naabu — Network Analysis and Diagnostics

Latest Tool Guides / Network Analysis and Diagnostics / naabu.html

High-speed port scanner based on Go. Detects open ports quickly and accurately using SYN scans.

Basic Information

What is this program?

naabu is a high-speed port scanner written in Go, supporting SYN scan, CONNECT scan, and UDP scan. It is designed to be lightweight and fast, efficiently detecting open ports across a large number of hosts.

As a core tool in the ProjectDiscovery ecosystem, it can be connected via pipes with httpx, subfinder, and nuclei to build an automated security investigation pipeline. It supports various input formats like ASN, CIDR, and files.

What problem does it solve?

• Used when you need to quickly identify open ports on target hosts.
• Verifies that firewall rules are working correctly.
• Connects with httpx to filter only HTTP services among open ports.
• Identifies the full scope of service exposure in a security audit.

Key Features

SYN Scan

Detects ports quickly and accurately by utilizing the half-open (SYN) handshake state.

• Use Case: Used when both speed and accuracy are required in large-scale port scans.
• Result Obtained: Verifies port status without fully establishing a TCP connection.
• Limitations: SYN scan requires root or cap_net_raw privileges.

Top Ports Mode

Increases scan speed by selecting only the most frequently open ports (default top 100).

• Use Case: Used for a quick initial scan to check service exposure.
• Result Obtained: Confirms major service ports within seconds.
• Limitations: Non-standard ports may be missed in this mode.

ASN & CIDR Input

Supports range scanning by accepting ASN numbers or CIDR ranges as input.

• Use Case: Used to check the port exposure status of a specific ISP or cloud range.
• Result Obtained: Allows scanning an entire IP range at once.
• Limitations: Caution is needed regarding network policies and legal issues for large-scale scans.

nmap Integration

Can automatically pass discovered ports to the nmap command for in-depth analysis.

• Use Case: Used to further investigate service versions and vulnerabilities after port discovery.
• Result Obtained: Automates the naabu → nmap pipeline.
• Limitations: nmap must be installed.

Installation and Execution

Binary Download

Install from GitHub releases. Requires libpcap.

# Install libpcap (Debian/Ubuntu)
sudo apt install -y libpcap-dev

# Download binary
wget https://github.com/projectdiscovery/naabu/releases/latest/download/naabu_linux_amd64.zip
unzip naabu_linux_amd64.zip
sudo mv naabu /usr/local/bin/

# Verify installation
naabu -version

go install

Install in a Go environment.

go install -v github.com/projectdiscovery/naabu/cmd/naabu@latest

Docker

Run in an isolated Docker container.

docker pull projectdiscovery/naabu:latest
docker run -it --rm projectdiscovery/naabu -host example.com

Practical Usage Examples

Basic Port Scan

Scans for open ports on the target host.

# Scan Top 100 ports
echo "example.com" | naabu -silent

# Scan all ports
naabu -host example.com -p - -silent

Scan Specific Port Range

Scans only the specified port range.

# Scan ports 1-1024
naabu -host 192.168.1.1 -p 1-1024

# Specific port list
naabu -host example.com -p 80,443,8080,8443

Pipe with httpx

Extracts only HTTP services from open ports.

# naabu scan → httpx probing
naabu -host example.com -p 80,443,8080 -silent | httpx -silent -status-code

# Result: Shows only the port and status code for HTTP responses