Naabu: The Definitive
Professional's Guide.
Every flag. Every scan mode. Every integration pattern. From the physics of raw socket scanning to full CI/CD pipeline integration and ProjectDiscovery Cloud — the complete Naabu reference for practitioners running authorized engagements against real enterprise infrastructure.
Authorized use only. All techniques, flags, and workflows in this post are for systems you own or have explicit written authorization to test. Unauthorized port scanning violates the CFAA, Computer Misuse Act, and equivalent statutes worldwide. ROO SECURE IT SOLUTIONS publishes this content exclusively for defensive security awareness and authorized penetration testing professionals.
01 Why Nmap Breaks at Enterprise Scale
Nmap is a 25-year masterpiece of network engineering. For lab environments, CTF boxes, and single-host engagements it remains unrivalled in feature depth. But point it at a large enterprise's external attack surface and two hard physical constraints destroy the workflow.
A Fortune 500 may own 65,000 IP addresses. Scanning all 65,535 ports across that range generates over four billion packets. At Nmap's default rate, that is a multi-day operation — far beyond any practical engagement window.
Platforms like Darktrace, Vectra, and Palo Alto Cortex baseline normal traffic. Slow, polite TCP handshakes from a single external IP trigger behavioral anomaly scoring. Your source IP is blacklisted before you reach port 80.
Every Nmap TCP connection maintains kernel state — connection tables, buffers, wait timers. At scale this exhausts system resources long before bandwidth is saturated, creating artificial ceilings on scan throughput.
Naabu, built and maintained by Project Discovery, solves all three. It uses raw sockets to bypass OS state tracking entirely, implements token-bucket rate limiting to prevent self-saturation, and provides CDN awareness to avoid wasted scans and global CDN blocklists.
02 Raw Sockets: The Physics of Speed
The speed difference between Naabu and Nmap isn't a matter of configuration — it's architectural. Every normal network program routes through the OS kernel's TCP/IP stack. The kernel builds full connections, allocates file descriptors, waits for acknowledgements, and logs everything. This is intentional, safe behavior for application software. For security scanning at scale it's catastrophically slow.
Naabu bypasses the OS network stack entirely. Using raw sockets, it writes packet bytes directly to the network interface. It constructs each packet from scratch and reads raw frames off the wire with libpcap before the kernel even processes them. No state tracking. No connection tables. No kernel overhead.
This architecture is shared with Masscan and Zmap — tools capable of scanning the entire IPv4 internet in under six minutes with sufficient bandwidth. Naabu applies the same engine to targeted professional engagements, adding enterprise-specific features those pure-speed tools lack.
Raw socket operations require elevated privileges. Run as root, or grant the specific capability: sudo setcap cap_net_raw+eip $(which naabu). This avoids running an entire shell session as root while giving Naabu the exact permission it needs.
03 Installation — All Methods
Method 1: Go Install (Recommended — Always Latest)
# Prerequisite: raw packet capture library $ sudo apt install libpcap-dev -y # Prerequisite: Go 1.21+ (skip if installed) $ sudo apt install golang-go -y # Install latest Naabu from source $ go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest # Add Go binary path to shell $ echo 'export PATH=$PATH:$(go env GOPATH)/bin' >> ~/.bashrc && source ~/.bashrc # Verify $ naabu -version
Method 2: Kali APT (Stable, May Lag Behind Latest)
$ sudo apt update && sudo apt install naabu -y $ naabu -version
Method 3: Pre-Built Binary (Air-Gapped / No Go Toolchain)
$ wget https://github.com/projectdiscovery/naabu/releases/latest/download/naabu_linux_amd64.zip $ unzip naabu_linux_amd64.zip $ sudo mv naabu /usr/local/bin/ && sudo chmod +x /usr/local/bin/naabu
Method 4: Docker
$ docker pull projectdiscovery/naabu:latest # Run with host networking for raw socket access $ docker run --rm --net=host -v $(pwd):/data projectdiscovery/naabu:latest -list /data/targets.txt -top-ports 1000 -json -o /data/results.json
Self-Update and Health Check
# Update Naabu in-place $ naabu -update # Disable auto-update check on every run (useful in CI) $ naabu -disable-update-check -list targets.txt -top-ports 100 # Diagnostic: checks libpcap, interfaces, root permissions $ naabu -health-check # List all available network interfaces and their public IPs $ naabu -interface-list
04 Scan Modes: SYN vs CONNECT vs UDP
Naabu supports three distinct scanning methods controlled by the -scan-type flag. Choosing the right mode determines both your detection profile and result accuracy.
