> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/active-reconnaissance-approach/naabu.md).

# Naabu

Naabu is a **fast and efficient port scanning tool** developed by [ProjectDiscovery](https://github.com/projectdiscovery/naabu). It is designed to quickly enumerate open ports on a given list of hosts. Written in **Go**, Naabu is optimized for speed, making it ideal for scanning large networks.

***

### **Installation**

You can install Naabu using **Go** or download a precompiled binary:

```bash
go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest
```

For a quick setup, download the latest release from [GitHub](https://github.com/projectdiscovery/naabu/releases).

***

### **Syntax**

```bash
naabu [flags] -host <target>
```

#### **Common Flags & Options**

| **Flag**        | **Description**                            | **Example**               |
| --------------- | ------------------------------------------ | ------------------------- |
| `-host`         | Target host or IP address                  | `naabu -host example.com` |
| `-p`            | Specify ports to scan                      | `-p 22,80,443`            |
| `-top-ports`    | Scan the most common ports                 | `-top-ports 1000`         |
| `-rate`         | Set the rate of packets per second         | `-rate 10000`             |
| `-o`            | Save output to a file                      | `-o result.txt`           |
| `-sV`           | Enable service version detection           | `-sV`                     |
| `-Pn`           | Skip host discovery (assume host is up)    | `-Pn`                     |
| `-json`         | Save output in JSON format                 | `-json`                   |
| `-passive`      | Retrieve passive port data from **Shodan** | `-passive`                |
| `-nmap`         | Pipe results directly into **Nmap**        | `-nmap`                   |
| `-exclude`      | Exclude specific IPs or ranges             | `-exclude 192.168.1.1/24` |
| `-scan-all-ips` | Scan all IPs associated with a domain      | `-scan-all-ips`           |

***

### **Examples**

* **Scan a single target for open ports**

  ```bash
  naabu -host example.com
  ```
* **Scan multiple targets from a file**

  ```bash
  naabu -list targets.txt
  ```

  *(Each target should be on a new line in `targets.txt`.)*
* **Scan specific ports on a target**

  ```bash
  naabu -host example.com -p 21,22,80,443
  ```
* **Scan the top 1000 commonly used ports on a target**

  ```bash
  naabu -host example.com -top-ports 1000
  ```
* **Scan all 65535 ports on a target**

  ```bash
  naabu -host example.com -p -
  ```
* **Scan a target with a custom rate limit**

  ```bash
  naabu -host example.com -rate 5000
  ```

  *(Useful for controlling scan speed to avoid detection or throttling.)*
* **Save scan results to a file**

  ```bash
  naabu -host example.com -o output.txt
  ```
* **Perform a service version detection scan**

  ```bash
  naabu -host example.com -sV
  ```
* **Scan a target while skipping host discovery**

  ```bash
  naabu -host example.com -Pn
  ```

  *(Assumes the target is online, useful for firewall-bypassing scans.)*
* **Fetch passive port data using Shodan InternetDB**

  ```bash
  naabu -host example.com -passive
  ```

  *(Fetches existing port data without actively scanning the target.)*
* **Run Naabu and pipe the results into Nmap for a more detailed scan**

  ```bash
  naabu -host example.com -nmap
  ```
* **Exclude certain IPs or networks from scanning**

  ```bash
  naabu -host example.com -exclude 192.168.1.1/24
  ```
* **Scan all IPs associated with a domain**

  ```bash
  naabu -host example.com -scan-all-ips
  ```