## File: README.md

<h4 align="center">A Security Tool for Bug Bounty, Pentest and Red Teaming</h4>









## PoC Contributors



| [不动明王](https://blog.csdn.net/U_U520) | [雪山](https://www.linuxlz.com/) | [White-hua](https://github.com/White-hua) | [123456](javascript:void(0)) | [ifofor](https://github.com/ifofor) | [Air](https://github.com/SkinAir) | [执着](https://github.com/zhizhuoshuma) | [purple-WL](https://github.com/purple-WL) | [throat](javascript:void(0);) |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Secx](http://secx.store:4000/archives/) | [冰河](https://github.com/yueyu0740) | [Sheen](javascript:void(0);) | [a16](javascript:void(0);) | [A1](javascript:void(0);) | [rainbow2972](https://github.com/rainbow2972) | [wuha0926](https://github.com/wuha0926) | [茄子](javascript:void(0);) | [lei_sec](javascript:void(0);) |  |  |  |  |  |  |  |  |  |
| [G-H-Z](https://github.com/G-H-Z) | [wh1te](https://github.com/LDDP) | [清月](javascript:void(0);) | [york](javascript:void(0);) | [7eleven.eth](javascript:void(0);) | [Double...](https://github.com/Double-q1015) | [ICEY_](https://github.com/iceyjchen) | [lazy](https://github.com/Ablackcatlazy) | [free2e](javascript:void(0);) |  |  |  |  |  |  |  |  |  |
| [m4sk](javascript:void(0);) | [沉默树人](https://www.yuque.com/chenmoshuren/qyxg2k) | [陈麻子](javascript:void(0);) | [leonardo-o1](https://github.com/leonardo-o1) | [江湖人称魏...](javascript:void(0);) | [若兮风](javascript:void(0);) | [-sudo](javascript:void(0);) | [Cuerz](https://github.com/Cuerz) | [laohuan12138](javascript:void(0);) |  |  |  |  |  |  |  |  |  |
| [exp0l0zzz](https://github.com/exp0l0zzz) | [1derian](https://github.com/1derian) | [CMDB-M](https://github.com/CMDB-M) | [li1u](javascript:(0);) | [oxsonder](https://github.com/s0nd9r) | [Zhiliao](javascript:void(0);) | [段](javascript:void(0);) | [HuiTaiL](https://github.com/HuiTaiL6) | [Miracles666](https://github.com/Miracles666) | [Observer](javascript:void(0);) | [黑熊](javascript:void(0);) | [TryA9ain](javascript:void(0);) | [fgz00](https://github.com/fgz00) | [Y3y1ng](https://github.com/Y3y1ng) | [二大爷](javascript:void(0);) | [Wans](https://github.com/wanswu) | [海边的小米粥](https://github.com/hbdxmz) | [Wen](javascript:void(0);) |
| [SULAB](javascript:void(0);) | [ZacharyZcR](javascript:void(0);) | [Superhero](https://superhero.blog.csdn.net/) | [k5rC85Lma](javascript:void(0)) |  |  |  |  |  |  |  |  |  |  |  |  |  |  |



## What is afrog

afrog is a high-performance vulnerability scanner that is fast and stable. It supports user-defined PoC and comes with several built-in types, such as CVE, CNVD, default passwords, information disclosure, fingerprint identification, unauthorized access, arbitrary file reading, and command execution. With afrog, network security professionals can quickly validate and remediate vulnerabilities, which helps to enhance their security defense capabilities.

## Features

- [x] Open source
- [x] Fast, stable, with low false positives
- [x] Detailed HTML vulnerability reports
- [x] Customizable and stably updatable PoCs
- [x] Port pre-scan (PortScan) for open port discovery
- [x] Active community exchange group

## Installation

### Prerequisites

- [Go](https://go.dev/) version 1.24 or higher.

you can install it with:

**Binary**

```sh
$ https://github.com/zan8in/afrog/releases/latest
```

**Github**

```sh
$ git clone https://github.com/zan8in/afrog.git
$ cd afrog
$ go build cmd/afrog/main.go
$ ./afrog -h
```

**Go**

```sh
$ go install -v github.com/zan8in/afrog/v3/cmd/afrog@latest

# Confirm Go’s bin path is in your environment
$ ls ~/go/bin/afrog

# Make it runnable from anywhere (add ~/go/bin to PATH)
# Permanently (Bash — add to ~/.bashrc):
$ echo 'export PATH=$PATH:~/go/bin' >> ~/.bashrc
$ source ~/.bashrc

# If you use Zsh:
$ echo 'export PATH=$PATH:~/go/bin' >> ~/.zshrc
$ source ~/.zshrc
```

## Running afrog

By default, afrog scans all built-in PoCs, and if it finds any vulnerabilities, it automatically creates an HTML report with the date of the scan as the filename.

```sh
afrog -t https://example.com
```


**Warning occurs when running afrog**

If you see an error message saying:

```
[ERR] ceye reverse service not set: /home/afrog/.config/afrog/afrog-config.yaml
```

it means you need to modify the [configuration file](#configuration-file).

