Port Scan

port-scan

When to Use

• Target domain or IP discovered and need to find open ports
• Subdomain enumeration complete and ready to scan hosts
• Need to identify running services for vulnerability assessment
• Looking for non-standard ports that may expose admin panels
• Preparing targets for service-specific vulnerability scanning
• Building comprehensive attack surface map of infrastructure

Quick Start

Fast port scan with naabu on top 100 ports:

naabu -host example.com -top-ports 100 -silent

Tools Overview

Naabu (Primary - Fast Discovery)

ProjectDiscovery's Go-based port scanner. Optimized for speed and reliability with CDN/WAF awareness.

Best For: Initial fast enumeration, CDN detection, pipeline integration

Masscan (Speed - Large Scale)

Asynchronous TCP port scanner capable of Internet-scale scanning. Uses custom TCP/IP stack.

Best For: Large IP ranges, high-speed sweeps, initial broad discovery

Nmap (Detail - Service Detection)

Industry-standard network scanner with service detection, OS fingerprinting, and scripting engine.

Best For: Service version detection, detailed analysis, script-based enumeration

Step-by-Step Process

Step 1: Initial Fast Scan with Naabu

Start with naabu for quick enumeration of common ports:

naabu -host example.com -top-ports 100 -o naabu-ports.txt

For multiple hosts from file:

naabu -list hosts.txt -top-ports 100 -o discovered-ports.txt

With JSON output for structured data:

naabu -host example.com -top-ports 100 -json -o ports.json

Step 2: Extended Port Range Discovery

Scan all ports on promising targets:

naabu -host example.com -p - -rate 1000 -o all-ports.txt

Scan specific port ranges:

naabu -host example.com -p 1-1000,8000-9000,3389 -o custom-ports.txt

Step 3: CDN/WAF Aware Scanning

Exclude CDN IPs to avoid scanning protected infrastructure:

naabu -host example.com -top-ports 1000 -exclude-cdn -display-cdn -o filtered-ports.txt

Step 4: High-Speed Scanning with Masscan

For large IP ranges, use masscan for speed:

masscan 10.0.0.0/8 -p80,443,8080,8443 --rate 10000 -oL masscan-results.txt

Full port scan on smaller ranges:

masscan 192.168.1.0/24 -p1-65535 --rate 5000 -oG masscan-grep.txt

Step 5: Service Version Detection with Nmap

After discovering open ports, identify services:

nmap -sV -p 80,443,8080 example.com -oX nmap-services.xml

For stealth scanning with version detection:

nmap -sS -sV -p 80,443 --open example.com -oX nmap-results.xml

Step 6: Comprehensive Service Analysis

Full service and script scan on discovered ports:

nmap -sV -sC -p 22,80,443,8080 example.com -oA nmap-full

With OS detection:

nmap -sS -sV -O -p 80,443 example.com -oX nmap-os.xml

Step 7: Combine Tools in Pipeline

Use naabu to discover, nmap to enumerate:

naabu -host example.com -top-ports 100 -silent | nmap -sV -iL - -oX services.xml

Naabu has built-in nmap integration:

naabu -host example.com -top-ports 100 -nmap-cli "nmap -sV -oX nmap-output.xml"

Examples

Example 1: Basic Host Port Scan

Scenario: Scan a single domain for common web ports

Command:

naabu -host hackerone.com -p 80,443,8080,8443 -silent

Output:

hackerone.com:80
hackerone.com:443
hackerone.com:8443

Example 2: Subdomain List Scanning

Scenario: Scan all discovered subdomains for open ports

Command:

naabu -list subdomains.txt -top-ports 100 -json -o ports.json

Output (ports.json):

{"ip":"104.16.99.52","port":80,"host":"www.example.com"}
{"ip":"104.16.99.52","port":443,"host":"www.example.com"}
{"ip":"192.168.1.10","port":22,"host":"admin.example.com"}
{"ip":"192.168.1.10","port":8080,"host":"admin.example.com"}

