文章总结： naabu是一款用Go编写的快速端口扫描工具，支持SYN/CONNECT/UDP扫描，优化了易用性和资源效率，具备DNS扫描、IPv4/IPv6支持、被动枚举和主机发现等功能，集成NMAP进行服务发现，适用于红队渗透测试，需合法使用。
综合评分： 75
文章分类： 红队,渗透测试,安全工具

【红队】一款用 Go 编写的端口扫描工具

naabu

贝雷帽SEC

2025年8月25日 12:19
广东

免责声明

本公众号所提供的文字和信息仅供学习和研究使用，请读者自觉遵守法律法规，不得利用本公众号所提供的信息从事任何违法活动。本公众号不对读者的任何违法行为承担任何责任。工具来自网络，安全性自测，如有侵权请联系删除。

工具介绍

Naabu 是一款用 Go 编写的端口扫描工具，可以快速可靠地枚举主机的有效端口。它非常简单易用，可以对主机/主机列表进行快速 SYN/CONNECT/UDP 扫描，并列出所有返回响应的端口。

快速简单的基于SYN/CONNECT/UDP探测的扫描
针对易用性和轻量级资源进行了优化
DNS端口扫描
DNS 端口扫描的自动 IP 重复数据删除
IPv4/IPv6端口扫描（实验）
使用 Shodan Internetdb 进行被动端口枚举
主机发现扫描（实验性）
NMAP集成用于服务发现
多输入支持 – STDIN/HOST/IP/CIDR/ASN
支持多种输出格式 – JSON/TXT/STDOUT

