projectdiscovery/naabu
Naabu
Naabu is a port scanner library and tool that probes hosts for open ports using SYN, CONNECT, and UDP methods to identify active services. It functions as a Go library for embedding port scanning into programs, and as a standalone tool that accepts targets as hostnames, IP addresses, CIDR ranges, or ASN numbers. The tool discovers live hosts before scanning, filters ports by range or top lists, and can integrate with Nmap for service version detection.
The project distinguishes itself through its SYN-based port probing approach that sends TCP SYN packets and analyzes responses without completing the full handshake, enabling faster scans. It supports passive port enumeration through external services like Shodan InternetDB, and can exclude CDN or WAF IPs from full scans. Naabu also provides a REST API for programmatic scan triggering, configuration management, and result export, alongside the ability to embed port scanning directly into Go programs with callback-based result handling.
The tool covers host discovery, port scanning, and service detection across multiple input formats and output options. It includes features for filtering scan targets, rescanning completed scans, and exposing scan metrics via HTTP. The project is available as a command-line tool and as a Go library, with support for Docker deployment.
Features
- Programmatic Scan Triggers - Initiate a port scan against specified targets through the API and receive a scan ID and status.
- Subdomain Enumeration - Discovers subdomains for a given domain using the Chaos dataset.
- Asset Profile Enrichment - Transforms raw asset data into detailed profiles through DNS analysis, HTTP probing, screenshots, and technology fingerprinting.
- Asset - Collects technology fingerprints and HTTP response details from discovered hosts to feed downstream detection pipelines.
- Programmatic Scanning APIs - Initiate vulnerability scans through a REST API by specifying targets, templates, and configuration IDs.
- Go Library Port Scanners - Embeds port scanning directly into Go programs with callback-based result handling.
- REST APIs - Exposes all scanning, enumeration, and asset management operations through a REST API.
- Go Library Integrations - Ships a Go library for embedding port scanning directly into programs with callback-based results.
- Internal Network Discoverers - Scans internal network ranges to identify hosts, services, and open ports for building an asset inventory.
- DNS Record Resolvers - Resolves DNS records to map an organization's digital footprint.
- Network Host Discoverers - Probes hosts with ARP, TCP SYN/ACK, ICMP, or IPv6 neighbor discovery before port scanning.
- Multi-Format Target Scanning - Accepts hosts, URLs, and CIDR ranges as input to probe multiple targets in a single scan run.
- Port Scanners - Probes hosts for open ports using SYN, CONNECT, and UDP methods to identify active services.
- Port Range and Top List Filters - Scans a user-defined port range, a curated top-ports list, or excludes specific ports from the scan.
- Service Enumeration Tools - Discovers open ports on hosts using SYN, CONNECT, and UDP scans to identify accessible services.
- Target Input Formats - Accepts targets as hostnames, IPs, CIDR ranges, or ASN numbers for flexible scanning.
- SYN Probes - Probes hosts by sending TCP SYN packets and analyzing responses without completing the full handshake.
- Asset Discovery Tools - Discovers and inventories internet-exposed, internal, and cloud assets continuously for attack-surface visibility.
- Root Domain Discoverers - Discovers hosts from root domains, CIDR ranges, and IP addresses to build a monitored asset inventory.
- Attack Surface Mapping - Discovers and maps all internet-facing assets to understand the full attack surface of an organization.
- Custom DNS Resolvers - Uses user-supplied DNS resolvers over TCP, UDP, DOH, or DOT to perform lookups.
- External Asset Discovery - Discovers external-facing domains and IPs using pre-indexed data, DNS brute-forcing, certificate logs, and ASN correlation.
- CIDR-Based Scanning - Accepts CIDR ranges as input to probe every IP address within that subnet.
- ASN-Based Scanning - Accepts ASN numbers as input to probe every IP address within that autonomous system.
- Security Automation Templates - Creates and runs custom security templates to automatically detect vulnerabilities at scale.
- Active Wordlist Bruteforcing - Discovers subdomains by testing a wordlist of potential names against a target domain.
- Subdomain Brute Forcing - Attempts to resolve a list of subdomain names against a target domain to discover valid entries.