- Sends TCP SYN, reads RST or SYN-ACK off the wire via libpcap
- Never completes handshake — no connection entry in target logs
- Requires root or CAP_NET_RAW capability
- Fastest mode — no wait for connection teardown
- May be blocked by host-based firewalls tracking only ESTABLISHED
- Default when running as root on Linux
- Uses OS
connect()syscall — full three-way handshake - Works without root privileges
- Leaves complete connection log entries on target
- More compatible with complex paths: proxies, NAT, tunnels
- Slightly slower; works through SOCKS5 proxies
- Default when not running as root
Verification Pass
SYN scanning can produce false positives — firewall rate-limit RSTs look identical to a real port's RST response. The -verify flag runs a second CONNECT-based confirmation pass on every port flagged open during SYN scanning, eliminating false positives at the cost of additional time and log entries on the target.
# SYN scan — stealth, requires root $ sudo naabu -host target.com -scan-type s -top-ports 1000 # CONNECT scan — no root required, works through proxies $ naabu -host target.com -scan-type c -top-ports 1000 # SYN scan with TCP verification pass (eliminates false positives) $ sudo naabu -list targets.txt -top-ports 1000 -rate 3000 -verify
05 Complete Flag Reference
Every Naabu flag as of v2.4.0, organized by category with types, defaults, and operational context.
FlagShortTypeDefaultDescription // INPUT -host—string[]—Hosts to scan, comma-separated. Accepts IPs, hostnames, CIDR ranges, ASNs. -list-lstring—File of hosts to scan, one per line. Supports mixed IPs, hostnames, CIDRs, ASNs. -exclude-hosts-ehstring—Comma-separated hosts to exclude from the scan entirely. -exclude-file-efstring—File of hosts to exclude. Maintain this as your per-engagement out-of-scope list. // PORT -port-pstring—Specific ports:80,443; ranges: 8000-9000; combined: 22,80,8000-9000.
-top-ports-tpstring100Preset port lists. Values: 100, 1000, or full (all 65535 ports).
-exclude-ports-epstring[]—Ports to exclude. File path or comma-separated list.
-ports-file-pfstring[]—Custom port list file. Maintain engagement-specific scope port definitions here.
-port-threshold-ptsint—Skip full scan for any host already showing N+ open ports. Stops scanning tarpits and honeypots.
-exclude-cdn-ecboolfalseDetect CDN/WAF IPs; limit those to port 80/443 only. Prevents global CDN blocklisting.
-display-cdn-cdnboolfalseShow which CDN provider is detected for each CDN IP in output.
// RATE-LIMIT
-c—int25Concurrent goroutine workers for DNS resolution and host management. Lightweight — safely scale to 100–200.
-rate—int1000Packets per second. 1000 = conservative default. 3000 = standard VPS sweet spot. 10000+ = dedicated server.
// CONFIGURATION
-config—string~/.config/naabu/config.yamlPath to YAML config file. Sets persistent defaults for every run.
-scan-all-ips-saboolfalseQuery all A/AAAA records and scan every resolved IP. Critical for CDN and load-balanced targets.
-ip-version-ivstring[]4,6IP versions to scan. Use -iv 4 to restrict IPv4 only.
-scan-type-sstringcScan method: s (SYN, root required) or c (CONNECT, no root).
-source-ip—string—Override source IP:port — x.x.x.x:port. Useful for multi-homed servers. May not work on macOS.
-interface-istring—Specify network interface to use, e.g. eth0 or tun0 for VPN.
-interface-list-ilboolfalseList all available network interfaces and their assigned public IPs.
-nmap-cli—string—Run this Nmap command on discovered open ports. Example: -nmap-cli 'nmap -sV -sC'.
-r—stringsystemCustom DNS resolvers: comma-separated IPs or a file. Use internal DNS on internal engagements.
-proxy—string—SOCKS5 proxy for CONNECT scans: ip:port or fqdn:port. SYN mode bypasses proxies entirely.
-proxy-auth—string—SOCKS5 proxy authentication: username:password.
-passive—boolfalsePassive port enumeration via Shodan InternetDB. Zero packets sent to target.
-resume—boolfalseResume an interrupted scan from resume.cfg. Essential for long enterprise scans.
-stream—boolfalseOutput results immediately as found. Disables resume/verify/retries. Ideal for pipeline chaining.
