frogy2.0

Orbis is an full spectrum automated external attack surface intelligent toolkit.

Key Features

Risk Scoring

Every endpoint is scored through three capped buckets (max 100). The aggregate report score is the mean of the top-5 domain endpoint scores.

Why it matters: An internal admin panel with an expired self-signed cert, a wildcard CORS header, and port 3306 exposed scores far higher than a static marketing page — so your team skips the noise and starts where it matters.

Screenshots

Quick Start

1. Build the Docker image

2. Run the container

Linux (native Docker — --network host works):

macOS / Windows (Docker Desktop — no --network host):

-v "$(pwd)/output:/opt/frogy/output" persists scan history across container restarts.

3. Open the dashboard

4. Start your first scan

1. Click + New Scan — enter a project name and paste your domains (one per line)
2. Optionally paste any out-of-scope assets in the Exclusion List textarea (exact or suffix match)
3. Click Run Now or Add to Queue
4. Watch live progress: Step X of 31, elapsed timer, real-time log streaming
5. When complete, click Report → to open the self-contained HTML report

Results are written to output/run-<timestamp>/.

Report Tour

The generated report is a self-contained HTML file — no server needed, open it in any browser.

Every table has full-text search, column visibility toggle (hidden columns persisted per browser), and the ⓘ About button explains what each section means and what to look for.

Orbis Dashboard

The web UI at localhost:8787 is branded Orbis — Full-Spectrum Attack Surface Intelligence.

• Project cards — status badge, live progress bar (Step X of 31), elapsed/total duration
• KPI row — Total projects · Active scans · Completed · Queued
• Filter tabs — All / Running / Done / Queued
• 📋 View Logs — live log streaming side panel, polls every 1.5 s during active scans
• Project detail page — full per-project run history with individual report + log access
• Bulk operations — select multiple projects for batch deletion
• Modify / Rescan / Cancel any project from the ··· context menu
• Per-project Exclusion List — edit out-of-scope assets from the New Scan / Modify modal
• API Keys panel — configure optional enrichment keys with live validation and individual Clear buttons
• Dark / Light theme — persisted via frogyTheme localStorage key (shared with reports)

Tech Stack

Configuration

Access the API Keys panel from the sidebar (🔑 API Keys) to configure:

API Keys (optional but unlock additional sources)

All keys are optional — the pipeline runs fully without them, skipping only the enrichment steps that require a specific key. Each key has a live validation test and a Clear button in the API Keys panel.

Tech Stack

BlackHat Arsenal

Frogy was presented at BlackHat Arsenal. Watch the full demo:

Acknowledgements

Special thanks to the Project Discovery team for building the open-source tools that power this pipeline (Subfinder, DNSX, Naabu, HTTPX, Katana, tlsx), and to tomnomnom for Assetfinder. Keep rocking the community!