- Recurring Task Scheduling - Sets a recurring schedule for an enumeration scan by specifying a frequency and optional start time or weekdays.
- CDN and WAF IP Exclusions - Skips full port scans on IPs belonging to known CDN or WAF providers and only checks ports 80 and 443.
- Nmap Integration - Passes scan results to Nmap for detailed service and version detection on open ports.
- Agent-Based Internal Scanners - Ships a lightweight agent that runs port scans inside internal networks via outbound connections.
- Scan Schedulers - Sets a recurring scan schedule with configurable frequency, start time, and weekday options to automate port scanning.
- Library Scan Scheduling - Creates, schedules, imports, and configures port scans to run automatically or on demand.
- Cloud Asset Discoverers - Connects cloud provider accounts to import and continuously synchronize host assets for monitoring.
- Nmap Integration - Passes discovered open ports to an external nmap command for service version detection or additional scans.
- Security Automation APIs - Provides a REST API for programmatically managing scans, templates, assets, and vulnerability workflows.
- Asset Management APIs - Provides REST endpoints for adding, updating, and removing monitored hosts programmatically.
- Security Automation APIs - Provides a REST API for programmatically triggering scans, managing configurations, and exporting results.
- Automatic Categorizers - Analyzes metadata, DNS, HTTP responses, and screenshots to automatically classify discovered assets by role.
- Cloud Infrastructure Mapping - Connects natively with AWS, Azure, and GCP to continuously discover and monitor cloud-hosted assets and configurations.
- Domain Correlation - Finds domains related to an organization by analyzing certificate logs and WHOIS records.
- Scan Result Exporters - Downloads scan logs, audit information, and result data in various formats for external analysis.
- Real-Time Scan Result Viewers - Groups and displays real-time scan results from automatic exploit-triggered scans.
- Scan Result Browsers - Views all scan results with filters for vulnerabilities, info, and affected assets.
- Security Automation Workflows - Builds custom security workflows by chaining REST API endpoints together.
- Interaction Capture Servers - Deploys a private server instance to capture callbacks with control over domains, encryption, and custom responses.
- Streaming DNS Processors - Processes DNS queries in streaming mode for continuous input without loading the entire wordlist into memory.
- Passive Port Enumeration - Queries external services like Shodan InternetDB to find open ports without sending probes.
- Misconfiguration Scanning - Identifies misconfigured software and services, such as default credentials and TLS/SSL issues.
- Hosting Infrastructure Displays - Shows CDN provider and ASN details for resolved hosts to identify hosting infrastructure.
- Network Security - Performs automated vulnerability assessment and monitoring to secure internal networks.
- Network Vulnerability Scanning - Automatically scans internet-facing assets for exploitable vulnerabilities when changes are detected.
- Remote Template Executions - Fetch templates, call AI features, and run scans remotely through a REST API.
- Template Validators - Executes a template against a URL, list, CIDR range, or ASN to check its validity and find results.
- Template Linters and Formatters - Ships a built-in API for automatically linting, formatting, and enhancing security scanning templates.
- Security Operations Automation - Uses a cloud platform with advanced automation to scale security operations for organizations.
- Scanning Template Libraries - Runs a security scan using the currently open template to test for vulnerabilities.
- Exploit-Triggered Scan Activators - Automatically scans assets when new vulnerability templates are added to protect against emerging threats.
- HTTP - Probes web servers and URLs with configurable tests to gather metadata and detect misconfigurations.
- Wildcard DNS Filters - Detects and removes DNS wildcard responses to eliminate false positives from scan results.
- Detection Template Authors - Defines an HTTP request to reproduce a security issue and tests it across multiple hosts automatically.
- Cloud-Hosted - Provides a cloud-hosted Monaco-based code editor for creating and modifying security scanning templates.
- Built-in WebUI Dashboards - Displays all captured interactions in a browser-based dashboard.
- Analysis Result Dashboards - Displays scan findings in a UI dashboard for browsing and analyzing probe results.
- Port Scanning - Fast, reliable port scanner.
- Port Scanning Tools - Fast port scanner written in Go.
- Reconnaissance Tools - Fast port scanner focused on reliability.
- Vulnerability Scanning - Fast port scanner for network service discovery.
