legal, deliberately vulnerable target.

### Can I use CTF Mode in a CTF competition?

Check the competition's rules first. Some allow AI assistants and some do not, and the rules of the event you entered decide. CTF Mode is built for learning, so the explanations are the point, not only the flag.

### What are the Payloads section and the Memory tab?

The Payloads section stores the inputs that made the application behave unexpectedly, such as a database error or reflected input, so you can retrieve, modify and replay those requests. The Memory tab keeps what was learned about the target during the session, so you do not have to repeat it in every message.

### Do I need CTF experience to start?

No. Each step is explained as it happens, so CTF Mode works as a way to learn. A good first target is CyberGym, where you can practise without any risk to a real site.

### Does CTF Mode find every vulnerability?

No tool does. CTF Mode reports what it found and how it found it. Findings are findings: what it did not find is not proof that it is not there.

[Try CTF Mode on HackerGPT](https://hackergpt.app)

## Related

- [HackerGPT 0.5.0: Advancing Applied Security Training with CTF Mode](https://hackergpt.org/blog/hackergpt-050-advancing-applied-security-training-with-ctf-mode/)
- [HackerGPT 0.5.7: Stateful CTF Engagements, Concurrent Steering, and Decoupled Browsing](https://hackergpt.org/blog/hackergpt-update-stateful-ctf-engagements-concurrent-steering-and-decoupled-browsing/)
- [AppMap: see the whole attack surface of your web app](https://hackergpt.org/features/appmap/)