-connect-payload-cpstring—Custom payload sent during CONNECT scan handshakes.
-no-stdin—boolfalseDisable STDIN processing — use when STDIN is occupied in complex scripts.
-input-read-timeout-irtduration3mTimeout waiting for input from STDIN before abandoning.
// OPTIMIZATION
-retries—int3Retry attempts per port. Reduce to 1 for speed on stable low-latency networks.
-timeout—duration1sResponse wait time. Increase to 2s–5s for high-latency or geographically distant targets.
-warm-up-time—int2Seconds between scan phases. Allows in-flight packets to return before phase transition.
-ping—boolfalseICMP ping verification of each host before beginning port scanning.
-verify—boolfalseSecond CONNECT-based pass on SYN-discovered open ports. Eliminates false positives from firewall RSTs.
// HOST-DISCOVERY
-host-discovery-snboolfalseDiscover live hosts only — skip port scanning entirely.
-skip-host-discovery-PnboolfalseAssume all hosts alive; skip discovery and proceed directly to port scanning.
-with-host-discovery-wnboolfalseRun host discovery concurrently alongside port scanning (experimental).
-probe-tcp-syn-psstring[]—TCP SYN probe to specific ports for host discovery. E.g. -ps 80,443,22.
-probe-tcp-ack-pastring[]—TCP ACK probe for discovery. Bypasses stateless ACLs that pass established-session traffic.
-probe-icmp-echo-peboolfalseStandard ICMP echo request ping for host discovery.
-probe-icmp-timestamp-ppboolfalseICMP timestamp request — passes through some firewalls that block echo specifically.
-probe-icmp-address-mask-pmboolfalseICMP address mask probe for host discovery.
-arp-ping-arpboolfalseARP broadcast — Layer 2 only, can't be filtered by IP-layer firewalls. Guaranteed on local networks.
-nd-ping-ndboolfalseIPv6 Neighbor Discovery — equivalent of ARP for IPv6 networks.
-rev-ptr—boolfalseReverse PTR lookup for input IPs. Reveals hostnames from IP-only input lists.
// SERVICE DISCOVERY
-service-discovery-sDboolfalseEnable service fingerprinting on discovered open ports.
-service-version-sVboolfalseDetect service version on open ports (equivalent to Nmap's -sV).
// OUTPUT
-output-ostringstdoutWrite output to file. Combine with -json or -csv for structured output.
-json-jboolfalseOutput in JSON Lines format (one JSON object per line). Best for pipeline automation.
-csv—boolfalseOutput in CSV format. Useful for spreadsheet import and SIEM ingestion.
-list-output-fields-lofboolfalsePrint all available JSON output field names.
-exclude-output-fields-eofstring[]—Exclude specific fields from structured output.
// DEBUG
-health-check-hcboolfalseRun diagnostic checks: permissions, libpcap, interface, network connectivity.
-debug—boolfalseDisplay all internal debug messages. Extremely verbose — use only for troubleshooting.
-verbose-vboolfalseShow additional detail about each scan step without full debug output.
-silent—boolfalsePrint only results — no banners, no info lines. Essential for clean pipe chaining.
-no-color-ncboolfalseDisable ANSI color codes. Use when output is consumed by scripts or written to log files.
-metrics-port-mpint63636Port for live Prometheus-compatible metrics endpoint during active scan.
// CLOUD (PDCP)
-auth—bool—Configure ProjectDiscovery Cloud Platform API key interactively.
-dashboard-pdboolfalseUpload scan results to PDCP dashboard automatically during/after scan.
-team-id-tidstring—Upload results to a specific PDCP team workspace.
-asset-id-aidstring—Append results to an existing PDCP asset record.
-asset-name-anamestring—Name for the asset group in PDCP (e.g. "Target Corp External Q2 2026").
-dashboard-upload-pdustring—Upload an existing Naabu JSONL output file to PDCP dashboard post-scan.
06 Input: Hosts, Lists, CIDRs, ASNs, and STDIN
Naabu accepts targets in every format you encounter during a real engagement. The tool automatically resolves hostnames, deduplicates IPs across multiple subdomains pointing to the same address, and handles mixed input types in a single file without any pre-processing on your end.
