repository·dev·Indexed 27 days ago
https://github.com/projectdiscovery/naabuA fast and reliable port scanning tool written in Go that performs SYN, CONNECT, and UDP scans to enumerate valid ports for hosts. It supports host discovery via various ping methods (ARP, ICMP, TCP), service discovery and version detection using nmap-service-probes, and integration with Nmap via the -nmap-cli flag. Naabu provides JSON output, metrics monitoring, and the ability to be used as a Go library via the runner package.
Before installing Naabu, you must install the libpcap library for packet capturing:
sudo apt install -y libpcap-devbrew install libpcapOnce the prerequisite is met, you can install Naabu using Go:
go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latestNaabu can perform host discovery to identify active hosts before or instead of port scanning.
-wn or -with-host-discovery.-sn or -host-discovery.-show-dead to see hosts that did not respond (requires host discovery).Available probe types (require host discovery to be enabled):
-ps, -probe-tcp-syn <ips>: TCP SYN Ping-pa, -probe-tcp-ack <ips>: TCP ACK Ping-pe, -probe-icmp-echo: ICMP echo request Ping-pp, -probe-icmp-timestamp: ICMP timestamp request Ping-pm, -probe-icmp-address-mask: ICMP address mask request Ping-arp, -arp-ping: ARP ping-nd, -nd-ping: IPv6 Neighbor Discovery-rev-ptr: Reverse PTR lookup for input IPsIf nmap is installed on your system, you can use the -nmap-cli flag to run Nmap commands on the ports discovered by Naabu. This allows for advanced service discovery or additional Nmap-specific scans.
echo hackerone.com | naabu -nmap-cli 'nmap -sV -oX nmap-output'To perform a basic scan on a single host, use the -host flag. You can use the -v flag for verbose output. To scan multiple hosts from a file, use the -list flag. You can also provide an ASN to scan all IP addresses associated with it.
Common port scanning patterns:
-p with Nmap-style syntax (e.g., 80,443,21-23).u: (e.g., u:53).-p - to scan all ports from 1-65535.-exclude-ports to skip specific ports.-top-ports 100 or -top-ports 1000 to scan Nmap's top port lists.Naabu supports uploading scan results to the ProjectDiscovery UI dashboard. This can be enabled via several flags or automatically if cloud upload is enabled in the environment. When enabled, you can view your results at https://cloud.projectdiscovery.io/assets after the scan completes.
To enable asset uploading, you can use the following options:
-asset-upload or similar internal triggers).AssetID using -asset-id.AssetName using -asset-name.TeamID using -team-id.Note: If you do not see the dashboard option, ensure you have configured your credentials for naabu.
Naabu supports graceful shutdowns and scan resumption. If the process receives an interrupt signal (like SIGINT or SIGTERM), it attempts to:
ResumeCfg is configured and supports saving.Upon a successful (non-interrupted) execution, Naabu will automatically clean up the resume configuration files.
Naabu can identify services and detect versions using nmap-service-probes.
-sD or -service-discovery to identify services by port number.-sV or -service-version to detect service versions.-sV-fast to only probe port-hinted services (skips fallback for speed).-sV-timeout <duration> to set the timeout for version probes (default 5s).-sV-workers <int> to set concurrent workers (default 25).-sV-probes <path> to specify a custom nmap-service-probes file.-uP or -udp-probes to send protocol-specific payloads on UDP scans.You can integrate Naabu into your Go applications using the runner package.
runner.NewRunner(&options) to initialize the scanner.OnResult callback to process results after the scan completes.OnReceive callback to process results in real-time as ports are discovered.RunEnumeration(context.Background()) to start the scan.package main
import (
"log"
"context"
"github.com/projectdiscovery/goflags"
"github.com/projectdiscovery/naabu/v2/pkg/result"
"github.com/projectdiscovery/naabu/v2/pkg/runner"
)
func main() {
options := runner.Options{
Host: goflags.StringSlice{"scanme.sh"},
ScanType: "s",
OnResult: func(hr *result.HostResult) {
log.Println(hr.Host, hr.Ports)
},
Ports: "80",
}
naabuRunner, err := runner.NewRunner(&options)
if err != nil {
log.Fatal(err)
}
defer naabuRunner.Close()
naabuRunner.RunEnumeration(context.Background())
}Naabu supports a wide range of flags for controlling scan behavior, input/output, and service discovery.
Note: Some flags are deprecated (e.g., -nmap, -Pn, -stats). Always check naabu -h for the most current usage.
