naabu-portscan

Scan hosts and CIDR ranges for open ports with JSON output.

1.6k|234|Updated Dec 7, 2019
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill naabu-portscan
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: naabu-portscan
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/tool/naabu-portscan
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill naabu-portscan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identify open ports and live hosts to enable rapid network discovery and attack surface mapping.

Core Features & Use Cases

  • High-speed port discovery using SYN/CONNECT with high concurrency to quickly reveal open ports
  • Batch and network-range scanning including single hosts, CIDR blocks, and ASN scopes
  • Pipeline integration with httpx and nuclei for alive checks and vulnerability scanning across workflows
  • Real-world scenario: quickly identify exposed services on a target network to prioritize remediation

Quick Start

Run naabu against a target or CIDR to rapidly enumerate open ports and live hosts, then chain with httpx and nuclei for verification and coverage.

Frequently Asked Questions about naabu-portscan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a CIDR range for open ports and live hosts?

To scan a CIDR range for open ports and live hosts, you run naabu directly against the target network block. It supports high-concurrency network discovery across single hosts and CIDR scopes, outputting JSON results for easy pipelining.

What is the difference between SYN and CONNECT scanning for network discovery?

SYN and CONNECT scanning differ by execution privilege: SYN scanning is used when running as root for stealthy high-speed port discovery, while CONNECT scanning is used otherwise. Both enable rapid identification of exposed services.

How can I integrate port scanning with vulnerability scanning workflows?

You integrate port scanning with vulnerability scanning workflows by outputting naabu results in JSON format and piping them directly into httpx for alive checks and nuclei for vulnerability scanning across the discovered attack surface.

Can I perform batch port scanning across ASN prefixes?

Yes, you can perform batch port scanning across ASN prefixes. The tool supports high-concurrency network discovery across ASN scopes and CIDR blocks to quickly reveal exposed services on large target networks.

What is the best way to quickly identify exposed services on a target network?

The best way to quickly identify exposed services on a target network is using high-concurrency port discovery with top-port prioritization. This allows rapid network discovery and attack surface mapping for internal and external security assessments.