README.md

A Security Tool for Bug Bounty, Pentest and Red Teaming

English • 中文

What is afrog

afrog is a high-performance vulnerability scanner with support for built-in and custom PoCs. It is designed for fast verification, low false positives, and practical workflows across web targets, network services, PoC authoring, and SDK-based integration.

Install

For source builds or go install, use Go 1.27 or later.

Binary release

Download the latest release from:

• https://github.com/zan8in/afrog/releases/latest

Build from source

git clone https://github.com/zan8in/afrog.git
cd afrog
go mod tidy
go build -o afrog cmd/afrog/main.go
./afrog -h

Go install

go install -v github.com/zan8in/afrog/v3/cmd/afrog@latest

Quick start

Scan a single target:

afrog -t https://example.com

Scan multiple targets from a file:

afrog -T targets.txt

Run only high and critical checks:

afrog -T targets.txt -S high,critical

Documentation

The documentation is being reorganized into a structured bilingual tree. Chinese content is currently the most complete; English paths are already reserved and will be filled incrementally.

• Chinese docs index: docs/zh/index.md
• English docs index: docs/en/index.md
• PoC quickstart: docs/zh/poc/quickstart.md
• SDK quickstart: docs/zh/sdk/quickstart.md
• Contributors: docs/zh/community/contributors.md

PoC Contributors

PoC contributors are a core part of the afrog community. This section stays in the repository README on purpose so contributor recognition remains visible in the first place people land.

For contribution guidance, see the Chinese contributor guide. For a stable docs entry, see docs/zh/community/contributors.md.

Examples

• Basic scanner
• Async scanner
• OOB scanner
• Progress scanner
• Full output
• SDK portscan
• Vulnerability scan
• Port scan

Project links

• Releases: https://github.com/zan8in/afrog/releases
• Wiki archive: https://github.com/zan8in/afrog/wiki

Community

To join the afrog WeChat discussion group, add the afrog account and mark it as afrog.

404Starlink

afrog is part of 404Starlink.

Disclaimer

This tool is intended only for legally authorized security work. Do not scan unauthorized targets. The user is solely responsible for any misuse or illegal activity.