Naabu

Overview

Naabu is a free, open-source command-line port scanner from ProjectDiscovery for finding valid ports across hosts and networks. It suits security practitioners who build attack-surface discovery workflows around other tools; its strength is flexible scanning and pipeline use, not a graphical interface.

SYN, CONNECT, and UDP scans cover different probing approaches, while target input and output options make Naabu adaptable to scripted work. It is a poor fit for readers who want a point-and-click scanner or a turnkey service inventory: IPv6 and host discovery are experimental, and deeper version detection depends on a separate Nmap probe database.

Key features

Scanning and target handling

Naabu accepts hosts, IPs, CIDRs, and ASNs, supplied directly, from a file, or through standard input. That breadth is useful when a target set comes from different stages of an assessment. It supports IPv4 and IPv6, but IPv6 and host discovery are marked experimental, so they are less dependable choices for workflows that require mature behavior.

Alongside active SYN, CONNECT, and UDP probing, passive port enumeration can use Shodan InternetDB. CDN/WAF exclusion can restrict scans to ports 80 and 443 for supported Cloudflare, Akamai, Incapsula, and Sucuri IPs. This is a targeted safeguard for those networks, not a general substitute for setting a careful scan scope.

Results and integrations

Results can be emitted as JSON, CSV, text, or standard output, giving operators both structured exports and a natural command-line handoff. Discovered ports can be piped to ProjectDiscovery's httpx to identify running HTTP servers. Nmap integration supports service discovery and additional scans; Naabu can identify services by port and detect versions with Nmap service probes, but version detection requires the probe database from a local Nmap installation or a custom path.

The CLI can upload or display scan output in the ProjectDiscovery Cloud dashboard and associate results with team and asset IDs. It can be installed from ready-to-run binaries, Docker, or Go. Packet capture requires libpcap on Linux and macOS or Npcap on Windows; the README recommends root privileges for best results and tuning flags and scan rate on local systems. Those requirements make it more suitable for technically comfortable users than casual scanning.

Naabu is intended for authorized attack-surface discovery, including bug-bounty work and penetration tests. Its README places responsibility for use on the user and disclaims liability for misuse or damage; operators should keep scans within authorized scope.

Pricing

Naabu is free: the Open source plan costs nothing and provides an MIT-licensed port-scanning tool. It is a strong fit for individual practitioners and teams that can operate a CLI tool and supply any needed system dependencies themselves. The plan has API access and exports in JSON, CSV, TXT, and STDOUT; no paid Naabu tier is presented, so there is no higher plan to compare against.

Platforms

Naabu is available for Linux, macOS, and Windows, as well as API and self-hosted use. It is deployed as a CLI tool, with scanning scope listed as internet. The operating-system-specific packet-capture dependency remains important: libpcap is needed on Linux and macOS, and Npcap on Windows.

Who it's for

Choose Naabu if you need a free scanner that can take varied target inputs, produce machine-readable results, and feed a larger attack-surface workflow. Bug-bounty hunters and penetration testers who already use command-line tools are its clearest audience. Look elsewhere if you need a GUI-first product, mature experimental features, or version detection without installing or pointing Naabu to Nmap's probe database.

Pros and cons

• Pro: SYN, CONNECT, and UDP scans plus passive enumeration give operators several ways to discover ports.
• Pro: Hosts, IPs, CIDRs, ASNs, files, and standard input support varied target-supply workflows.
• Pro: JSON, CSV, text, and standard output suit both reporting and command-line pipelines.
• Con: IPv6 and host discovery are experimental, limiting their appeal for workflows that need established behavior.
• Con: Packet capture needs an additional platform-specific dependency, and best results may require root access and scan-rate tuning.
• Con: Version detection needs an external Nmap service-probe database rather than a bundled one.

Alternatives

Nmap is a free alternative for users who want a port scanner with a free end-user license; redistribution within commercial software or hardware products is not allowed by that license.

RustScan is another free, open-source port scanner to consider, including if Android support matters.

ScanSearch is worth considering for an internet-scanning service with a paid per-kpps plan, unlimited results per scan, full CSV/JSON export, and up to 10 queued scans.

Unicornscan is a free GPL option with downloadable packages and source.

Pentest-Tools Port Scanner offers web and API access, with a free tier for open-port and service discovery and a paid NetSec plan starting at $95 a month.

Nmap Online Scan is a web-based freemium alternative, with 10 scan credits priced at 1.99 USD once.

Masscan and NetsCLI are also free alternatives for Windows, macOS, and Linux.

Verdict

Naabu is a sound choice for security practitioners who want a free, scriptable port scanner that fits into attack-surface discovery pipelines. Its broad inputs, several scan types, and structured outputs are compelling for that audience; users who need experimental features to be dependable, graphical operation, or self-contained version detection should look elsewhere.