afrog

# afrog

<p align="center">
  <a href="http://afrog.net"><img src="https://raw.githubusercontent.com/zan8in/afrog/HEAD/images/afrog-logo.svg" width="60px" alt="afrog"></a>
</p>
<!-- </a> <h1 align="center">afrog</h1> -->

<h4 align="center">用于漏洞赏金、测试和红队的安全工具</h4>

<p align="center">
  <a href="https://github.com/zan8in/afrog/blob/main/README.md">English</a> •
  <a href="https://github.com/zan8in/afrog/blob/main/docs/README_CN.md">中文</a>
</p>

<p align="center">
<img src="https://img.shields.io/github/go-mod/go-version/zan8in/afrog?filename=go.mod">
<a href="https://github.com/zan8in/afrog/releases"><img src="https://img.shields.io/github/downloads/zan8in/afrog/total">
<a href="https://github.com/zan8in/afrog/graphs/contributors"><img src="https://img.shields.io/github/contributors-anon/zan8in/afrog">
<a href="https://github.com/zan8in/afrog/releases/"><img src="https://img.shields.io/github/release/zan8in/afrog">
<a href="https://github.com/zan8in/afrog/issues"><img src="https://img.shields.io/github/issues-raw/zan8in/afrog">
<!-- <a href="https://github.com/zan8in/afrog/discussions"><img src="https://img.shields.io/github/discussions/zan8in/afrog"> -->
</p>

<p align="center" dir="auto">
  <a href="https://github.com/zan8in/afrog/releases">下载</a> •
  <a href="https://github.com/zan8in/afrog/wiki">Wiki</a> •
  <a href="https://github.com/zan8in/afrog/wiki/Afrog-PoC-规则编写权威指南">Afrog PoC 规则编写权威指南</a>
</p>