工具使用

Usage:&nbsp; naabu [flags]
Flags:INPUT:&nbsp; &nbsp;-host&nbsp;string[] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;hosts to scan ports&nbsp;for&nbsp;(comma-separated)&nbsp; &nbsp;-list, -l&nbsp;string&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; list of hosts to scan&nbsp;ports&nbsp;(file)&nbsp; &nbsp;-exclude-hosts, -eh&nbsp;string&nbsp; hosts to exclude&nbsp;from&nbsp;the&nbsp;scan&nbsp;(comma-separated)&nbsp; &nbsp;-exclude-file, -ef&nbsp;string&nbsp; &nbsp;list of hosts to exclude&nbsp;from&nbsp;scan&nbsp;(file)
PORT:&nbsp; &nbsp;-port, -p&nbsp;string&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ports to&nbsp;scan&nbsp;(80,443,&nbsp;100-200)&nbsp; &nbsp;-top-ports, -tp&nbsp;string&nbsp; &nbsp; &nbsp; top ports to&nbsp;scan&nbsp;(default&nbsp;100) [full,100,1000]&nbsp; &nbsp;-exclude-ports, -ep&nbsp;string&nbsp; ports to exclude&nbsp;from&nbsp;scan&nbsp;(comma-separated)&nbsp; &nbsp;-ports-file, -pf&nbsp;string&nbsp; &nbsp; &nbsp;list of ports to&nbsp;scan&nbsp;(file)&nbsp; &nbsp;-port-threshold, -pts&nbsp;int&nbsp; &nbsp;port threshold to skip port scan&nbsp;for&nbsp;the host&nbsp; &nbsp;-exclude-cdn, -ec &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; skip full port scans&nbsp;for&nbsp;CDN/WAF&nbsp;(only scan&nbsp;for&nbsp;port&nbsp;80,443)&nbsp; &nbsp;-display-cdn, -cdn &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;display cdn&nbsp;in&nbsp;use
RATE-LIMIT:&nbsp; &nbsp;-c&nbsp;int&nbsp; &nbsp; &nbsp;general&nbsp;internal&nbsp;worker&nbsp;threads&nbsp;(default&nbsp;25)&nbsp; &nbsp;-rate&nbsp;int&nbsp; packets to send per&nbsp;second&nbsp;(default&nbsp;1000)
UPDATE:&nbsp; &nbsp;-up, -update &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; update naabu to latest version&nbsp; &nbsp;-duc, -disable-update-check &nbsp;disable automatic naabu update check
OUTPUT:&nbsp; &nbsp;-o, -output&nbsp;string&nbsp; file to write output&nbsp;to&nbsp;(optional)&nbsp; &nbsp;-j, -json &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; write output&nbsp;in&nbsp;JSON lines format&nbsp; &nbsp;-csv &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;write output&nbsp;in&nbsp;csv format
CONFIGURATION:&nbsp; &nbsp;-config&nbsp;string&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;path to the naabu configuration&nbsp;file&nbsp;(default&nbsp;$HOME/.config/naabu/config.yaml)&nbsp; &nbsp;-scan-all-ips, -sa &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; scan all the IP's associated&nbsp;with&nbsp;DNS&nbsp;record&nbsp; &nbsp;-ip-version, -iv&nbsp;string[] &nbsp; &nbsp; &nbsp; &nbsp;ip version to scan of&nbsp;hostname&nbsp;(4,6) - (default&nbsp;4) (default&nbsp;["4"])&nbsp; &nbsp;-scan-type, -s&nbsp;string&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; type of port&nbsp;scan&nbsp;(SYN/CONNECT) (default&nbsp;"c")&nbsp; &nbsp;-source-ip&nbsp;string&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; source ip&nbsp;and&nbsp;port&nbsp;(x.x.x.x:yyy - might&nbsp;not&nbsp;work&nbsp;on&nbsp;OSX)&nbsp;&nbsp; &nbsp;-interface-list, -il &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; list available interfaces&nbsp;and&nbsp;public&nbsp;ip&nbsp; &nbsp;-interface, -i&nbsp;string&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; network Interface to use&nbsp;for&nbsp;port scan&nbsp; &nbsp;-nmap &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;invoke nmap scan&nbsp;on&nbsp;targets&nbsp;(nmap must be installed) - Deprecated&nbsp; &nbsp;-nmap-cli&nbsp;string&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;nmap command to run&nbsp;on&nbsp;found&nbsp;results&nbsp;(example: -nmap-cli&nbsp;'nmap -sV')&nbsp; &nbsp;-r&nbsp;string&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; list of custom resolver dns&nbsp;resolution&nbsp;(comma separated&nbsp;or&nbsp;from&nbsp;file)&nbsp; &nbsp;-proxy&nbsp;string&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; socks5&nbsp;proxy&nbsp;(ip[:port] / fqdn[:port]&nbsp; &nbsp;-proxy-auth&nbsp;string&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;socks5 proxy authentication (username:password)&nbsp; &nbsp;-resume &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;resume scan&nbsp;using&nbsp;resume.cfg&nbsp; &nbsp;-stream &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;stream&nbsp;mode&nbsp;(disables resume, nmap, verify, retries, shuffling, etc)&nbsp; &nbsp;-passive &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; display passive open ports&nbsp;using&nbsp;shodan internetdb api&nbsp; &nbsp;-irt, -input-read-timeout&nbsp;value&nbsp; timeout&nbsp;on&nbsp;input&nbsp;read&nbsp;(default&nbsp;3m0s)&nbsp; &nbsp;-no-stdin &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Disable Stdin processing
HOST-DISCOVERY:&nbsp; &nbsp;-sn, -host-discovery &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Perform Only Host Discovery&nbsp; &nbsp;-Pn, -skip-host-discovery &nbsp; &nbsp; &nbsp;Skip Host&nbsp;discovery&nbsp;(Deprecated: use -wn/-with-host-discovery instead)&nbsp; &nbsp;-wn, -with-host-discovery &nbsp; &nbsp; &nbsp;Enable Host discovery&nbsp; &nbsp;-ps, -probe-tcp-syn&nbsp;string[] &nbsp; TCP SYN&nbsp;Ping&nbsp;(host discovery needs to be enabled)&nbsp; &nbsp;-pa, -probe-tcp-ack&nbsp;string[] &nbsp; TCP ACK&nbsp;Ping&nbsp;(host discovery needs to be enabled)&nbsp; &nbsp;-pe, -probe-icmp-echo &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ICMP echo request&nbsp;Ping&nbsp;(host discovery needs to be enabled)&nbsp; &nbsp;-pp, -probe-icmp-timestamp &nbsp; &nbsp; ICMP timestamp request&nbsp;Ping&nbsp;(host discovery needs to be enabled)&nbsp; &nbsp;-pm, -probe-icmp-address-mask &nbsp;ICMP address mask request&nbsp;Ping&nbsp;(host discovery needs to be enabled)&nbsp; &nbsp;-arp, -arp-ping &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ARP&nbsp;ping&nbsp;(host discovery needs to be enabled)&nbsp; &nbsp;-nd, -nd-ping &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;IPv6 Neighbor&nbsp;Discovery&nbsp;(host discovery needs to be enabled)&nbsp; &nbsp;-rev-ptr &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Reverse PTR lookup&nbsp;for&nbsp;input ips
OPTIMIZATION:&nbsp; &nbsp;-retries&nbsp;int&nbsp; &nbsp; &nbsp; &nbsp;number of retries&nbsp;for&nbsp;the port&nbsp;scan&nbsp;(default&nbsp;3)&nbsp; &nbsp;-timeout&nbsp;int&nbsp; &nbsp; &nbsp; &nbsp;millisecond to wait before timing&nbsp;out&nbsp;(default&nbsp;1000)&nbsp; &nbsp;-warm-up-time&nbsp;int&nbsp; time&nbsp;in&nbsp;seconds between scan&nbsp;phases&nbsp;(default&nbsp;2)&nbsp; &nbsp;-ping &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ping probes&nbsp;for&nbsp;verification of host&nbsp; &nbsp;-verify &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;validate the ports again&nbsp;with&nbsp;TCP verification
DEBUG:&nbsp; &nbsp;-health-check, -hc &nbsp; &nbsp; &nbsp; &nbsp;run diagnostic check up&nbsp; &nbsp;-debug &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;display debugging information&nbsp; &nbsp;-verbose, -v &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;display verbose output&nbsp; &nbsp;-no-color, -nc &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;disable colors&nbsp;in&nbsp;CLI output&nbsp; &nbsp;-silent &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; display only results&nbsp;in&nbsp;output&nbsp; &nbsp;-version &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;display version of naabu&nbsp; &nbsp;-stats &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;display stats of the running&nbsp;scan&nbsp;(deprecated)&nbsp; &nbsp;-si, -stats-interval&nbsp;int&nbsp; number of seconds to wait between showing a statistics&nbsp;update&nbsp;(deprecated) (default&nbsp;5)&nbsp; &nbsp;-mp, -metrics-port&nbsp;int&nbsp; &nbsp; port to expose naabu metrics&nbsp;on&nbsp;(default&nbsp;63636)
CLOUD:&nbsp; &nbsp;-auth &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; configure projectdiscovery&nbsp;cloud&nbsp;(pdcp) api&nbsp;key&nbsp;(default&nbsp;true)&nbsp; &nbsp;-ac, -auth-config&nbsp;string&nbsp; &nbsp; &nbsp; &nbsp; configure projectdiscovery&nbsp;cloud&nbsp;(pdcp) api key credential file&nbsp; &nbsp;-pd, -dashboard &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; upload / view output&nbsp;in&nbsp;projectdiscovery&nbsp;cloud&nbsp;(pdcp) UI dashboard&nbsp; &nbsp;-tid, -team-id&nbsp;string&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;upload asset results to given team&nbsp;id&nbsp;(optional)&nbsp; &nbsp;-aid, -asset-id&nbsp;string&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; upload&nbsp;new&nbsp;assets to existing asset&nbsp;id&nbsp;(optional)&nbsp; &nbsp;-aname, -asset-name&nbsp;string&nbsp; &nbsp; &nbsp; assets&nbsp;group&nbsp;name to&nbsp;set&nbsp;(optional)&nbsp; &nbsp;-pdu, -dashboard-upload&nbsp;string&nbsp; upload naabu output&nbsp;file&nbsp;(jsonl)&nbsp;in&nbsp;projectdiscovery&nbsp;cloud&nbsp;(pdcp) UI dashboard

