Naabu

Naabu is a free command-line port-scanning tool for enumerating open ports on hosts. It uses SYN, CONNECT, and UDP probes, and accepts hosts, IP addresses, CIDR ranges, and ASNs from direct input, files, or standard input. Results can be written as JSON, CSV, text, or standard output. It supports IPv4; IPv6 scanning and host discovery are marked experimental. Passive enumeration can use Shodan InternetDB, and DNS port scanning is also available. Naabu can work with Nmap for service discovery and version detection, and discovered ports can be piped to ProjectDiscovery’s httpx to identify HTTP servers. Service-version detection requires an Nmap service probe database from a local installation or a custom path. Installation options include ready-to-run binaries, Docker, and Go. Packet capture requires libpcap on Linux and macOS or Npcap on Windows. The README recommends running as root for best results and tuning scan flags and rates on local systems. Its stated use cases include attack-surface discovery for bug-bounty work and penetration tests.

Naabu combines several scan types and flexible inputs with output formats that can feed other tools. Note its experimental features, packet-capture dependencies, and additional requirement for service-version detection.

Naabu suits security practitioners doing attack-surface discovery in bug-bounty work or penetration tests. It is also relevant to users who want port-scan results to feed into Nmap or httpx.

Overview

Naabu is a command-line port scanner from ProjectDiscovery for finding valid ports across hosts and network ranges. It suits security practitioners who work in attack-surface discovery, bug bounties, or penetration testing and want scan results to feed into other tools. Its range of scan methods and inputs is useful, but experimental discovery features and packet-capture requirements make it a more operational choice than a plug-and-play scanner.

Naabu accepts hosts, IPs, CIDRs, and ASNs supplied directly, from a file, or through standard input. It is designed for command-line workflows, not graphical scanning. The README warns that users are responsible for their actions and that the developers assume no liability for misuse or damage; scan only systems you are authorized to assess.

Key features

Scanning and target discovery

SYN, CONNECT, and UDP probes give operators several ways to check ports, while DNS port scanning adds another discovery option. Passive enumeration can draw on Shodan InternetDB. Host discovery is available but experimental, as is IPv6 scanning; those caveats matter if either capability is central to a workflow. CDN/WAF exclusion can restrict scans to ports 80 and 443 for supported Cloudflare, Akamai, Incapsula, and Sucuri IPs.

Service details and tool connections

Naabu integrates with Nmap for service discovery and additional scans, and can identify services by port. Service-version detection needs the Nmap service probe database, which Naabu does not include; users must supply it from a local Nmap installation or a custom path. That extra setup is a meaningful trade-off for teams that need version details rather than open-port results alone.

Discovered ports can be piped to ProjectDiscovery's httpx to identify running HTTP servers. The CLI can also upload or display scan output in the ProjectDiscovery Cloud dashboard and associate results with team and asset IDs. Those integrations make Naabu more useful in a larger workflow, though its core remains a CLI scanner.

Output and installation

Results can be emitted as JSON, CSV, text, or standard output, giving command-line users options for saving results or passing them downstream. ProjectDiscovery provides ready-to-run binaries and Docker and Go installation paths. Packet capture requires libpcap on Linux and macOS or Npcap on Windows. The README recommends root privileges for best results and tuning flags and scan rate on local systems, so administrators should account for permissions and local configuration.

Pricing

Open source — free: The free plan is an MIT-licensed port-scanning tool deployed as a CLI. It includes internet scan scope, API access, and JSON, CSV, TXT, and STDOUT export formats. This suits practitioners who can work in a command line and manage their own scanning environment; the plan does not present a separate paid tier.

Platforms

Naabu is available for Linux, macOS, and Windows, with self-hosted deployment and API access. Packet-capture support depends on libpcap on Linux and macOS or Npcap on Windows, so platform availability does not remove those setup requirements.

Who it's for

Naabu is best suited to security practitioners conducting authorized attack-surface discovery, bug-bounty work, or penetration tests, particularly those who already use Nmap or httpx and want port results in a pipeline. It is less suitable for readers seeking a graphical interface or a scanner that provides service-version detection without additional local database setup.

Pros and cons

• Pros: SYN, CONNECT, and UDP scanning, plus broad target inputs, support varied command-line discovery workflows.
• Pros: JSON, CSV, text, and standard output make results usable in scripts and downstream tools.
• Pros: Nmap and httpx integration can extend port results into service discovery and HTTP identification.
• Cons: IPv6 and host discovery are experimental, so they are less dependable choices for workflows that rely on those capabilities.
• Cons: Packet capture requires a platform-specific dependency, and best results may require root privileges and scan-rate tuning.
• Cons: Service-version detection requires a separate Nmap service probe database.

Alternatives

For another free option, RustScan supports Linux, macOS, Windows, Android, and self-hosted use. Port Authority is a free Android option. Pentest-Tools Port Scanner offers a free tier for open-port and service discovery as well as a NetSec plan starting at $95 a month, making it a web and API alternative with a paid tier. ScanSearch offers a paid Internet Scanner plan at $0.30 a month, billed per kpps/month, with 100–10,000 kpps, unlimited results per scan, full CSV/JSON export, and a queue of up to 10 scans.

NetsCLI is another free option for Linux, macOS, and Windows. Nmap is a free alternative for Linux, macOS, Windows, and self-hosted use; its end-user license permits free use but not redistribution within commercial software or hardware products. Sherlock Forensics Port Scanner is a free Linux and Windows option. Angry IP Scanner is a free, GPLv2-licensed option for Linux, macOS, and Windows.

Explore more options in Port Scanner Software.

Verdict

Choose Naabu if you need a free, command-line port scanner that can take varied target inputs and send structured results into an existing security workflow. Its strongest case is the combination of scan methods, output formats, and integrations. Look elsewhere if you need a graphical scanner, dependable experimental features, or service-version detection without installing and configuring Nmap's probe database.