A Security Tool for Bug Bounty, Pentest and Red Teaming

English • 中文

What is afrog

afrog is a high-performance security scanning toolkit built for bug bounty, pentest, and red team workflows. It combines fast target probing, built-in vulnerability checks, custom PoC authoring, and SDK-driven automation in a single Go-based workflow.

What afrog does

• Fast and focused scanning for web targets and network services
• Built-in and custom PoC support for practical security validation
• Lower false-positive noise through precise rule design and checks
• Flexible integration with Go applications, automation flows, and private PoC pipelines

Install

Dependencies

• Go 1.27 or later

Binary release

Download the latest release from:

• https://github.com/zan8in/afrog/releases/latest

Build from source

git clone https://github.com/zan8in/afrog.git
cd afrog
go mod tidy
go build -o afrog cmd/afrog/main.go
./afrog -h

Go install

go install -v github.com/zan8in/afrog/v3/cmd/afrog@latest

Quick start

Scan a single target:

afrog -t https://example.com

Scan multiple targets from a file:

afrog -T targets.txt

Run only high and critical checks:

afrog -T targets.txt -S high,critical

Start the built-in web console (open http://127.0.0.1:16868 in a browser and sign in with the password printed to the terminal):

afrog -web

Documentation

The documentation is organized into five handbooks:

PoC Contributors

Community

To join the afrog WeChat discussion group, add the afrog account and mark it as afrog.

404Starlink

afrog is part of 404Starlink.

Disclaimer

This tool is intended only for legally authorized security work. Do not scan unauthorized targets. The user is solely responsible for any misuse or illegal activity.