## PoC 贡献者

<div><table frame=void>
	<tr>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/b6be986588e2221bd337ee40e357c48dd0d29511c6a69749b5c368e5d8162f9d.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://blog.csdn.net/U_U520"><sub>不动明王</sub></a>
        </td>    
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/da42e8648ed7404a1096f71113b8aba807abdbfa7e381cdc9e713627b0b65c89.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://www.linuxlz.com/"><sub>雪山</sub></a>
        </td> 
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/f7e7e78f1c2d308a5216c92f1973ed95929da6bfe461eaa4c4d0960b0a37db7c.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/White-hua"><sub>White-hua</sub></a>
        </td> 
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/d4ab098e69125f1c2b73bad60125163b350d3ccc167d7f2a40f7d604f6bc9349.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0)"><sub>123456</sub></a>
        </td> 
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/c786e7372573e88d6cfb0f03bc7a67fdaf380927f4074697824533c147fb527e.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/ifofor"><sub>ifofor</sub></a>
        </td> 
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/fef7f04c04c090469b7fa51f6cf9bab53bbd4706a9882873f9569bf206b999b4.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/SkinAir"><sub>Air</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/14f6556e592680b9f916bc49c3ba8b80c993887117fb626f0ffb41f69d73d6ff.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/zhizhuoshuma"><sub>执着</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/93e66b515fac4263e80bd6cdcaf832a4847a2926a5d802cb236dc1553b536fac.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/purple-WL"><sub>purple-WL</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/042e18fc2615eb699f1d5146a1fa9a1724c5a58b85cffe8f81541a6ee5360e54.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>throat</sub></a>
        </td>
	</tr>
    <tr>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/05448a4fb9aab282a80bc3d949a41616ebecf31bc29a3ccb8910f39be7b21000.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="http://secx.store:4000/archives/"><sub>Secx</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/7ff53adf002374f9553fdee9fadaa33a4428929411c16e0b89884ca77358a83d.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/yueyu0740"><sub>冰河</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/4eed8bf0fe3b7e1ab26beae0606813f8b3ea13844e3ee19a6c03ab7975e5a6ba.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>Sheen</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/64711092b7b7bf2f1a8b83d8ab414fba925d0fa28ddad66656015c56f0ab95f9.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>a16</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/0688060188e981a059e50998b3dc937102c1f201ddddb1cab3fb7d1c6f6a8071.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>A1</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/2a95c724ca11344b06fd983725a04219b4f7510046efa4570ed2cfd465514cc9.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/rainbow2972"><sub>rainbow2972</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/46ee62db6bafd06e954530595d4994e8c00ed766a008916ec9d33a942fa49dac.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/wuha0926"><sub>wuha0926</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/b9b9a64672b22b987ce6a437183c6aa63202f65ab293cefe95dff1a208487993.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>茄子</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/79f2cc361bf54d6def96c81da792d96f8d65e3993a9df67fb689f6f4bf2130d1.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>lei_sec</sub></a>
        </td>
	</tr>	
    <tr>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/70800195b402df9b8b6356e4a9870f0ed4e82cce0d62e18b48d25382ef09e208.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/G-H-Z"><sub>G-H-Z</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/bea2840b6462e56a8591c7d6567685bf95357924380120db38e928472d393760.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/LDDP"><sub>wh1te</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/5f46f7adb68b1aff71ff941cc01552c3aa9f3dd08597f4e3cab04b72989726ba.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>清月</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/824c2276bc4a6058f833a895ed1680821da4adcb95c2c62c0a33120b4807a747.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>york</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/4abf40648670a149718b0f4a6248fabce0ff6a84573d06eefa790004a1b80043.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>7eleven.eth</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/b9c31a0c06d5b77063719507e39d144b73466142a2aa5ff4308a5c2d57e9bf99.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/Double-q1015"><sub>Double...</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/ff3456ab4eff5ca2dd673f5d31e75c077a2678b6dbcbde92df7d315d0ffa03f6.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/iceyjchen"><sub>ICEY_</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/a8b53cbcc9057a8b786b8cc4751d8a75eaff84d23b8a2f8990a5ded2d18a9b7a.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/Ablackcatlazy"><sub>lazy</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/53ff47c2a0e4ce3a1b73f08119fbef6376d05427406d26c9aa6a0f1cf7e558d2.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>free2e</sub></a>
        </td>
    </tr>	
    <tr>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/3f183ede38557aff22ccebc6930ba5a6c006a2c05a98f68d2938e692abb1162a.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>m4sk</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/3d31507955289aeba1a894da57c9b9cda800e2ad136474197440d1f019c660db.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://www.yuque.com/chenmoshuren/qyxg2k"><sub>沉默树人</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/06b07ea4bd3bd12852b4156942934531d0424a1921da09560d47fb8ad54217e5.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>陈麻子</sub></a>
        </td>
         <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/794b76cbfb1b0334674fbe63af67780f99657c4b13f5e7a6936eae6fee3c20c4.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/leonardo-o1"><sub>leonardo-o1</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/5564c37dda6daf29791adb1e8ec3534bc120abe2ae1cacbee01219cb993946c8.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>江湖人称魏...</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/14e7f4fcad75f813aed6b5a246505e590fe170fbfb01b131c1c5acf98cb998ce.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>若兮风</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/73179f29b26d12b3154a522d975f4568d624936e8e5a1cd770d824edefa8458c.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>-sudo</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/525e48a81be5f3935aa6ed15bf5f2f25f98cd7b45041d96e6e4d6dc0925f4c20.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/Cuerz"><sub>Cuerz</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/dca2a99be27a6a4de936363319fd7d549e0b698b735a01500381eb6382534ee9.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>laohuan12138</sub></a>
        </td>
    </tr>
    <tr>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/9fc2f6ab553f081a3f15c74991c39b010969e00563c4667bc1acde7876e2291b.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/exp0l0zzz"><sub>exp0l0zzz</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/3c6f4421b22cc5babce8b8c0e799f0c25424e2402fd2db98a70075f0bbd4e385.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/1derian"><sub>1derian</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/243d2b4c4c713041bee097db17622cd667607f5f140239af081f07f649a5d79e.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/CMDB-M"><sub>CMDB-M</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/4751d4e902358d2a9f6f66aea87d2dabb6a8e8c92c46043c03a58276e3a09714.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:(0);"><sub>li1u</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/14e936dc6f1544ba72a08ca53ae05545c49a6ac50c5e817e6a2b16fec222667a.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/s0nd9r"><sub>oxsonder</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/18f73b4682bebe241739d78b09017a370b80c0e3eb50de99e3ddb2e1fd1015ec.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>Zhiliao</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/6f89875a464f73bb6de8c2f04096dc46cb9693c7fd4b6d1b38bd6bd347ac94c5.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>段</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/90059da0a56db73106e94a04de961a7c9c630ef0019e04b1bc447cf92a289105.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/HuiTaiL6"><sub>HuiTaiL</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/b66f6077afa623b286d5e2926143d14febd90844fb23b6d832a453ed0f2a9f5d.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/Miracles666"><sub>Miracles666</sub></a>
        </td>
    </td>
     <tr>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/96eeb1fb82b8170a7268b74126aede0edab4d9d8b7a1fe4e352446e3a8b91b82.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>Observer</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/5bb6736e6eafbc093a7df2082a75271f5ec81868b79b676e35d525c115425931.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>黑熊</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/b8e606d4239ef2196f8bcbe333241423d8381532a5276fc00698ff98e8362e9a.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>TryA9ain</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/ec1d88ea2cdd62d4c65389aac72ce407a46063d9cd04b58c7b978162ccc6a69a.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/fgz00"><sub>fgz00</sub></a>
        </td>
         <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/97e348f42ed9b9b19659134c1a438a16f3fdfc9bfb3815bda25a47757118a9e0.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/Y3y1ng"><sub>Y3y1ng</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/84302f067105b2ce6744c55408427f3188c65a2956784c0fdb793d2453fb4c0f.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>二大爷</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/06e71fbffef515ceb4870fdad14b3a4d27078688a9edc623d47b750cef6142b9.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/wanswu"><sub>Wans</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/5865093ceddaf62249d34355fbfdf5b860cb601da8426032295be80a8345c6bc.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://github.com/hbdxmz"><sub>海边的小米粥</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/ad99a7d285842e79110269d5cbc080f216c6522e9d5908720d5adef65b75f3a5.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>Wen</sub></a>
        </td>
        </tr>
        <tr>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/3de24fcc1088c1921090e84b7a701f76fa0f256a1afed8c1982a9ad93920c105.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>SULAB</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/c8f312d6a22ffa63ef9259808e3937a247ba1f12bdba33367ee6a28a6c685ba0.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="javascript:void(0);"><sub>ZacharyZcR</sub></a>
        </td>
        <td align="center">
            <img src="https://assets.kitploit.com/production/public/readmes/5376/a2a008345cb31d5ac5a50752aa5102cbef9c788ca808d04b1d565d12d6d055cc.png"
                   alt="Typora-Logo"
                 />
            <br>
            <a href="https://superhero.blog.csdn.net/"><sub>Superhero</sub></a>
        </td>
        </tr>
        