Single Host / IP
$ naabu -host target.com -top-ports 1000 $ naabu -host 192.168.1.100 -top-ports 1000 $ naabu -host target1.com,target2.com,192.168.1.0/24 -top-ports 100
File Input with Mixed Formats
# Hostnames api.target.com admin.target.com # Raw IPs 10.0.1.5 203.0.113.42 # CIDR ranges 192.168.0.0/24 10.10.0.0/16 # ASN — resolves to all IP blocks owned by that autonomous system AS15169
STDIN Pipeline Input
$ subfinder -d target.com -silent | naabu -top-ports 1000 -rate 3000 -silent $ amass enum -d target.com | naabu -top-ports 1000 -silent $ echo "target.com" | naabu -top-ports 1000
Exclusion Scoping
$ naabu -list targets.txt -exclude-hosts 10.0.0.1,10.0.0.254 -exclude-file oos.txt -top-ports 1000 -rate 3000
Automatic IP Deduplication
When you feed Naabu a subdomain list, it resolves every hostname and deduplicates the resulting IPs before scanning. If api.target.com, app.target.com, and www.target.com all resolve to 203.0.113.10, Naabu scans that IP exactly once. This prevents redundant scan traffic and keeps your effective packet rate honest — without deduplication, your actual rate silently multiplies by the number of duplicate resolutions.
07 Port Selection Strategy
Which ports you scan determines both your scan duration and how much real attack surface you uncover. Naabu's port selection is more flexible than any fixed-preset tool.
The 100 statistically most common ports. Good for fast triage when you need initial results in seconds. Misses uncommon web admin panels, dev ports, and non-standard services.
The professional standard. Covers 95%+ of real-world attack surface including most admin panels, dev environments, and database ports. Reasonable scan time on large target lists.
All 65,535 ports. Required when nothing can be missed. Significantly longer — plan your scan window and use -resume to handle interruptions.
# Specific ports $ naabu -host target.com -p 22,80,443,8080,8443 # Port range $ naabu -host target.com -p 8000-9000 # Combined: specific + ranges $ naabu -host target.com -p 22,80,443,3000-3100,8080-8090 # From a custom file (one port per line) $ naabu -host target.com -ports-file bb-high-value.txt # Exclude specific ports $ naabu -list targets.txt -top-ports 1000 -exclude-ports 22,23,25 # Port threshold: skip hosts with too many open ports (tarpits / honeypots) $ naabu -list targets.txt -top-ports 1000 -port-threshold 10
Maintain a custom bb-high-value.txt with ports the default 1000 misses but that appear constantly in findings: 4848 (GlassFish), 9200 (Elasticsearch), 27017 (MongoDB), 6379 (Redis), 2375 (Docker unauthenticated API), 9090 (Prometheus), 8500 (Consul), 5601 (Kibana), 15672 (RabbitMQ management), 7474 (Neo4j).
08 Rate Tuning & Concurrency
Getting rate tuning wrong is the single most common cause of missed findings. Too fast creates the saturation trap — too slow triggers behavioral IDS. Both directions cause real problems.
The Saturation Trap
Setting -rate 100000 on a standard VPS produces zero results. Your VPS NIC and upstream router have finite queue depths. When you push more packets per second than they can process, the router silently drops packets. Target responses arrive but are discarded before libpcap sees them. Every host reports all ports closed — false negatives across the board.
$ sudo naabu -list 10k-subdomains.txt -top-ports 1000 -c 100 "" # 100 goroutines for DNS throughput # pyright: ignore[reportInvalidStringEscapeSequence] # type: ignore -rate 5000 "" # tune to your connection -retries 2 "" # reduce from default 3 for speed -timeout 500ms "" # shorter on fast internal networks -exclude-cdn -scan-all-ips -json -o results.json
The -c flag controls goroutines for DNS resolution parallelism — not raw packet throughput. Go goroutines are extremely lightweight (a few KB each). Safely scale -c to 100–200. The raw packet rate is governed exclusively by -rate.
09 Host Discovery — All Probe Methods
Running a full 1000-port scan against an offline host wastes 1,000 packet slots per dead IP. Naabu's host discovery cleanly separates alive-checking from port scanning. It supports every probe method Nmap offers plus some that Nmap doesn't.
Two-Phase: Discover Then Scan
# Phase 1: find live hosts across entire /16 $ sudo naabu -host 10.0.0.0/16 -host-discovery -probe-icmp-echo -probe-tcp-syn 80,443,22 -probe-tcp-ack 80 -arp-ping -rate 10000 -silent -o live-hosts.txt # Phase 2: full port scan against only confirmed live hosts $ sudo naabu -list live-hosts.txt -skip-host-discovery -top-ports 1000 -rate 5000 -json -o ports.json
Probe Methods Explained
Standard ICMP echo request. Fastest discovery method. Blocked by most perimeter and host-based firewalls on hardened servers.
