A Security Tool for Bug Bounty, Pentest and Red Teaming

English • 中文

What is afrog

afrog is a high-performance security scanning toolkit built for bug bounty, pentest, and red team workflows. It combines fast target probing, built-in vulnerability checks, custom PoC authoring, and SDK-driven automation in a single Go-based workflow.

What afrog does

• Fast and focused scanning for web targets and network services
• Built-in and custom PoC support for practical security validation
• Lower false-positive noise through precise rule design and checks
• Flexible integration with Go applications, automation flows, and private PoC pipelines

Install

Dependencies

• Go 1.27 or later

Binary release

Download the latest release from:

• https://github.com/zan8in/afrog/releases/latest

Build from source

git clone https://github.com/zan8in/afrog.git
cd afrog
go mod tidy
go build -o afrog cmd/afrog/main.go
./afrog -h

Go install

go install -v github.com/zan8in/afrog/v3/cmd/afrog@latest

Quick start

Scan a single target:

afrog -t https://example.com

Scan multiple targets from a file:

afrog -T targets.txt

Run only high and critical checks:

afrog -T targets.txt -S high,critical

Start the built-in web console (open http://127.0.0.1:16868 in a browser and sign in with the password printed to the terminal):

afrog -web

Documentation

The documentation is organized into five handbooks:

PoC Contributors

不动明王	雪山	White-hua	123456	ifofor	Air	执着	purple-WL	throat
Secx	冰河	Sheen	a16	A1	rainbow2972	wuha0926	茄子	lei_sec
G-H-Z	wh1te	清月	york	7eleven.eth	Double...	ICEY_	lazy	free2e
m4sk	沉默树人	陈麻子	leonardo-o1	江湖人称魏...	若兮风	-sudo	Cuerz	laohuan12138
exp0l0zzz	1derian	CMDB-M	li1u	oxsonder	Zhiliao	段	HuiTaiL	Miracles666
Observer	黑熊	TryA9ain	fgz00	Y3y1ng	二大爷	Wans	海边的小米粥	Wen
SULAB	ZacharyZcR	Superhero	k5rC85Lma

Community

To join the afrog WeChat discussion group, add the afrog account and mark it as afrog.

404Starlink

afrog is part of 404Starlink.

Disclaimer

This tool is intended only for legally authorized security work. Do not scan unauthorized targets. The user is solely responsible for any misuse or illegal activity.