nerva-scan

Identify services and protocols on open ports using nerva fingerprinting.

1.7k|238|Updated Dec 7, 2019
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill nerva-scan
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: nerva-scan
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/tool/nerva-scan
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill nerva-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

After port scanning reveals open ports, you still need to know exactly which service and protocol is listening on each one. This Skill uses nerva (Praetorian's upgraded successor to fingerprintx) to fingerprint 120+ protocols across TCP, UDP, and SCTP, turning raw port lists into actionable service intelligence.

Core Features & Use Cases

  • Multi-Protocol Fingerprinting: Identify databases, remote access services, message queues, industrial control systems, and web services across 120+ protocols with rich metadata extraction.
  • Flexible Scan Modes: Run fast mode for default services, UDP probing, custom timeouts, concurrency limits, and rate limiting for large target sets.
  • Pipeline Integration: Chain directly with naabu or masscan output to convert port scan results into structured JSON service inventories.
  • Use Case: You ran masscan against a 10.0.0.0/24 subnet and have hundreds of open ports. Pipe the results into nerva to produce a JSON file mapping every port to its identified service for the next attack phase.

Quick Start

Ask the AI to fingerprint the services running on a target host and port list using nerva and output the results as JSON.

Frequently Asked Questions about nerva-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify services running on open ports?

Run nerva against target host:port pairs with the -t flag, or pass a file of targets with -l. It fingerprints 120+ protocols and returns the identified service with metadata, optionally in JSON format via the --json flag.

How to combine masscan or naabu with service fingerprinting?

Pipe the port scanner output directly into nerva. For naabu, run naabu -host <target> -silent | nerva --json. For masscan, extract open host:port pairs with grep and awk, then pipe them into nerva with -o to save JSON results.

Does nerva support UDP service scanning?

Yes, nerva supports UDP probing with the -U flag, for example nerva -t 192.168.1.1:161 -U for SNMP. It also supports TCP and SCTP transport layers depending on the protocol being fingerprinted.

What is the difference between nerva and fingerprintx?

nerva is Praetorian's upgraded successor to fingerprintx. It expands coverage to 120+ protocols including industrial control systems and message queues, adds multi-transport support across TCP, UDP, and SCTP, and extracts richer service metadata.

How do I control scan speed and timeouts in nerva?

Use -w to set timeout in milliseconds and -W to limit concurrency, for example nerva -t targets -w 2000 -W 50. For large target lists, apply rate limiting with -R, such as nerva -l targets.txt -R 100.