ICMP type 13 timestamp request. Passes through some firewalls that block echo (type 8) specifically but permit other ICMP types.
ICMP type 17 address mask request. Rarely blocked independently — useful when both echo and timestamp are filtered.
SYN to specified ports. Firewalls permit port 80 traffic — the SYN passes, the host returns RST or SYN-ACK. Either response confirms it's alive.
ACK to specified ports. Stateless ACL rules that pass established-session traffic (ACK bit set) may let these through. Host returns RST.
Layer 2 ARP broadcast — cannot be blocked by IP-layer firewalls. The most reliable method on local network segments.
IPv6 Neighbor Discovery. The IPv6 equivalent of ARP. Required for accurate host discovery in dual-stack environments.
Enriching with Reverse PTR
$ sudo naabu -host 203.0.113.0/24 -host-discovery -probe-icmp-echo -probe-tcp-syn 80,443 -rev-ptr -json -o discovery.json
10 CDN Detection & Bypass
Modern enterprise external infrastructure increasingly sits entirely behind CDN layers — Cloudflare, Akamai, Fastly, Imperva, Sucuri. Scanning CDN IPs directly causes two simultaneous problems: you waste your scan window because CDNs only expose web ports, and you trigger CDN threat intelligence that flags your source IP across their entire global customer base. A single scan run can lock you out of visiting half the internet.
The -exclude-cdn flag solves this by checking each resolved IP against a maintained database of CDN and WAF provider ranges. Identified CDN IPs get a lightweight port 80/443 probe only. True origin IPs get the full scan.
$ naabu -list targets.txt -exclude-cdn -display-cdn -top-ports 1000 -rate 3000 -json -o results.json
Confirm your scope documentation explicitly addresses whether CDN IPs are in or out of scope. Some engagements require testing CDN bypass to verify WAF configuration — that work needs separate tooling and explicit written authorization beyond standard port-scanning scope.
11 Smart Scan & Predictive Port Discovery
Smart scan uses a statistical model of known service co-occurrence patterns to predict which additional ports are likely open based on initial findings — and only scans those predicted ports if confidence exceeds your configured threshold. You fire a fraction of the packets while targeting only the ports most likely to yield results.
# Conservative — extend only when very confident $ naabu -list targets.txt -smart-scan -threshold 40 -rate 1000 # Aggressive — extend to lower-confidence predictions $ naabu -list targets.txt -smart-scan -threshold 10 -rate 3000 # Standard for stealth red team engagements $ naabu -list targets.txt -smart-scan -threshold 20 -rate 500 -exclude-cdn -json -o stealth.json
Smart scan trades coverage for stealth. When thoroughness matters more than packet count — comprehensive assessments, bug bounty — use -top-ports 1000. Reserve smart scan for stealth red team operations and environments with strict IDS alerting thresholds.
12 UDP Scanning: The Massive Blind Spot
Most practitioners scan only TCP. UDP gets skipped because it's connectionless — sending a blank packet to a UDP port produces no response if the service doesn't recognize the data. Your scanner records the port as closed when it's actually open and waiting for protocol-correct input. You walk past critical services on every engagement.
Naabu constructs protocol-accurate payloads from an Nmap service probe database for every UDP port it scans. Port 53 gets a real DNS query. Port 161 gets a correctly-formatted SNMP request. Port 500 gets an IKE initiation packet. The service processes the real request and responds.
$ sudo naabu -list targets.txt -udp -top-ports 100 -rate 300 "" # UDP needs lower rate — no ACKs to pace it -retries 3 "" # UDP drops — retry more than TCP -timeout 2s "" # UDP responses can arrive slowly -json -o udp.json # Combined TCP + UDP in one pass $ sudo naabu -list targets.txt -top-ports 1000 -udp -rate 2000 -json -o full.json
High-Value UDP Targets
Internal resolvers may allow recursive queries or zone enumeration. A common lateral movement entry point.
No authentication. Network devices use TFTP for config backup. Unauthenticated read/write to router configs is a critical finding.
Mode 6/7 queries leak peer lists and client IPs. Monlist on legacy implementations maps network topology.
Default community strings (public, private) leak interface tables, ARP caches, routing tables, and full device configs.
IPSec VPN endpoints. Aggressive mode leaks PSK hashes for offline cracking. Consistent finding on enterprise perimeters.
