Skip to content
Deepak Gupta markRecon Atlas

Port scanning

Naabu

Go port scanner doing fast SYN, CONNECT and UDP scans across hosts, CIDRs and ASNs, with CDN exclusion and Nmap hand-off.

Passive and active modesScope a pentestAudit your own exposure

6.4k stars · last push November 9, 2026 · v2.7.0 · MIT

GitHub repositoryOfficial docs

What it finds

Naabu enumerates open ports on hosts, IPs, CIDRs or ASNs using SYN, CONNECT or UDP probes and lists every port that replies. It defaults to Nmap's top 100 ports, can skip full scans of CDN/WAF IPs, and can detect service versions using a local nmap-service-probes file. A `-passive` mode reads open ports from Shodan InternetDB instead of scanning.

  • open TCP ports
  • open UDP ports
  • live hosts (host discovery)
  • service names and versions
  • CDN/WAF in use

Does it touch the target?

Has a passive mode and active modes. The active modes need the owner's permission.

Active by default: it "does fast SYN/CONNECT/UDP scans on the host/list of hosts and lists all ports that return a reply." The `-passive` flag switches to "display passive open ports using shodan internetdb api" with no packets to the target.

API keys: Scanning and `-passive` need no key; a ProjectDiscovery cloud (pdcp) API key is only used for the optional `-dashboard` upload of results.

Install

Install with go
go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest

From the project's documentation

Install with package
sudo apt install -y libpcap-dev

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Scan the default top 100 ports on one host
naabu -host example.com

From the project's documentation

Scan specific TCP ports plus UDP 53
naabu -p 80,443,21-23,u:53 -host example.com

From the project's documentation

Pipe open ports into httpx to find web servers
echo example.com | naabu -silent | httpx -silent

From the project's documentation

Run nmap service detection on the ports naabu found
echo example.com | naabu -nmap-cli 'nmap -sV -oX nmap-output'

From the project's documentation

Output formats: txt, json, csv, nmap-xml, nmap-grepable

Limits the project documents

  • Requires the libpcap library (Npcap on Windows) for packet capturing.
  • "For best results, run naabu as root user"; without root it runs a CONNECT scan instead of SYN.
  • Raising `-rate` "may lead to increased false-positive rates."
  • "As default naabu is configured with a assumption that you are running it from VPS"; tune flags and rate on a local system.
  • "Naabu allows arbitrary binary execution as a feature to support nmap integration."
  • `-sV` needs a local nmap install for the nmap-service-probes database, which naabu does not ship.
  • IPv6 scanning is marked experimental; CDN exclusion covers only Cloudflare, Akamai, Incapsula and Sucuri.
  • Runtime banner: "Use with caution. You are responsible for your actions."

Deepak's take

Analysis, not documentation

Use it when
Use it to sweep many hosts or a whole ASN for open ports quickly, then pipe results into httpx or nmap. CDN exclusion avoids wasting scans on edge IPs.
Skip it when
For deep per-host fingerprinting, OS detection or scripted checks, run nmap directly. For Internet-scale ranges at millions of packets per second, masscan is built for that.
What it will miss
It reports reachable ports, not the hostnames or subdomains you have not supplied, and passive mode only knows what InternetDB has seen.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Licence: MIT. Naabu is a trademark or project name of its owners; this library is not affiliated with it.