Naabu

Fast port scanner by ProjectDiscovery with service discovery and Nmap integration

Recon & OSINT12 commands

#port-scanner#recon#network#projectdiscovery#enumeration

Installation

1Install using Go

2Install via apt

3Verify installation

# Using Go
go install github.com/projectdiscovery/naabu/v2/cmd/naabu@latest

# Linux via apt
sudo apt install naabu

# Verify
naabu --version

Basic Usage

Discover open ports on targets with fast SYN scanning

# Scan single host
naabu -host example.com

# Scan multiple hosts
naabu -list hosts.txt

# Scan specific ports
naabu -host example.com -p 80,443,8080,8443

# Scan port range
naabu -host example.com -p 1-1000

# Fast top 100 ports
naabu -host example.com -top-ports 100

# Output with Nmap service detection
naabu -host example.com -nmap-cli "nmap -sV"

# JSON output
naabu -host example.com -json -o results.json

Command Reference

12 commands

1Target host or IP

-host

2File with host list

-list

3Ports to scan

-p

4Top N ports to scan

-top-ports

5Ports to exclude

-exclude-ports

6Packets per second

-rate

7Timeout in milliseconds

-timeout

8Nmap command for service detection

-nmap-cli

9JSON output format

-json

10Output file

-o

11Verbose output

-v

12Verify ports with TCP connect

-verify

When to Use

Fast port scanning during recon

Discovering web servers and services

Mass scanning of IP ranges

Integration with automation pipelines

Preliminary scan before Nmap detailed enumeration

Notes & Tips

Requires root privileges for SYN scan on Linux

Top 1000 ports covers most common services

Use -verify for TCP connect scan (no root required)

Pipe results to httpx for HTTP service probing

Common Errors & Solutions

Permission denied (SYN scan)

Run with sudo or use -verify flag for TCP connect scan

No ports found

Try -top-ports full or scan broader range. Some hosts block SYN probes

# Scan single host naabu -host example.com # Scan multiple hosts naabu -list hosts.txt # Scan specific ports naabu -host example.com -p 80,443,8080,8443 # Scan port range naabu -host example.com -p 1-1000 # Fast top 100 ports naabu -host example.com -top-ports 100 # Output with Nmap service detection naabu -host example.com -nmap-cli "nmap -sV" # JSON output naabu -host example.com -json -o results.json