zan8in/afrog
Afrog
afrog is an HTTP vulnerability scanner and web vulnerability management system that identifies security flaws and known CVEs using a YAML-based rule engine. It functions as a payload generator and scanner, comparing server responses against detection rules to find unauthorized access points.
The project provides a framework for out-of-band security testing, detecting blind vulnerabilities by triggering and verifying external DNS or HTTP callbacks. Beyond web traffic, it includes a protocol fuzzer capable of executing multi-step read and write sequences over raw TCP and SSL sockets to identify flaws in non-HTTP services.
The system covers a broad range of security capabilities, including network service discovery, dictionary-based brute forcing, and HTTP protocol fuzzing. It supports dynamic variable injection for payload construction, regex-based data extraction from responses, and the ability to store results in a database or export them as HTML and JSON reports.
Features
- Vulnerability Scanners - Provides an automated system to identify known CVEs and security flaws using a rule-based scanning engine.
- Vulnerability Scanning - Identifies known CVEs and unauthorized access points by checking targets against a library of detection rules.
- YAML-Based Check Definitions - Uses a YAML-based rule engine to evaluate security vulnerability checks via structured request and logic sequences.
- Response Value Extraction - Uses regular expressions to capture specific data from HTTP responses to populate variables for subsequent requests.
- Network Protocol Fuzzers - Executes multi-step read and write sequences over raw TCP and SSL sockets to find flaws in non-HTTP services.
- Web Vulnerability Scanning - Identifies and exploits web application vulnerabilities by checking targets against a library of detection rules.
- Payload Variable Management - Defines reusable variables with random strings and encoding options to construct flexible payloads for requests.
- Response Header Extractors - Captures specific values from response bodies or headers using regular expressions for use in subsequent rules.
- Protocol Fuzzing - Executes multi-step read and write sequences over raw TCP and SSL sockets to identify protocol-specific flaws.
- Dictionary-Based Route Probing - Performs reconnaissance by testing predefined lists of common paths and credentials to discover hidden endpoints.
- Out-of-Band Security Testing - Identifies blind vulnerabilities by triggering external network callbacks and verifying them through a remote check function.
- Proof of Concept Execution - Runs custom YAML-based rules and scripts to verify if a target system is susceptible to specific vulnerabilities.
- Out-of-Band Testing - Identifies blind vulnerabilities by triggering external network callbacks and verifying them via a remote check function.
- Vulnerability Management Systems - Provides a centralized platform for scanning targets, storing detected CVEs in a database, and exporting reports.
- YAML Security Rule Definition - Provides a system to create YAML-based rules using HTTP requests and logic expressions to identify security flaws.
- HTTP Fuzzing - Generates permutations of HTTP requests using variables to discover hidden endpoints and unexpected server behavior.
- Evasive Payload Generators - Constructs flexible HTTP requests using random variables, custom encodings, and manual header control.
- Raw HTTP Request Construction - Allows construction of manual HTTP messages to control exact header order and manage complex multi-part bodies.
- Variable Injection - Constructs flexible HTTP payloads by replacing placeholders with randomly generated or encoded values during runtime.
- PoC Execution Engines - Loads and executes user-defined rule sets from external directories to identify specific security vulnerabilities.
- Scan Result Exporters - Generates structured reports of scan findings in multiple formats such as HTML and JSON.
- Vulnerability Result Storage - Saves detected vulnerabilities to a database and provides a web interface for searching and filtering.
- Network Service Discovery - Automatically discovers active components and reachable services on a network via port scanning.
- Scan Result Exporters - Generates vulnerability reports in HTML or JSON formats including detailed request and response data.
- Port Scanners - Provides functional capabilities to identify open network ports and services across target hosts.
- Protocol Session Orchestration - Manages multi-step read and write sequences over raw TCP and SSL sockets to identify flaws in non-HTTP services.
- File Upload Security - Generates random boundaries and filenames to create self-deleting verification files to validate file upload vulnerabilities.
- Credential Brute-Forcing - Performs automated testing of paths and credentials using dictionary-based brute-forcing to find vulnerable endpoints.
- Vulnerability Report Generation - Generates detailed vulnerability reports and dashboards from scan results in HTML and JSON formats.
- Analysis Report Serialization - Transforms scan findings and audit trails into human and machine-readable reports for external analysis.
- Vulnerability Exploitation Tools - Vulnerability scanner for web applications.
- Vulnerability Scanners - High-performance vulnerability scanner with customizable PoCs.