</table></div>

## 什么是 afrog

afrog 是一个高性能的漏洞扫描器，具有快速稳定的特点。它支持用户自定义 PoC，并内置了多种类型，如 CVE、CNVD、默认密码、信息泄露、指纹识别、未授权访问、任意文件读取和命令执行。使用 afrog，网络安全专业人员可以快速验证和修复漏洞，从而提升安全防护能力。

## 功能特性

- [x] 开源
- [x] 快速、稳定、误报率低
- [x] 详细的 HTML 漏洞报告
- [x] 可自定义且稳定更新的 PoCs
- [x] 活跃的社区交流群

## 安装

### 前置要求

- [Go](https://go.dev/) 版本 1.19 或更高版本。

您可以通过以下方式安装：

**二进制文件**

```sh
$ https://github.com/zan8in/afrog/releases/latest
```

**Github**

```sh
$ git clone https://github.com/zan8in/afrog.git
$ cd afrog
$ go build cmd/afrog/main.go
$ ./afrog -h
```

**Go**

```sh
$ go install -v github.com/zan8in/afrog/v3/cmd/afrog@latest
```

## 运行 afrog

默认情况下，afrog 会扫描所有内置的 PoCs，如果发现任何漏洞，它会自动创建一个以扫描日期为文件名的 HTML 报告。

```sh
afrog -t https://example.com
```