Usage:
naabu [flags]
INPUT:
-host string[] hosts to scan ports for (comma-separated)
-list, -l string list of hosts to scan ports (file)
-exclude-hosts, -eh string hosts to exclude from the scan (comma-separated)
-exclude-file, -ef string list of hosts to exclude from scan (file)
PORT:
-port, -p string ports to scan (80,443, 100-200)
-top-ports, -tp string top ports to scan (default 100) [full,100,1000]
-exclude-ports, -ep string ports to exclude from scan (comma-separated)
-ports-file, -pf string list of ports to scan (file)
-port-threshold, -pts int port threshold to skip port scan for the host
-exclude-cdn, -ec skip full port scans for CDN/WAF (only scan for port 80,443)
-display-cdn, -cdn display cdn in use
RATE-LIMIT:
-c int general internal worker threads (default 25)
-rate int packets to send per second (default 1000)
UPDATE:
-up, -update update naabu to latest version
-duc, -disable-update-check disable automatic naabu update check
OUTPUT:
-o, -output string file to write output to (optional)
-j, -json write output in JSON lines format
-csv write output in csv format
SERVICES-DISCOVERY:
-sD, -service-discovery identify services by port number
-sV, -service-version detect service versions using nmap-service-probes
-sV-fast only probe port-hinted services (faster, skips fallback)
-sV-timeout duration timeout for service version probes (default 5s)
-sV-workers int number of concurrent service version workers (default 25)
-sV-probes string custom nmap-service-probes file path (auto-detected from local nmap install if empty)
-uP, -udp-probes send protocol-specific payloads on UDP scans using nmap-service-probes
CONFIGURATION:
-config string path to the naabu configuration file (default $HOME/.config/naabu/config.yaml)
-scan-all-ips, -sa scan all the IP's associated with DNS record
-ip-version, -iv string[] ip version to scan of hostname (4,6) - (default 4,6) (default ["4","6"])
-scan-type, -s string type of port scan (SYN/CONNECT) (default "c")
-source-ip string source ip and port (x.x.x.x:yyy - might not work on OSX)
-cp, -connect-payload string payload to send in CONNECT scans (optional)
-interface-list, -il list available interfaces and public ip
-interface, -i string network Interface to use for port scan
-nmap invoke nmap scan on targets (nmap must be installed) - Deprecated
-nmap-cli string nmap command to run on found results (example: -nmap-cli 'nmap -sV')
-r string list of custom resolver dns resolution (comma separated or from file)
-proxy string socks5 proxy (ip[:port] / fqdn[:port]
-proxy-auth string socks5 proxy authentication (username:password)
-dns-order string dns resolution order (p/l/lp/pl) (default "l")
-sr, -system-resolver use system DNS as fallback resolver
-resume resume scan using resume.cfg
-stream stream mode (disables resume, nmap, verify, retries, shuffling, etc)
-passive display passive open ports using shodan internetdb api (automatically enables stream mode)
-irt, -input-read-timeout value timeout on input read (default 3m0s)
-no-stdin Disable Stdin processing
HOST-DISCOVERY:
-sn, -host-discovery Perform Only Host Discovery
-show-dead show hosts that did not respond to host discovery (requires host discovery)
-Pn, -skip-host-discovery Skip Host discovery (Deprecated: use -wn/-with-host-discovery instead)
-wn, -with-host-discovery Enable Host discovery
-ps, -probe-tcp-syn string[] TCP SYN Ping (host discovery needs to be enabled)
-pa, -probe-tcp-ack string[] TCP ACK Ping (host discovery needs to be enabled)
-pe, -probe-icmp-echo ICMP echo request Ping (host discovery needs to be enabled)
-pp, -probe-icmp-timestamp ICMP timestamp request Ping (host discovery needs to be enabled)
-pm, -probe-icmp-address-mask ICMP address mask request Ping (host discovery needs to be enabled)
-arp, -arp-ping ARP ping (host discovery needs to be enabled)
-nd, -nd-ping IPv6 Neighbor Discovery (host discovery needs to be enabled)
-rev-ptr Reverse PTR lookup for input ips
OPTIMIZATION:
-retries int number of retries for the port scan (default 3)
-timeout int millisecond to wait before timing out (default 1000)
-warm-up-time int time in seconds between scan phases (default 2)
-ping ping probes for verification of host
-verify validate the ports again with TCP verification
-ss, -smart-scan predictive port scanning using port correlation model (not compatible with stream mode)
-pt, -prediction-threshold int minimum confidence for port predictions (0-100%) (default 20)
DEBUG:
-health-check, -hc run diagnostic check up
-debug display debugging information
-verbose, -v display verbose output
-no-color, -nc disable colors in CLI output
-silent display only results in output
-version display version of naabu
-stats display stats of the running scan (deprecated)
-si, -stats-interval int number of seconds to wait between showing a statistics update (deprecated) (default 5)
-mp, -metrics-port int port to expose naabu metrics on (default 63636)
CLOUD:
-auth configure projectdiscovery cloud (pdcp) api key (default true)
-ac, -auth-config string configure projectdiscovery cloud (pdcp) api key credential file
-pd, -dashboard upload / view output in projectdiscovery cloud (pdcp) UI dashboard
-tid, -team-id string upload asset results to given team id (optional)
-aid, -asset-id string upload new assets to existing asset id (optional)
-aname, -asset-name string assets group name to set (optional)
-pdu, -dashboard-upload string upload naabu output file (jsonl) in projectdiscovery cloud (pdcp) UI dashboardhttp://localhost:63636/metrics. You can change the port using the -metrics-port flag.AssetFileUpload option, Naabu will decode the file and treat each entry as a runner.Result, converting them into result.HostResult objects for processing.-exclude-cdn flag. Supported providers include cloudflare, akamai, incapsula, and sucuri.