SQL Server browser discloses all instance names, versions, and ports on the host — no authentication required.
UPnP on internal printers, NAS, IoT. Used for SSRF amplification and internal network mapping without authentication.
Multicast DNS reveals service names, device types, OS versions, and hostnames on local segments — no auth needed.
Identifying DHCP servers reveals internal addressing schemes. Misconfigured DHCP enables rogue DHCP on isolated segments.
13 IPv4 / IPv6 and Automatic IP Deduplication
Modern enterprise networks are dual-stack. A domain may resolve to both an IPv4 A record and an IPv6 AAAA record pointing at completely different infrastructure — and a scan that only checks one family is incomplete. Naabu handles both protocol families by default.
# Default: scan both IPv4 and IPv6 when a local IPv6 interface exists $ naabu -host target.com -top-ports 1000 # IPv4 only $ naabu -host target.com -ip-version 4 -top-ports 1000 # IPv6 only $ naabu -host target.com -ip-version 6 -top-ports 1000 # Scan ALL resolved IPs per domain (round-robin / load balancers) $ naabu -list subdomains.txt -scan-all-ips -top-ports 1000 # Custom internal DNS resolver for on-prem engagements $ naabu -list targets.txt -r 10.0.0.53,10.0.0.54 -scan-all-ips -top-ports 1000
-scan-all-ips is non-negotiable on enterprise work. A standard DNS query returns one IP from a round-robin pool of six servers. Five are current and hardened. The sixth is a forgotten legacy dev box running a three-year-old application with known CVEs. A standard scan misses it entirely. You report all-clear and you're wrong.
14 Passive Port Enumeration via Shodan InternetDB
Sometimes you need port data on a target without sending a single packet to it — pre-authorization reconnaissance, pre-scan planning, or engagement scope sizing before your scan window opens. Naabu's -passive mode queries the Shodan InternetDB API and returns historical open-port data with zero active scan traffic.
# Zero packets to target — data from Shodan's historical scans $ naabu -host target.com -passive # Passive against a full target list $ naabu -list targets.txt -passive -json -o passive-baseline.json # Use passive for planning, then confirm with active scan during window $ naabu -list targets.txt -passive -silent > passive-ports.txt $ naabu -list passive-ports.txt -verify -rate 2000 -json -o confirmed.json
Passive results reflect Shodan's scan history — potentially days or weeks old. Use passive for pre-authorization intelligence and planning. Always validate with an active scan during your authorized window to confirm current state. The two phases together give you historical baseline plus real-time verification.
15 Nmap Integration & Service Discovery
Naabu and Nmap occupy different positions in the reconnaissance stack. Naabu finds every open port as fast as possible across a large target set. Nmap goes deep on each port — version detection, script execution, fingerprinting. The professional workflow combines both: Naabu for breadth, Nmap for depth, on only the confirmed open ports. Far faster than running Nmap's -sV across all ports on all hosts directly.
# Naabu discovers → Nmap does deep service detection on open ports only $ naabu -list targets.txt -top-ports 1000 -rate 3000 -nmap-cli 'nmap -sV -sC -oA nmap-deep' # Web-specific deep fingerprint $ naabu -host target.com -p 80,443,8080,8443 -nmap-cli 'nmap -sV --script=http-title,ssl-cert,http-methods' # Native Naabu service detection (lighter than Nmap) $ naabu -host target.com -top-ports 1000 -service-version -json -o svc.json
# List interfaces and their IPs before scanning $ naabu -interface-list # Force through VPN interface $ naabu -list targets.txt -interface tun0 -top-ports 1000 # Override source IP for multi-homed egress control $ naabu -list targets.txt -source-ip 203.0.113.50:0 -top-ports 1000
16 Output Formats: JSON, CSV, and TXT
Reading terminal output is how beginners work. Building systems that consume structured data is how professionals work. Naabu's output format determines what every downstream tool in your pipeline can do with the results.