**运行 afrog 时的警告**

如果您看到错误消息：

```
[ERR] ceye reverse service not set: /home/afrog/.config/afrog/afrog-config.yaml
```

这意味着您需要修改[配置文件](#配置文件)。

要执行自定义 PoC 目录，您可以使用以下命令：

```sh
afrog -t https://example.com -P mypocs/
```

使用命令 `-s keyword` 对所有 PoCs 进行模糊搜索并扫描搜索结果。可以使用多个关键词，用逗号分隔。例如：`-s weblogic,jboss`。

```sh
afrog -t https://example.com -s weblogic,jboss
```

使用命令 `-S keyword` 根据严重程度级别扫描漏洞。严重程度级别包括：`info`、`low`、`medium`、`high` 和 `critical`。例如，要仅扫描高危和严重漏洞，请使用命令 `-S high,critical`。

```sh
afrog -t https://example.com -S high,critical
```

您也可以同时扫描多个 URL。

```sh
afrog -T urls.txt
```

### 指纹门控（requires）

弱口令/爆破/默认口令等高成本 PoC 通常建议只在命中指定指纹后执行。Afrog 支持在 PoC `info` 中声明以下字段：

- `requires`：依赖的指纹标签（例如 `mysql`、`ftp`、`nacos`）
- `requires-mode`：门控模式（`strict`/`opportunistic`），默认 `strict`

当 PoC 使用 `requires-mode: strict` 时，如果运行时禁用了指纹阶段（`-nf`），或目标未命中对应指纹，该 PoC 将被跳过。完整用法与问题排查请参考：[requires 指纹门控：用法教程与问题答疑](https://github.com/zan8in/afrog/blob/main/docs/requires-gating-guide.md)

## -web 命令

`-web` 命令允许将 afrog 扫描的漏洞持久存储到 SQLite3 数据库中。通过浏览器访问 http://x.x.x.x:16868 可以访问漏洞报告网页，用户可以进行简单的关键词搜索并按漏洞严重程度过滤结果。

```shell
afrog -web

```

<img src="https://assets.kitploit.com/production/public/readmes/5376/ff7d1c53f89e8a2723040e3c1c36132c1a87cd4c0ead4eb514e5ad29af94c968.png" >

## 配置文件

第一次启动 afrog 时，它会自动创建一个名为 `afrog-config.yaml` 的配置文件，该文件将保存在当前用户目录下的 `$HOME/.config/afrog/afrog-config.yaml`。

以下是示例配置文件：

```yaml
reverse:
  ceye:
    api-key: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    domain: "xxxxxx.cey2e.io"
  dnslogcn:
    domain: dnslog.cn
  alphalog:
    domain: dnslogxx.sh
    api_url: "http://dnslogxx.sh/"
  xray:
    x_token: "xraytest"
    domain: dnslogxx.sh
    api_url: "http://x.x.0.x:8777"
  revsuit:
    token: "xx"
    dns_domain: "log.xx.com"
    http_url: "http://x.x.x.x/log/"
    api_url: "http://x.x.x.x/helplog"
```

`reverse` 是一个反向连接平台，用于验证无法回显的命令执行漏洞。目前只有 ceye 可以用于验证。

### Ceye 配置

要获取 ceye，请按照以下步骤操作：

- 前往 [ceye.io](http://ceye.io/) 网站并注册账户。
- 登录并进入个人设置页面。
- 复制 `domain` 和 `api-key` 并在 `afrog-config.yaml` 文件中正确配置它们。

### Dnslogcn

无需配置，但不稳定
[dnslog.cn](http://dnslog.cn/)

### Alphalog

需要构建服务
[alphalog](https://github.com/AlphabugX/Alphalog)

### Xray

需要构建服务
[xray](https://docs.xray.cool/tools/xray/advanced/reverse)

### Revsuit

需要构建服务
[Revsuit](https://github.com/Li4n0/revsuit)、
[教程](https://mp.weixin.qq.com/s/hGwcMz8sh7BImBjI3wHqnQ)

