Frogscope points at your internet-facing estate - domains, IP addresses, or address ranges - and tells you three things:
- What's actually out there. Every reachable host, port, certificate, and piece of DNS data, correlated together.
- What needs fixing, in plain English, ranked by how much it matters.
- What changed since the last time you scanned.
Everything runs from one Docker container. No cloud account, no per-asset pricing, no sending your asset list to a third party.
Most external-scanning tools do one of two things badly: they either flood you with thousands of "findings" that are actually the same proxy port counted thirteen times, or they need a heavyweight platform and a support contract to run at all.
Frogscope was built to do the boring part right - tell a real exposed service apart from scan noise, tell a domain you own apart from one that just happens to share a certificate - so the list you're staring at on a Monday morning is short enough to actually work through.
- Counts services, not rows. A Cloudflare-fronted site answering on thirteen proxy ports is one service, not thirteen findings.
- Never guesses at severity from a version banner. Every finding is
labelled
confirmed,probable, orpossible- a fingerprint match stayspossibleno matter how scary the underlying flaw sounds. - Analysis never touches the network. Only the scan step does. Scoring, diffing, and everything you click through in the UI runs entirely offline against data already collected.
- Takes domains, IPs, and CIDR ranges - mixed freely, one scan. Not domains only. DNS, network, and TLS certificate correlation run automatically, on every scan, regardless of what you fed it.
- Every detection is an editable config file, not code. Scoring weights,
fingerprints, takeover providers, environment keywords - all in
config/. Tune it for your estate without touching Python. - Honest about what it can't see. A dashboard that goes quiet about its own blind spots is worse than no dashboard - Frogscope tells you outright what a scan did and didn't check.
Pentest / Red team - recon before an engagement. Point it at the client's domains and IP ranges, get the full attack surface in one pass: forgotten subdomains, exposed admin panels and management consoles, subdomain-takeover candidates, weak/default certificates. Use the findings list as your initial target shortlist, export a workbook for the report.
SecOps - continuous exposure monitoring. Schedule recurring scans per project, and use What changed to see exactly what appeared, vanished, or shifted since last time - new host, new open port, a cert that flipped to self-signed. Feed alerts to your existing tooling via webhook.
AppSec - track what's actually running. Technology and web-server inventory, end-of-life software, version disclosure, default/parked pages - all searchable and filterable from the Summary table's Software and Application quick filters. Turns "what's our exposure to CVE-X" from a Slack thread into a filtered grid.
Vulnerability Management - the asset inventory you need before you can even scan for vulnerabilities. "What do we actually have on the internet" is usually the hardest part of a VM program to answer honestly - Frogscope answers it, with ownership tagging and a risk score to help prioritize what a traditional vuln scanner should look at first.
You need Docker and Docker Compose. Nothing else.
git clone https://github.com/iamthefrogy/frogscope
cd frogscope
docker compose up --buildWatch the logs for a line like:
Frogscope access key (save this): yLA8CX7N-T3BWYZN-wwVQUN3y-HFSRirvk6O3Z7dY74
Copy that key - it's generated once, the first time the container starts, and never printed again. You'll paste it into the browser on first visit.
Open http://127.0.0.1:8099, paste the key, and you're in. Light theme by default - toggle to dark with the ☾ button, top right; it's remembered on this browser after that.
That's the whole install. Your data lives in a Docker volume and survives
restarts; ./config is mounted from your checkout so any tuning survives a
rebuild.
A project is one target - a client engagement, your own company, a business unit. Create one, then paste your targets into the scan box: domains, IP addresses, or CIDR ranges, one per line or comma-separated, mixed freely.
acme.com
acme.co.uk
203.0.113.0/24
198.51.100.42
Tick the authorisation checkbox (you're confirming you're allowed to scan these), then either press Start scan and wait, or press Schedule scan to set up a recurring scan right from the same pane instead - see Scheduled scanning. A scan enumerates subdomains, port-scans, probes what's live, and pulls DNS/network/TLS data automatically - no extra toggles to remember; everything httpx can collect is collected, every time.
| Section | What it's for |
|---|---|
| Summary | One big table of every asset, worst risk score first, every column shown by default. |
| What to fix | Every issue, ranked by severity, with evidence and how to fix it. Start here day-to-day. |
| What changed | New, gone, or modified since any previous scan of this project, grouped into Risk / Applications / Infrastructure. |
| Configuration | Run/manage scans and projects, set up scheduled scanning, see what a scan could and couldn't check. |
All assets - every host, every column shown by default, fully filterable and searchable, sorted by risk score first. Don't want a column? Uncheck it in Columns, then Remember columns so that selection is what you see next time you open the tab (per browser, not shared with anyone else). A row of chips above the table narrows the same data to one slice, so you're never looking at a different data source, just a filtered view of it:
- Network - IPs, DNS records, PTR data, CIDR blocks, dangling-record candidates.
- Application - the runtime side: status codes, titles, redirects, exposed panels.
- Certificates - TLS certs: expiry, self-signed, mismatched, wildcard scope, what other domains a cert covers.
- On-Prem / Cloud - the same assets split by whether they sit behind a known cloud/CDN provider or not.
- Software - a different shape of data (grouped by product, not one row per endpoint), so this chip opens its own page: web servers, detected technologies, end-of-life products, WordPress plugins.
Click any row to open the drawer - full detail for that one endpoint, including related hosts sharing the same IP or certificate.
Set one up from the scan pane directly (press Schedule scan instead of Start scan), or manage existing schedules from Configuration - hourly, daily, or weekly. Useful for anything meant to stay watched continuously rather than scanned once and forgotten.
CSV / Excel - from the Summary table, respects your current filter and
chip. There is no manual upload path - every scan goes through the UI (or
frogscope scan from the CLI), so a run's provenance is never in question.
Frogscope asks you to confirm you're authorised to scan a target and records that you did - it does not and cannot verify it. Only scan what you own or have explicit written permission to test.