下载链接

回复关键字【250825】获取下载链接

End

“点赞、在看与分享都是莫大的支持”

工具精选

【红队】一款红队在大量的资产中存活探测与重点攻击系统指纹探测工具
 【红队】集成一站式企业信息资产收集、网络资产测绘的工具。
【红队】内网渗透工具-Viper最新版本
 【红队】一个辅助平常渗透测试项目或者攻防项目快速打点的综合工具
 【红队】afrog v2.7.2 新版本发布
 【红队】横向移动命令执行工具—WMIHACKER
【红队】Aboutveinmind-tools 容器安全工具集
 【红队】一个集成了非常多渗透测试工具
 【红队】一款内网综合扫描工具，一键自动化、全方位漏扫。
【红队】红队快速打点工具-POC-bomber v3.0.0 版本
 【红队】Medusa—红队武器库平台
 【红队】一款C2设施前置流量控制工具
 【红队】集成 vscan、nuclei、ksubdomain、subfinder等工具的打点神器–scan4all
【红队】网络安全单兵作战工具-YAKIT
【红队】最新 Burpsuite Professional 2023.6.1

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：贝雷帽SEC naabu《【红队】一款用 Go 编写的端口扫描工具》

Tags: 安全工具渗透测试红队

你可能错过

致歉当日凌晨还在偷传！智谱ZCode被实锤：你的代码，正在流向新加坡？

蓉城聚智，AI 护航｜2026 补天白帽沙龙成都站圆满落幕

致歉当日凌晨还在偷传！智谱ZCode被实锤：你的代码，正在流向新加坡？

Docker Mac沙箱逃逸漏洞详解