# JSON Lines — one record per line, best for automation $ naabu -list targets.txt -top-ports 1000 -json -o results.json # CSV — for spreadsheet import and SIEM ingestion $ naabu -list targets.txt -top-ports 1000 -csv -o results.csv # Plain text — one host:port per line, for simple tool chaining $ naabu -list targets.txt -top-ports 1000 -silent -o results.txt # List available JSON output fields $ naabu -list-output-fields
{
"ip": "203.0.113.10",
"host": "api.target.com",
"port": 8080,
"protocol": "tcp",
"cdn_name": "",
"cdn": false,
"timestamp": "2026-06-22T10:14:03.221Z"
}
Automated Result Processing
#!/usr/bin/env python3 import json from collections import defaultdict with open("results.json") as f: results = [json.loads(line) for line in f if line.strip()] host_ports = defaultdict(list) for r in results: host_ports[r["ip"]].append(r["port"]) # Find exposed database services DB_PORTS = {3306, 5432, 27017, 6379, 9200, 5984, 11211, 1433, 1521, 2375} db_exposure = { host: [p for p in ports if p in DB_PORTS] for host, ports in host_ports.items() if any(p in DB_PORTS for p in ports) } print(f"Hosts with exposed database ports: {len(db_exposure)}") for host, ports in sorted(db_exposure.items()): print(f" {host}: {ports}") # Generate nuclei HTTPS target list https_targets = [ f"https://{r.get('host') or r['ip']}:{r['port']}" for r in results if r["port"] in (443, 8443) ] with open("nuclei-targets.txt", "w") as f: f.write(" ".join(https_targets))
Live Metrics During Scan
$ naabu -list targets.txt -top-ports 1000 & $ curl -s http://localhost:63636/metrics | grep naabu_ # Custom metrics port $ naabu -list targets.txt -top-ports 1000 -metrics-port 9091
17 Building Full Recon Pipelines
The Linux pipe is the backbone of professional recon automation. Naabu outputs clean host:port in -silent mode, making it natively composable with every Project Discovery tool and most security utilities.
The Full External Attack Surface Pipeline
#!/bin/bash
TARGET="${1:?Usage: $0 domain.com}"
OUTDIR="./recon-$(echo $TARGET | tr '.' '-')-$(date +%Y%m%d-%H%M)"
mkdir -p "$OUTDIR"
echo "[+] Engagement output: $OUTDIR"
echo "[*] Step 1: Subdomain enumeration..."
subfinder -d "$TARGET" -silent -o "$OUTDIR/subdomains.txt"
echo "[+] Found $(wc -l < "$OUTDIR/subdomains.txt") subdomains"
echo "[*] Step 2: Port discovery..."
naabu -list "$OUTDIR/subdomains.txt" -top-ports 1000 -rate 3000 -exclude-cdn -scan-all-ips -silent -json -o "$OUTDIR/ports.json"
echo "[*] Step 3: Web surface fingerprinting..."
cat "$OUTDIR/ports.json" | jq -r '"\(.host // .ip):\(.port)"' | httpx -title -tech-detect -status-code -follow-redirects -json -o "$OUTDIR/web-surface.json"
echo "[*] Step 4: Vulnerability scanning..."
nuclei -l "$OUTDIR/subdomains.txt" -t ~/nuclei-templates -severity critical,high,medium -json -o "$OUTDIR/findings.json"
echo "[+] Done — results in $OUTDIR/"
Internal Scan Through a SOCKS5 Jump Box
# Dynamic SSH tunnel (SOCKS5) through the jump box $ ssh -D 1080 -N -f user@jumpbox.target.com # Scan internal range through tunnel — CONNECT mode only $ naabu -list internal-targets.txt -scan-type c -proxy socks5://127.0.0.1:1080 -top-ports 1000 -rate 500 -json -o internal.json
Stream Mode and Resumable Scans
# Stream mode: results flow to httpx immediately as each port is found $ naabu -list targets.txt -top-ports 1000 -rate 3000 -stream -silent | httpx -title -tech-detect -json -o live-surfaces.json # Resumable long scan — creates resume.cfg automatically $ naabu -list massive-targets.txt -top-ports full -rate 3000 -json -o results.json # [Ctrl+C at 40%] $ naabu -resume # continues exactly where it stopped
18 GitHub Actions CI/CD Scanning
Integrating Naabu into CI/CD turns port scanning from a point-in-time assessment into a continuous security control. Every deployment triggers a scan. Attack surface drift is caught before it lands in someone else's report. The scan history becomes a version-controlled audit trail.
