Naabu

Overview

Naabu is a free command-line port scanner for operators who need to fold host and port discovery into an existing security workflow. It suits bug-bounty and penetration-testing teams comfortable with CLI tooling; its main trade-off is operational setup, including packet-capture dependencies and elevated privileges for best results.

With multiple scan methods, target inputs and export formats, Naabu is a practical fit for scripted internet-scope discovery. It is less suitable for teams that want a managed graphical scanner or service-version detection without supplying a separate Nmap probe database.

Key features

Scanning and target control

Naabu supports SYN, CONNECT and UDP probing, plus DNS port scanning. Targets can be hosts, IPs, CIDRs or ASNs, entered directly, loaded from a file or passed through standard input. That flexibility helps teams feed inventories into a repeatable CLI process rather than re-entering targets for each scan.

IPv4 scanning is supported, while IPv6 and host discovery are marked experimental. Those capabilities may be useful for exploration, but teams relying on stable coverage should treat them as less mature than the core scan methods. Passive enumeration can use Shodan InternetDB. CDN/WAF exclusion can restrict scans to ports 80 and 443 for supported Cloudflare, Akamai, Incapsula and Sucuri IPs, a useful guardrail when broad scans could otherwise reach protected infrastructure.

Service discovery and workflow integration

Naabu integrates with Nmap for service discovery and additional scans. It can identify services by port and detect versions using Nmap service probes, but the service-probe database is not bundled: version detection requires a local Nmap installation or a custom database path. That makes the integration useful for teams already running Nmap, but adds setup for anyone expecting a self-contained scanner.

Discovered ports can be piped to httpx to identify running HTTP servers. Output is available as JSON, CSV, text or standard output, so results can move into scripts and adjacent tools without being confined to a single report format. The CLI can also upload or display results in the ProjectDiscovery Cloud dashboard and associate them with team and asset IDs.

Installation and operation

ProjectDiscovery provides ready-to-run binaries, Docker installation and Go installation. Packet capture requires libpcap on Linux and macOS or Npcap on Windows. The README recommends running Naabu as root for best results and tuning flags and scan rate on local systems. These requirements are manageable for security teams accustomed to scanner setup, but less convenient than a hosted service with no local prerequisites.

Naabu's README places responsibility for scanning activity on the user and disclaims developer liability for misuse or damage; operators should keep scans within authorized scope.

Pricing

Naabu is free under its Open source plan at 0.00 USD per free. The plan is MIT-licensed and provides the port-scanning tool as a CLI, with internet scan scope, API access and JSON, CSV, TXT and STDOUT export formats. There is no paid Naabu tier to trade features or quotas against; teams should instead account for the local installation and service-detection database requirements.

Platforms

Naabu is available for Linux, macOS and Windows, with self-hosted deployment and API access. Its CLI orientation makes it a natural fit for teams that already manage command-line security tooling; it is not a web-based scanning interface.

Who it's for

Naabu is best suited to bug-bounty operators and penetration testers building attack-surface discovery pipelines, especially those who already use Nmap or ProjectDiscovery's httpx. Its varied inputs and machine-readable outputs support integration into existing workflows. Teams seeking a guided web interface, or unwilling to manage packet capture and privileges, should look at hosted alternatives instead.

Pros and cons

• Pros: SYN, CONNECT and UDP scans plus broad host, IP, CIDR and ASN inputs give operators flexibility in how they define targets.
• Pros: JSON, CSV, text and standard output, along with Nmap and httpx integration, make results usable in multi-tool discovery pipelines.
• Pros: Free, MIT-licensed availability avoids a product subscription for the scanner itself.
• Cons: Packet capture dependencies and the recommendation to run as root add setup and operational care.
• Cons: Service-version detection depends on an external Nmap probe database, so it is not turnkey.
• Cons: IPv6 scanning and host discovery are experimental, limiting their suitability for workflows that need mature behavior.

Alternatives

Port Scanner Software is the broader category directory for comparing other options.

• ScanSearch is worth considering when a freemium scanner with Linux and web access, a free trial and a paid internet-scanning plan is a better fit; its Internet Scanner plan is 0.30 USD per month, billed per kpps/month.
• Pentest-Tools Port Scanner may suit teams preferring API and web access with a free tier and trial; its NetSec plan starts at 95.00 USD per month.
• Unicornscan is another free, GPL port-scanning option for Linux, macOS, self-hosted and web use.
• HostedScan Security is a paid API and web option with a free trial, suited to buyers willing to pay for its Basic plan at 39.00 USD per month.
• Nmap is a free alternative for Linux, macOS, self-hosted and Windows; its end-user license does not allow redistribution within commercial software or hardware products.
• Angry IP Scanner is a free, GPLv2 option for Linux, macOS and Windows.
• RustScan is a free open-source scanner for Linux, macOS, Windows, Android and self-hosted use.
• Nmap Online Scan is a web-based alternative with a freemium model and a free trial.

Verdict

Choose Naabu if your team needs a free, scriptable port scanner that can feed Nmap and httpx workflows. Its combination of scan methods, target inputs and export formats is compelling for attack-surface discovery, but local packet-capture setup and the external Nmap database make it a weaker choice for teams wanting a ready-to-use hosted scanner or self-contained service-version detection.