Naabu

Overview

Naabu is a command-line port scanner for operators who need to find exposed ports across hosts, networks, and ASNs as part of a broader security workflow. It is a strong fit for bug-bounty and penetration-testing work; its main trade-off is that effective packet capture and service-version checks bring extra setup.

Key features

Scanning and target input

Naabu supports SYN, CONNECT, and UDP probe-based scans, plus DNS port scanning. Targets can be entered directly, read from a file, or passed through standard input, and can include hosts, IP addresses, CIDR ranges, and ASNs. That range of input and scan methods suits scripted discovery better than a workflow centered on a graphical interface.

Discovery and service details

IPv4 scanning is supported; IPv6 scanning and host discovery are experimental, so they are less dependable choices for a workflow that requires mature support for those functions. Passive enumeration can use Shodan InternetDB. Naabu can identify services by port and integrate with Nmap for service discovery and additional scans, but version detection requires an Nmap service-probe database installed locally or supplied through a custom path.

Output and integrations

Results can be emitted as JSON, CSV, text, or standard output. Discovered ports can be piped to ProjectDiscovery's httpx to identify running HTTP servers, making Naabu useful as one stage in a command-line pipeline. The CLI can also upload or display results in the ProjectDiscovery Cloud dashboard and associate them with team and asset IDs.

CDN/WAF exclusion can restrict scanning to ports 80 and 443 for supported Cloudflare, Akamai, Incapsula, and Sucuri IPs. This is a targeted safeguard, not a general-purpose substitute for defining authorized scan scope.

Pricing

Naabu is open source under the MIT license. Its Open source plan costs nothing and includes the port-scanning tool; there is no paid tier to choose among. It is a CLI deployment with internet scan scope and API access, and supports JSON, CSV, TXT, and STDOUT exports.

For packet-capture scans, install libpcap on Linux or macOS, or Npcap on Windows. The maker provides ready-to-run binaries, Docker installation, and Go installation. The README recommends running as root for best results and tuning flags and scan rate on local systems, which makes setup and operating discipline part of the cost of using a free tool. Nmap's service-probe database is an additional prerequisite for version detection.

Platforms

Naabu is available for Linux, macOS, and Windows, and is self-hosted rather than a hosted scanning application. It is also categorized for API use. ProjectDiscovery directs users to GitHub and Discord for help with its open-source tools.

Who it's for

Naabu suits security practitioners who need port discovery as part of attack-surface mapping, bug-bounty work, or penetration tests, especially those already comfortable connecting command-line tools into a pipeline. It is less suitable for readers who want a graphical scanner or a ready-made service-version database without installing and maintaining that dependency. Scan only systems you are authorized to assess; the project places responsibility for use on the user and disclaims liability for misuse or damage.

Pros and cons

Pros: Multiple probe methods and flexible host, IP, CIDR, and ASN inputs support varied discovery workflows.

Pros: JSON, CSV, text, and standard output, plus httpx and Nmap integration, make results useful in subsequent tooling.

Pros: Free, MIT-licensed software with binary, Docker, and Go installation options.

Cons: Packet capture needs a platform-specific dependency, and best results may require root privileges and scan-rate tuning.

Cons: IPv6 and host discovery are experimental, while service-version detection depends on a separate Nmap database.

Alternatives

Port Scanner Software is the broader category directory for comparing scanners.

Nmap is another free scanner for Linux, macOS, Windows, and self-hosting; choose it when you want its own service-probe database workflow rather than Naabu's port-discovery pipeline.

ScanSearch offers a web and API-based internet scanner with paid per-kpps pricing, unlimited results per scan, full CSV/JSON export, and a queue of up to 10 scans; choose it for that hosted scanning and export model.

Pentest-Tools Port Scanner offers web and API access, with a free tier for open-port and service discovery and a NetSec plan starting at $95 a month; choose it when a web-based option better fits the workflow.

RustScan is a free, open-source port scanner; consider it as another free scanner.

NetsCLI is a free, MIT-licensed option for Linux, macOS, and Windows; consider it as another command-line alternative.

Masscan is free software under the GNU Affero General Public License v3; consider it as another open-source scanner.

Unicornscan is GPL software available as downloadable packages and source; consider it as another free option.

Angry IP Scanner is free and open source under GPLv2, for Linux, macOS, and Windows; consider it as another platform-spanning option.

Verdict

Choose Naabu if you want a free, scriptable port scanner that can feed results into an attack-surface discovery pipeline. Look elsewhere if you need experimental IPv6 or host-discovery features to be dependable, or want service-version detection without supplying Nmap's probe database.