Built by Chintan Gurjar

Future Roadmap

• Completed ✅ Adding security and compliance-related data (SSL/TLS hygiene, SPF, DMARC, Headers etc)
• Completed ✅ Allow to filter column data.
• Completed ✅ Add more analytics based on new data.
• Completed ✅ Identify login portals.
• Completed ✅ Basic dashboard/analytics if possible.
• Completed ✅ Display all open ports in one of the table columns.
• Completed ✅ Pagination to access information faster without choking or lagging on the home page.
• Completed ✅ Change font color in darkmode.
• Completed ✅ Identify traditional endpoints vs. API endpoints.
• Completed ✅ Identifying customer-intended vs colleague-intended applications.
• Completed ✅ Enhance prioritisation for target picking. (Scoring based on management ports, login found, customer vs colleague intended apps, security headers not set, ssl/tls usage, etc.)
• Completed ✅ Implement parallel run, time out functionality.
• Completed ✅ Scan SSL/TLS for the url:port pattern and not just domain:443 pattern.-
• Completed ✅ Using mouseover on the attack surface column's score, you can now know why and how score is calculated-
• Completed ✅ Generate CSV output same as HTML table.
• Completed ✅ Self-contained HTML output is generated now. So no need to host a file on web server to access results.
• Completed ✅ To add all DNS records (A, MX, SOA, SRV, CNAME, CAA, etc.)
• Completed ✅ Consolidate the two CDN charts into one.
• Completed ✅ Added PTR record column to the main table.
• Completed ✅ Implemented horizontal and vertical scrolling for tables and charts, with the first title row frozen for easier data reference while scrolling.
• Completed ✅ Added screenshot functionality.
• Completed ✅ Added logging functionality. Logs are stored at /logs/logs.log
• Completed ✅ Added extra score for the management and database ports exposed.
• Completed ✅ Create Dockerized version.
• Completed ✅ Added new subdomain enum capability using GAU (waybackurls).
• Completed ✅ Now capable of crawling links per live application and also it adds the score of total crawled links to the main score.
• Completed ✅ Added check_dependencies to verify all required tools are installed (subfinder, assetfinder, dnsx, naabu, httpx, katana, jq, curl, whois, dig, openssl, xargs, unzip, grep, sed, awk). The script now aborts with a clear list of missing tools.
• Completed ✅ Added check_dependencies to verify all required tools are installed (subfinder, assetfinder, dnsx, naabu, httpx, katana, jq, curl, whois, dig, openssl, xargs, unzip, grep, sed, awk). The script now aborts with a clear list of missing tools.
• Completed ✅ New trap on ERR with contextual message (exit code, command, file:line). New script_cleanup hooked to EXIT prints success/failure summary and points to the trace log.
• Completed ✅ Improved CLI validation (usage message, file existence & readability checks).
• Completed ✅ Added (optional) domain-line sanity validation.
• Completed ✅ Verifies run/log directories are writable; keeps xtrace only in logs.log.
• Completed ✅ Assetfinder: switched to parallel execution via xargs -P 10 over input domains.
• Completed ✅ dnsx: added rate limit and thread tuning (-rl 50 -t 25).
• Completed ✅ katana: added concurrency/rate limits and timeouts (-c 5 -rl 30 -timeout 15), still honors KATANA_DEPTH/KATANA_TIMEOUT.
• Completed ✅ httpx: added tuned threads/rate-limit/timeouts (-t 25 -rl 80 -timeout 15).
• Completed ✅ naabu Skips scanning with a clear warning when master_subdomains.txt is empty.
• Completed ✅ httpx now runs a JSON pass first to build httpx.json and live counts, then a second pass for screenshots.
• Completed ✅ Verifies default artifact directories are writable before capture.
• Completed ✅ Introduced BLOCK_DETECTION_THRESHOLD (default 20%). If fewer than the threshold of web targets respond (derived from httpx.json vs naabu live targets), the run halts with guidance to rotate IP/VPN.
• Completed ✅ Login surface detection overhaul - Uses per‑request mktemp files and explicit curl timeouts.
• Completed ✅ Expanded heuristics (password/username fields, form attributes, submit labels, CSRF tokens, meta hints, CAPTCHA, modal hints, multilingual keywords, JS auth libraries, 401/403/407, WWW-Authenticate, session cookies, login redirects, URL patterns & query params).
• Completed ✅ Emits structured JSON and increments LOGIN_FOUND_COUNT when detected.
• Completed ✅ Colourised error output; clearer progress steps (e.g., [n/15]).
• Completed ✅ Completeley revamped design for easy navigation.
• Completed ✅ Added side panel to distribute data among Domain intel, application intel, cert intel, IP intel and cloud intel.
• Completed ✅ Enforce data quality checks (valid domain syntax, duplicate detection, enrichment completion) before persisting records.
• Completed ✅ Provide an option to hide the side panel.
• Completed ✅ Export report in CSV + JSON format.
• Completed ✅ Add the same search bar to all side panel reporting.
• Completed ✅ User should be allowed to directly open UI and add targets there only.
• Completed ✅ Implement brand new scoring logic.
• Completed ✅ Implement brand new GUI, slick design and more adaptability
• Completed ✅ Fix the URL redirection issue which was bumping score and no. of endpoints.