To execute a custom PoC directory, you can use the following command:

```sh
afrog -t https://example.com -P mypocs/
```

Use the command `-s keyword` to perform a fuzzy search on all PoCs and scan the search results. Multiple keywords can be used, separated by commas. For example: `-s weblogic,jboss`.

```sh
afrog -t https://example.com -s weblogic,jboss
```

Use the command `-S keyword` to scan vulnerabilities based on their severity level. Severity levels include: `info`, `low`, `medium`, `high`, and `critical`. For example, to only scan high and critical vulnerabilities, use the command `-S high,critical`.

```sh
afrog -t https://example.com -S high,critical
```

You can scan multiple URLs at the same time as well.

```sh
afrog -T urls.txt
```

### Port Pre-scan (PortScan)

PortScan runs before PoC scanning to discover open ports. Discovered ports will be appended to the scan target set (as `host:port`), and subsequent PoCs will run against the updated targets.

```sh
# Single-target full port scan
afrog -t 1.2.3.4 -ps -p all

# Network segment scan (host discovery + common port scan)
afrog -t 1.2.3.4/24 -ps

# Skip host discovery (assume target is reachable)
afrog -T targets.txt -ps -Pn

# Scan only specified ports
afrog -t example.com -ps -p 80,443,8080
```

Common flags:

- `-ps` / `--portscan`: enable port pre-scan
- `-p` / `--ports`: ports definition (e.g. `top`, `full`, `all`, `80,443`, `1-1024`)
- `-Pn` / `--ps-skip-discovery`: skip host discovery
- `-prate` / `--ps-rate`: portscan rate limit
- `-ptimeout` / `--ps-timeout-ms`: portscan timeout (ms)
- `-ptries` / `--ps-retries`: portscan retries
- `--ps-s4-chunk`: chunk size when ports=`full`

## -web Command

The `-web` command allows for persistently storing vulnerabilities scanned by afrog into an SQLite3 database. Accessing http://x.x.x.x:16868 via a browser provides access to the vulnerability report webpage, where users can conduct simple keyword searches and filter results by vulnerability severity.

```shell
afrog -web

```



## Configuration file

The first time you start afrog, it will automatically create a configuration file called `afrog-config.yaml`, which will be saved in the current user directory under `$HOME/.config/afrog/afrog-config.yaml`.

Here is an example config file:

```yaml
curated:
  enabled: "auto"         # auto|on|off
  endpoint: ""            # curated service endpoint, leave empty to disable online update
  auto_update: true       # automatically check for curated updates
  timeout_sec: 10         # mount/update timeout in seconds
  channel: "stable"       # curated channel, e.g. stable/beta
  license_key: ""         # your curated license key (if you have one)

reverse:
  ceye:
    api-key: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    domain: "xxxxxx.cey2e.io"
  dnslogcn:
    domain: dnslog.cn
  alphalog:
    domain: dnslogxx.sh
    api_url: "http://dnslogxx.sh/"
  xray:
    x_token: "xraytest"
    domain: dnslogxx.sh
    api_url: "http://x.x.0.x:8777"
  revsuit:
    token: "xx"
    dns_domain: "log.xx.com"
    http_url: "http://x.x.x.x/log/"
    api_url: "http://x.x.x.x/helplog"
```

### Curated PoCs

Curated PoCs are an additional encrypted PoC set that can be mounted and updated automatically before scanning.

- When `curated.enabled` is `auto` or `on`, afrog tries to mount curated PoCs on startup.
- If a valid `endpoint` and `license_key` are configured, afrog will:
  - Log in to the curated service
  - Periodically check and download the latest curated PoCs
  - Decrypt and store them under `~/.config/afrog/pocs-curated`
- PoC loading priority is:
  - curated > my > append > local > builtin
  so curated PoCs override other sources with the same PoC id.

If `curated.enabled` is `off`, or `endpoint` is empty, afrog will not connect to any curated service and will only use local/builtin PoCs.

For advanced users, you can override the curated PoC directory with the environment variable `AFROG_POCS_CURATED_DIR`.


`reverse` is a reverse connection platform used to verify command execution vulnerabilities that cannot be echoed back. Currently, only ceye can be used for verification.

