# Hack the Gap, Learn the Skills

Canonical: https://hackergpt.org/

HackerGPT is an AI agent that pentests your own website, shows you what is exposed, explains how to fix it, and teaches you hacking while it does the work.

[Try HackerGPT](https://hackergpt.app)

[See the Features](https://hackergpt.org/#features)

## What HackerGPT Does

[

### AppMap

Crawls your app into a state graph of pages, login screens and dead ends, and lists every API endpoint with the auth it requires. Export it to Postman or OpenAPI in one click.

For: Site owners and pentesters who need to see the whole attack surface

](https://hackergpt.org/features/appmap/)

[

### CTF Mode

Run a CTF on your own website: HackerGPT works through it the way a CTF player would, step by step, and explains every move. It also helps you solve the CTF challenges you bring.

For: CTF players and students

](https://hackergpt.org/features/ctf-mode/)

[

### Ask anything

Answers the security questions general-purpose models refuse, about attack techniques, tooling and methodology, and explains the reasoning behind each answer.

For: Pentesters and learners tired of refusals

](https://hackergpt.app)

[

### OSINT

Start from a domain name or a token and see what public sources reveal about it, so you know what an attacker could learn before they look.

For: Site owners and pentesters in the recon phase

](https://hackergpt.app)

[

### Learn on a real target

Learn hacking by testing your own site instead of a synthetic lab. Every finding comes with why it matters and how to fix it.

For: Learners and indie founders

](https://hackergpt.app)

[

### CyberGym

A legal, deliberately vulnerable practice target at cybergym.hackergpt.app. Practice there when you don't have a site of your own to test.

For: Anyone practicing offensive security

](https://cybergym.hackergpt.app)

### How It Works

1. 1

   #### Point it at your site

   Give HackerGPT the URL of a site you own or have written permission to test.

2. 2

   #### See the map

   AppMap shows the pages, logins and API endpoints it found.

3. 3

   #### Get findings and fixes, and learn why

   Each finding comes with how to fix it and an explanation of how the attack works.

Test only sites you own or have written permission to test. To practice without one, use [CyberGym](https://cybergym.hackergpt.app).

## Documentation

- ### [HackerGPT Docs](https://hackergpt.org/docs/)

  Quick start guide and documentation for HackerGPT

- ### [CyberGym](https://cybergym.hackergpt.app)

  Deliberately vulnerable apps set up for everyone to practice offensive security. Full permission is granted to perform hacking/intrusion/compromise of applications in scope.

- ### [Blog](https://hackergpt.org/blog/)

  Articles on offensive security, methodology and how HackerGPT works

## Latest Insights

- [Secrun: let HackerGPT run commands on your own machine](https://hackergpt.org/blog/secrun-run-commands-on-your-machine)

  Secrun is a small binary you download from a HackerGPT CTF session. While it runs, the commands the model chooses execute on your Linux or macOS machine, with your tools and your network. How to install it, approve it on macOS, and run it safely.

- [IDOR vulnerability example: find it and fix it](https://hackergpt.org/blog/idor-vulnerability-example)

  What an IDOR is, shown on the real basket handler of CyberGym, a deliberately vulnerable training app, then reproduced and fixed in a small local Express app with two users.

## Our Team

- ### Luca Distefano

  Security Researcher

- ### David S. Harris, Esq.

  Chief Legal Officer

- ### Shreeram Gudemaranahalli Subramanya

  Business Development and Outreach

- ### Oleg Spiridonov

  Product Manager

## Contact Us

Have questions or need assistance? We're here to help!

[support@hackergpt.app](mailto:support@hackergpt.app)