# Our Features

Canonical: https://hackergpt.org/features/

Point HackerGPT at your own website: map it, see what is exposed, learn how to fix it, and learn how attackers think while you do.

## What HackerGPT Does

[

### AppMap

Crawls your app into a state graph of pages, login screens and dead ends, and lists every API endpoint with the auth it requires. Export it to Postman or OpenAPI in one click.

For: Site owners and pentesters who need to see the whole attack surface

](https://hackergpt.org/features/appmap/)

[

### CTF Mode

Run a CTF on your own website: HackerGPT works through it the way a CTF player would, step by step, and explains every move. It also helps you solve the CTF challenges you bring.

For: CTF players and students

](https://hackergpt.org/features/ctf-mode/)

[

### Ask anything

Answers the security questions general-purpose models refuse, about attack techniques, tooling and methodology, and explains the reasoning behind each answer.

For: Pentesters and learners tired of refusals

](https://hackergpt.app)

[

### OSINT

Start from a domain name or a token and see what public sources reveal about it, so you know what an attacker could learn before they look.

For: Site owners and pentesters in the recon phase

](https://hackergpt.app)

[

### Learn on a real target

Learn hacking by testing your own site instead of a synthetic lab. Every finding comes with why it matters and how to fix it.

For: Learners and indie founders

](https://hackergpt.app)

[

### CyberGym

A legal, deliberately vulnerable practice target at cybergym.hackergpt.app. Practice there when you don't have a site of your own to test.

For: Anyone practicing offensive security

](https://cybergym.hackergpt.app)

### How It Works

1. 1

   #### Point it at your site

   Give HackerGPT the URL of a site you own or have written permission to test.

2. 2

   #### See the map

   AppMap shows the pages, logins and API endpoints it found.

3. 3

   #### Get findings and fixes, and learn why

   Each finding comes with how to fix it and an explanation of how the attack works.

Test only sites you own or have written permission to test. To practice without one, use [CyberGym](https://cybergym.hackergpt.app).