### Ceye Configuration


- Go to the [ceye.io](http://ceye.io/) website and register an account.
- Log in and go to the personal settings page.
- Copy the `domain` and `api-key` and correctly configure them in the `afrog-config.yaml` file.

### Dnslogcn

No configuration required, but unstable
[dnslog.cn](http://dnslog.cn/)

### Alphalog

Need to build services
[alphalog](https://github.com/AlphabugX/Alphalog)

### Xray

Need to build services
[xray](https://docs.xray.cool/tools/xray/advanced/reverse)

### Revsuit

Need to build services
[Revsuit](https://github.com/Li4n0/revsuit)、
[Tutorial](https://mp.weixin.qq.com/s/hGwcMz8sh7BImBjI3wHqnQ)

## Json Output (For developers)

### Json

Optional command: `-json` `-j`, Save the scan results to a JSON file. The JSON file includes the following contents by default: `target`, `fulltarget`, `id`, and `info`. The info field includes the following sub-fields: `name`, `author`, `severity`, `description`, and `reference`. If you want to save both `request` and `response` contents, please use the [-json-all](#jsonall) command parameter.

```sh
afrog  -t https://example.com -json result.json
afrog  -t https://example.com -j result.json
```

### Warning

The content of the JSON file is updated in real time. However, there is an important note to keep in mind: before the scan is completed, if developers want to parse the file content, they need to add a '`]`' symbol to the end of the file by themselves, otherwise it will cause parsing errors. Of course, if you wait for the scan to complete before parsing the file, this issue will not occur.

### JsonAll

Optional command: `-json-all` `-ja`, The only difference between the `-json-all` and `-json` commands is that `-json-all` writes all vulnerability results, including `request` and `response`, to a JSON file.

```sh
afrog -t https://example.com -json-all result.json
afrog -t https://example.com -ja result.json
```

## Screenshot





## As Library

### Simple Example

For comprehensive SDK documentation:

- [SDK Usage Guide (English)](docs/SDK_Usage_Guide_English.md)
- [SDK使用指南 (中文)](docs/SDK使用指南_中文.md)

### More Examples & Documentation

- [Basic scanner](examples/basic_scan/main.go)
- [Async scanner](examples/async_scan/main.go)  
- [OOB scanner](examples/oob_scan/main.go)
- [Progress scanner](examples/progress_scan/main.go)
- [SDK PortScan (sync/async)](examples/sdk_portscan/main.go)



## Discussion group

To join the afrog communication group on WeChat, please first add the afrog personal account and mark it as **afrog**. Then, you will be added to the group by the administrator.



## 404Starlink



afrog has joined [404Starlink](https://github.com/knownsec/404StarLink)

## Disclaimer

This tool is intended only for **legally authorized** enterprise security construction purposes. If you want to test the functionality of this tool, you should build a target environment by yourself.

To prevent malicious use, all PoCs included in this project are theoretical assessments of vulnerabilities. The tool does not exploit vulnerabilities, launch real attacks or exploits on targets.

When using this tool for vulnerability scanning, it is important to ensure that your behavior complies with local laws and regulations, and that you have obtained sufficient authorization. **Do not scan unauthorized targets**.

If you engage in any illegal behavior while using this tool, you will be solely responsible for any corresponding consequences, and we will not bear any legal or joint responsibility.

Before installing and using this tool, please **read each clause carefully and thoroughly**. Restrictions, disclaimers, or other clauses that may significantly affect your rights and interests may be highlighted in bold or underlined to draw your attention. Unless you have fully read, fully understood, and agreed to all the terms of this agreement, do not install or use this tool. Your use of the tool or your acceptance of this agreement in any other express or implied manner will be deemed as your acknowledgment and agreement to be bound by this agreement.

---

## File: pocs/afrog-pocs/README.md

<h1 align="center">afrog-pocs</h1>


### 文件名

后缀 `.yaml`

```azure
CVE-2022-0202.yaml
```

### id

`[公司]产品-漏洞名称|CVE/CNVD-2021-XXXX`

```yaml
id: CVE-2022-0202  // good
id: seeyon-ajax-unauth  // good
id: zhiyuan-oa-unauth   // bad
```
### info

