afrog is an MIT-licensed vulnerability scanner built for bug bounty, penetration testing and red teaming, aimed at testers who need fast verification of web targets and network services with low false positives.

What it is

afrog is a high-performance vulnerability scanner that supports both built-in and custom PoCs. The README describes it as designed for fast verification and low false positives, with practical workflows covering web targets, network services, PoC authoring, and SDK-based integration. The registry places it in Security & Privacy / Threat Detection & Response, lists its language as HTML, and records 4417 stars, 484 forks and 111 open issues at the time of writing. The build instructions in the README are Go-based, so the practical toolchain is Go rather than the language field shown in the metadata.

The concrete problem it addresses is the verification step in a security engagement. Running checks by hand across many targets is slow and produces noise that consumes triage time, so afrog provides a single command-line scanner that takes one target or a list of targets, runs built-in or custom proof-of-concept checks, and lets the operator narrow results by severity. Within the Go security-tooling ecosystem, it fills the role of a scriptable scanner that can also be embedded as a library instead of being driven only from a shell. It is part of 404Starlink.

Key capabilities

• Single-target scanning with afrog -t https://example.com and list-based scanning with afrog -T targets.txt.
• Severity filtering, for example afrog -T targets.txt -S high,critical, so only high and critical checks run.
• Support for both built-in and custom PoCs, with a dedicated PoC quickstart at docs/zh/poc/quickstart.md.
• SDK integration documented at docs/zh/sdk/quickstart.md, with worked examples including examples/basic_scan/main.go, examples/async_scan/main.go, examples/oob_scan/main.go, examples/progress_scan/main.go, examples/full_output/main.go, and examples/vuln_scan/main.go.
• Network service and port coverage through examples/sdk_portscan/main.go and examples/port_scan/main.go.
• Out-of-band verification via the OOB scanner example.
• A bilingual documentation tree with reserved English paths at docs/en/index.md alongside the more complete Chinese index at docs/zh/index.md.

Who uses it and how

• Bug bounty hunters scanning live web targets during recon and validation.
• Penetration testing teams working from a prepared target list, running severity-restricted passes over that list.
• Red teams that need out-of-band confirmation of findings rather than blind requests.
• PoC authors and contributors, supported by a contributor guide and a community list that is deliberately kept in the README so recognition stays visible.
• Go developers embedding the scanner in their own tooling through the SDK examples rather than invoking the CLI.

Getting started

The README documents three paths: download a binary release, go install -v github.com/zan8in/afrog/v3/cmd/afrog@latest, or build from source with git clone https://github.com/zan8in/afrog.git, go mod tidy and go build -o afrog cmd/afrog/main.go. Source builds and go install require Go 1.27 or later.

How it compares

No comparable tools are named in the facts supplied for this page, so afrog stands alone in this registry. It is published under the MIT licence and runs entirely from the operator's own machine or infrastructure.

When to use it — and when not to

A self-hoster needs the Go toolchain at version 1.27 or later for source builds, or simply a downloaded binary release; the README describes no database, object storage, or mail service to operate. Teams that need complete English documentation should be aware that the documentation tree is being reorganized and that Chinese content is currently the most complete, with English paths reserved but not yet filled. The README also lists project links for releases and a wiki archive without visible targets, so verify those before relying on them, and remember the stated disclaimer that the tool is intended only for legally authorized security work.

git clone https://github.com/zan8in/afrog.git
cd afrog
go mod tidy
go build -o afrog cmd/afrog/main.go
./afrog -h

go install -v github.com/zan8in/afrog/v3/cmd/afrog@latest

afrog -t https://example.com

afrog -T targets.txt

afrog -T targets.txt -S high,critical