naabu-portscan

naabu Port Scanning Methodology

naabu is a high-speed port scanner from ProjectDiscovery. Core advantages:Extreme speed(SYN scanning + high concurrency) + Lightweight and simple + Pipeline-friendly(seamless integration with httpx/nuclei).

Project address:https://github.com/projectdiscovery/naabu

Tool Selection Strategy

naabu's SYN scanning + high-concurrency design makes it far faster than nmap at port discovery (usually more than 10x faster), so naabu is the first choice for port scanning. nmap's strengths are service version detection (-sV) and NSE scripts, so the recommended workflow is: first use naabu to quickly discover ports, then use nmap for in-depth probing of key ports.

Note: SYN scanning requires root privileges; in non-root environments it automatically downgrades to CONNECT scanning (slightly slower but functionally equivalent).

Phase 1: Basic Port Scanning

# 扫描单个主机（默认 Top 100 端口）
naabu -host target.com

Specify ports

naabu -host target.com -p 80,443,8080,8443

Port range

naabu -host target.com -p 1-1000

Full port scan

naabu -host target.com -p -

UDP scan (specify UDP ports)

naabu -host target.com -p u:53,u:161,u:500

## Phase 2: 预定义端口列表

```bash
# Top 100 端口（默认，最快）
naabu -host target.com -top-ports 100

# Top 1000 端口（平衡速度和覆盖）
naabu -host target.com -top-ports 1000

# 全端口（慢，仅在前两者无结果时使用）
naabu -host target.com -p -

Phase 3: Batch Target Scanning

# 从文件读取目标
naabu -l targets.txt -p 80,443,8080

# 从 stdin 读取（管道）
cat targets.txt | naabu -p 80,443,8080

# 扫描 CIDR 网段
naabu -host 10.0.0.0/24 -p 22,80,135,445,3389,5985

# 扫描 ASN
echo AS14421 | naabu -p 80,443

Phase 4: High-Value Port Strategy

Port combinations to prioritize during penetration testing:

# Web 服务
naabu -host target -p 80,443,8080,8443,8888,9090,3000,5000

# 数据库
naabu -host target -p 3306,5432,6379,27017,1433,1521,9200

# 远程管理
naabu -host target -p 22,3389,5900,5985,5986

# 域控相关
naabu -host target -p 88,135,139,389,445,636,3268,3269

# 中间件
naabu -host target -p 8009,7001,4848,9090,8161,61616

# 综合高价值端口（一条命令）
naabu -host target -p 22,80,135,139,443,445,1433,3306,3389,5432,5900,5985,6379,8080,8443,9200,27017

Phase 5: Pipeline Integration

The core value of naabu lies in forming a scanning chain with other ProjectDiscovery tools:

# 端口扫描 → HTTP 存活检测
naabu -host target.com -p 80,443,8080 -silent | httpx -silent

# 端口扫描 → HTTP 存活 → 漏洞扫描
naabu -host target.com -silent | httpx -silent | nuclei -severity critical,high

# 子域名 → 端口扫描 → HTTP 存活
subfinder -d target.com -silent | naabu -p 80,443 -silent | httpx -silent

# 网段扫描 → 存活主机 → Web 指纹
naabu -host 10.0.0.0/24 -p 80,443,8080 -silent | httpx -tech-detect -silent

Phase 6: Advanced Options

# 排除 CDN/WAF（只扫 80,443）
naabu -host target.com -p - -exclude-cdn

# 显示 CDN 信息
naabu -host target.com -display-cdn

# 排除特定端口
naabu -host target.com -p - -exclude-ports 80,443

# 控制速率
naabu -host target.com -rate 500 -c 10

# 主机存活探测（不扫端口）
naabu -host 10.0.0.0/24 -sn

# SYN 扫描（需要 root）
sudo naabu -host target.com -s s

# 集成 nmap 服务识别
naabu -host target.com -nmap-cli "nmap -sV"

# JSON 输出
naabu -host target.com -json -o results.json

# 静默输出（只显示 host:port）
naabu -host target.com -silent

Comparison and Decision-Making with nmap

Scenario	Recommended Tool	Reason
Fast port discovery	naabu	More than 10x faster
Batch targets/network segments	naabu	Superior concurrency performance
Service version detection	nmap (-sV)	naabu does not perform version detection
Vulnerability script scanning	nmap (--script)	NSE script ecosystem
In-depth UDP scanning	nmap	UDP scanning is more mature
Operating system fingerprinting	nmap (-O)	naabu does not support it

Recommended workflow: naabu quickly discovers ports → use nmap -sV on key ports for service identification