包含 `name`、`author`、`severity`、`description`、`reference`

```yaml
id: CVE-2022-22947
info:
  name: Spring Cloud Gateway Code Injection
  author: alex
  severity: critical
    Spring Cloud Gateway 远程代码执行漏洞（CVE-2022-22947）发生在Spring Cloud Gateway...
    影响版本：Spring Cloud Gateway 3.1.x < 3.1.1 、Spring Cloud Gateway < 3.0.7
    官方已发布安全版本，请及时下载更新，下载地址：https://github.com/spring-cloud/spring-cloud-gateway
    FOFA：app="vmware-SpringBoot-framework"
  reference:
    - https://mp.weixin.qq.com/s/qIAcycsO_L9JKisG5Bgg_w	 // 必须是列表（数组）形式
```
name：漏洞名称，尽量英文且官方用语

author：大佬名称

severity: 漏洞等级，分为`critical`、`high`、`mideum`、`low`、`info`，请参考 [[National Vulnerability Database]](https://nvd.nist.gov/vuln/detail/cve-2020-11710)
reference: （可选填）参考链接，必须数组形式，否则 poc 无法验证

### rules

示例

``` yaml
rules:
  r0:
    request:
      method: GET
      path: /phpinfo.php
    expression: response.status == 200 && response.body.bcontains(b'PHP Version')
    stop_if_match: true
  r1:
    before_sleep: 6
    request:
      method: GET
      path: /info.php
    expression: response.status == 200 && response.body.bcontains(b'PHP Version')
    stop_if_mismatch: true
expression: r0() || r1()
```

rules：定义规则组

r0 / r1 :  子规则，自定义名称，不能重复

request:  表示 http request 请求

method:  表示 http request method 方法

path:  表示 http request URL 请求的 PATH

expression：子规则的验证表达式，用于验证 r0 或 r1 是否匹配规则。比如：`response.status == 200 && response.body.bcontains(b'PHP Version')`表示 request 请求返回状态码必须是 200 且 源码必须含有 `PHP Version` 关键字

stop_if_match: 如果匹配就停止

stop_if_mismatch：如果不匹配就停止

before_sleep: 顾名思义，http 请求前 sleep 6 秒钟

expression: 最外面的 `expression` 是 `rules` 的验证表达式，`r0() || r1()` 表示 `r0` 和 `r1` 两个规则，匹配一个表达式就为 `true`，代表漏洞存在。

> 如果 rules 表达式都是 `||`关系，比如：r0() || r1() || r2() ... ，默认执行 `stop_if_match` 动作。同理，如果表达式都是 `&&` 关系，默认执行 `stop_if_mismatch` 动作。

### raw http
```yaml
set:
  hostname: request.url.host
rules:
  r0:
    request:
      raw: |
        GET .//WEB-INF/web.xml HTTP/1.1
        Host: {{hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
    expression: response.status == 200 && response.body.bcontains(b'<web-app') && response.body.bcontains(b'</web-app>') && (response.raw_header.bcontains(b'application/xml') || response.raw_header.bcontains(b'text/xml'))
  r1:
    request:
      raw: |
        GET .//WEB-INF/weblogic.xml HTTP/1.1
        Host: {{hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
    expression: response.status == 200 && response.body.bcontains(b'<weblogic-web-app') && response.body.bcontains(b'</weblogic-web-app>') && (response.raw_header.bcontains(b'application/xml') || response.raw_header.bcontains(b'text/xml'))
expression: r0() || r1()
```
raw: 顾名思义，支持原生 http 请求
# 免责声明

本工具仅面向**合法授权**的企业安全建设行为，如您需要测试本工具的可用性，请自行搭建靶机环境。

为避免被恶意使用，本项目所有收录的poc均为漏洞的理论判断，不存在漏洞利用过程，不会对目标发起真实攻击和漏洞利用。

在使用本工具进行检测时，您应确保该行为符合当地的法律法规，并且已经取得了足够的授权。**请勿对非授权目标进行扫描。**

如您在使用本工具的过程中存在任何非法行为，您需自行承担相应后果，我们将不承担任何法律及连带责任。

在安装并使用本工具前，请您**务必审慎阅读、充分理解各条款内容**，限制、免责条款或者其他涉及您重大权益的条款可能会以加粗、加下划线等形式提示您重点注意。 除非您已充分阅读、完全理解并接受本协议所有条款，否则，请您不要安装并使用本工具。您的使用行为或者您以其他任何明示或者默示方式表示接受本协议的，即视为您已阅读并同意本协议的约束。

---

## File: pocs/readme.md

# Directory Structure
- afrog-pocs:     afrog built-in PoCs
- unverified:    Unverified PoCs
- temp:          Temporarily updated afrog PoCs (applicable only until the next version release)
- v:             Compressed files of temporarily updated afrog PoCs provided

# 目录结构
- afrog-pocs:     afrog 内置的 PoC
- unverified:     未经验证的 PoC
- temp:           暂时更新的 afrog PoC（仅适用于下一个版本发布前）
- v:      提供的 afrog 临时更新 PoC 的压缩文件