name: Attack Surface Monitor
on:
schedule:
- cron: '0 2 * * *'
workflow_dispatch:
push:
branches: [main, production]
jobs:
naabu-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
with:
go-version: '1.21.x'
- name: Install Naabu
run: |
sudo apt-get install -y libpcap-dev
go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest
- name: Run Port Scan
run: |
naabu -list hosts.txt -top-ports 1000 -rate 2000 -exclude-cdn -disable-update-check -no-color -json -o naabu-results.json
- name: Compare Against Baseline
id: check
run: python3 .github/scripts/compare-baseline.py naabu-results.json baseline.json
continue-on-error: true
- uses: actions/upload-artifact@v4
with:
name: naabu-results-${{ github.run_id }}
path: naabu-results.json
retention-days: 90
- name: Fail on New Open Ports
if: steps.check.outcome == 'failure'
run: exit 1
#!/usr/bin/env python3
import json, sys
with open(sys.argv[1]) as f:
current = {(r["ip"], r["port"]) for line in f
if (r := json.loads(line.strip()))}
with open(sys.argv[2]) as f:
baseline = {tuple(e) for e in json.load(f)}
new_ports = current - baseline
closed_ports = baseline - current
if closed_ports:
print(f"Info: {len(closed_ports)} ports closed since last baseline")
if new_ports:
print(f"ALERT — {len(new_ports)} new open ports detected:")
for ip, port in sorted(new_ports):
print(f" + {ip}:{port}")
sys.exit(1)
print(f"OK — {len(current)} expected ports confirmed open.")
19 ProjectDiscovery Cloud Platform (PDCP)
PDCP provides centralized storage, visualization, and team collaboration for scan results across all ProjectDiscovery tools. For multi-operator engagements or clients who want continuous attack surface visibility without parsing raw JSON files, PDCP is the structured answer.
# One-time PDCP API key setup $ naabu -auth # Scan and auto-upload to PDCP dashboard $ naabu -list targets.txt -top-ports 1000 -rate 3000 -json -o results.json -dashboard -asset-name "Target Corp External — June 2026" # Upload to a specific team workspace $ naabu -list targets.txt -top-ports 1000 -json -o results.json -dashboard -team-id YOUR_TEAM_UUID # Append to an existing asset record $ naabu -list targets.txt -top-ports 1000 -json -o results.json -dashboard -asset-id EXISTING_ASSET_UUID # Upload a previously completed scan file post-facto $ naabu -dashboard-upload old-results.json -asset-name "Q1 2026 Assessment"
PDCP integrates with all ProjectDiscovery tools — Subfinder, HTTPX, Nuclei, Katana. Results from the full pipeline can be uploaded to a single asset record, giving you a unified view of the complete recon and vulnerability chain in one dashboard rather than across multiple JSON files on your local machine.
20 Config Files & Operational Security
Running Naabu with consistent settings across an engagement — or across a team of operators — requires configuration management. Naabu supports a persistent YAML config file that establishes defaults for every run without requiring full CLI flags each time.
# Default settings applied to every naabu run # Any CLI flag overrides these values rate: 3000 c: 50 retries: 2 timeout: 1000 warm-up-time: 2 scan-all-ips: true exclude-cdn: true disable-update-check: true json: true exclude-ports: - 9 - 25 - 135
Operational Security Considerations
Scan from a dedicated engagement IP — never your corporate or home address. Use separate VPS instances per client to prevent log cross-contamination between engagements.
Stick to your authorized scan window exactly. Enable -resume on all long scans so you can stop cleanly at window end and continue in the next authorized window without restarting from scratch.
Store all scan outputs with engagement metadata — client, date, scope, operator. JSON is your evidence trail for both reporting and demonstrating the exact scope of what you did and did not scan.
Before every scan, run naabu -interface-list and confirm your egress IP is correct. Scanning from the wrong interface — especially after a VPN drop — can silently take you outside authorized scope.
Maintain an explicit exclude-file for every engagement. Out-of-scope IPs, shared infrastructure, CDN ranges not owned by the client — all populated before the first packet fires.
Even with written authorization, aggressive scanning of production infrastructure during business hours can cause measurable impact. Coordinate scan timing with the client's ops team. Conservative rates during business hours, higher rates during maintenance windows.
Pre-Scan Verification Checklist
→ The Complete Engagement Workflow
The tools are fast. The architecture is composable. The workflow scales from a single asset to an organization's entire external and internal attack surface without modification — every step produces structured JSON that the next step consumes automatically. No manual intervention between phases. No reading terminal output. No guesswork.
Everything in this guide is available today, in open-source tooling, at no cost. The only variable at every point in this workflow is authorization.
Need a full-scope external attack surface assessment, internal network penetration test, or continuous attack surface monitoring for your organization? ROO SECURE IT SOLUTIONS designs and executes authorized engagements across all network layers — from initial recon through exploitation and reporting. Contact us to scope your engagement.