## Json 输出（面向开发者）

### Json

可选命令：`-json` `-j`，将扫描结果保存到 JSON 文件。JSON 文件默认包含以下内容：`target`、`fulltarget`、`id` 和 `info`。info 字段包含以下子字段：`name`、`author`、`severity`、`description` 和 `reference`。如果您想保存 `request` 和 `response` 内容，请使用 [-json-all](#jsonall) 命令参数。

```sh
afrog  -t https://example.com -json result.json
afrog  -t https://example.com -j result.json
```

### 警告

JSON 文件的内容会实时更新。但是有一个重要的注意事项：在扫描完成之前，如果开发者想要解析文件内容，他们需要自己在文件末尾添加一个 '`]`' 符号，否则会导致解析错误。当然，如果您等待扫描完成后再解析文件，就不会出现这个问题。

### JsonAll

可选命令：`-json-all` `-ja`，`-json-all` 和 `-json` 命令之间的唯一区别是 `-json-all` 将所有漏洞结果（包括 `request` 和 `response`）写入 JSON 文件。

```sh
afrog -t https://example.com -json-all result.json
afrog -t https://example.com -ja result.json
```

## 截图

![](https://assets.kitploit.com/production/public/readmes/5376/022855cb3c49272ddecedb5f52f09746af9d36df295faa91810f05d29fa535b3.png)

<!-- ![](https://assets.kitploit.com/production/public/readmes/5376/889e24e45e094751868e6af7ce5a2f5ddc77133036a3e9b7c2bea4822226b798.png) -->

## 作为库使用

### 简单示例

详细的 SDK 使用指南：

- [SDK 使用指南（中文）](https://github.com/zan8in/afrog/blob/main/docs/SDK%E4%BD%BF%E7%94%A8%E6%8C%87%E5%8D%97_%E4%B8%AD%E6%96%87.md)
- [SDK Usage Guide (English)](https://github.com/zan8in/afrog/blob/main/docs/SDK_Usage_Guide_English.md)


更多示例：

- [基础扫描器](https://github.com/zan8in/afrog/blob/main/examples/basic_scan/main.go)
- [异步扫描器](https://github.com/zan8in/afrog/blob/main/examples/async_scan/main.go)
- [OOB 扫描器](https://github.com/zan8in/afrog/blob/main/examples/oob_scan/main.go)
- [进度扫描器](https://github.com/zan8in/afrog/blob/main/examples/progress_scan/main.go)


## 讨论群

要加入微信上的 afrog 交流群，请先添加 afrog 个人账户并标记为 **afrog**。然后，管理员会将您添加到群中。

<img src="https://assets.kitploit.com/production/public/readmes/5376/597d9159327adec548dc500165d9d6a62dc5781f0ca34f70e4d17446a95cdb0e.jpg" width="33%" />

## 404Starlink

<img src="https://assets.kitploit.com/production/public/readmes/5376/94f6cf110c996c1a92deed0930ecd46e3390562ce9a6e52cfb2526dab6b0c851.png" width="30%">

afrog 已加入 [404Starlink](https://github.com/knownsec/404StarLink)

## 免责声明

此工具仅用于**合法授权**的企业安全建设目的。如果您想测试此工具的功能，您应该自己构建目标环境。

为了防止恶意使用，此项目中包含的所有 PoCs 都是漏洞的理论评估。该工具不会利用漏洞、对目标发起真正的攻击或利用。

在使用此工具进行漏洞扫描时，重要的是确保您的行为符合当地法律法规，并且您已获得充分的授权。**请勿扫描未经授权的目标**。

如果您在使用此工具时从事任何非法行为，您将对任何相应的后果承担全部责任，我们不会承担任何法律或连带责任。

在安装和使用此工具之前，请**仔细彻底地阅读每个条款**。可能会以粗体或下划线突出显示可能显著影响您的权利和利益的限制、免责声明或其他条款，以引起您的注意。除非您已完全阅读、完全理解并同意本协议的所有条款，否则请勿安装或使用此工具。您使用该工具或以任何其他明示或暗示的方式接受本协议将被视为您承认并同意受本协议约束。