Example 3: Full Port Range Scan

Scenario: Discover all open ports on high-value target

Command:

naabu -host admin.example.com -p - -rate 2000 -o all-ports.txt

Output (all-ports.txt):

admin.example.com:22
admin.example.com:80
admin.example.com:443
admin.example.com:3306
admin.example.com:8080
admin.example.com:9090

Example 4: CDN Detection and Filtering

Scenario: Identify CDN-protected hosts and scan direct IPs only

Command:

naabu -host example.com -top-ports 100 -exclude-cdn -display-cdn -silent

Output:

[cdn] example.com [cloudflare]
admin.example.com:22
admin.example.com:8080
api.example.com:443
api.example.com:8443

Example 5: High-Speed Network Sweep

Scenario: Quickly scan large network for web services

Command:

masscan 10.0.0.0/16 -p80,443,8000-8100 --rate 50000 -oL sweep.txt

Output (sweep.txt):

open tcp 80 10.0.1.15 1609459200
open tcp 443 10.0.1.15 1609459200
open tcp 8080 10.0.2.30 1609459201
open tcp 80 10.0.5.100 1609459202

Example 6: Masscan with JSON Output

Scenario: Large-scale scan with structured output

Command:

masscan 192.168.0.0/16 -p22,80,443,3389 --rate 10000 -oJ masscan.json

Output (masscan.json):

{"ip": "192.168.1.50", "timestamp": "1609459200", "ports": [{"port": 22, "proto": "tcp", "status": "open"}]}
{"ip": "192.168.1.50", "timestamp": "1609459200", "ports": [{"port": 80, "proto": "tcp", "status": "open"}]}
{"ip": "192.168.2.100", "timestamp": "1609459201", "ports": [{"port": 443, "proto": "tcp", "status": "open"}]}

Example 7: Service Version Detection

Scenario: Identify exact service versions on open ports

Command:

nmap -sV -p 22,80,443,8080 example.com -oX services.xml

Output:

PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 8.2p1 Ubuntu 4ubuntu0.5
80/tcp   open  http       nginx 1.18.0
443/tcp  open  ssl/http   nginx 1.18.0
8080/tcp open  http-proxy Apache Tomcat 9.0.50

Example 8: Nmap Script Scanning

Scenario: Run default scripts for additional enumeration

Command:

nmap -sV -sC -p 80,443 example.com --open -oX nmap-scripts.xml

Output:

PORT    STATE SERVICE  VERSION
80/tcp  open  http     nginx 1.18.0
| http-title: Example Domain
|_Requested resource was https://example.com/
443/tcp open  ssl/http nginx 1.18.0
| ssl-cert: Subject: commonName=example.com
| Not valid after:  2025-01-15T00:00:00

Example 9: UDP Port Scanning

Scenario: Discover UDP services (DNS, SNMP, etc.)

Naabu UDP scan:

naabu -host example.com -p u:53,161,500,1194 -o udp-ports.txt

Nmap UDP scan:

nmap -sU -p 53,161,500 example.com -oX udp-services.xml

Output:

PORT    STATE         SERVICE
53/udp  open          domain
161/udp open|filtered snmp
500/udp open|filtered isakmp

Example 10: Stealth SYN Scan

Scenario: Low-profile reconnaissance scan

Command:

nmap -sS -Pn -T2 --top-ports 100 example.com -oX stealth.xml

Output:

PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
443/tcp open  https

Example 11: IPv6 Port Scanning

Scenario: Scan IPv6 addresses for open ports

Command:

naabu -host example.com -p 80,443 -ip-version 6 -silent

Output:

2606:4700::6810:6434:80
2606:4700::6810:6434:443

Example 12: Passive Port Enumeration

Scenario: Discover ports without active scanning using Shodan

Command:

naabu -host example.com -passive -silent

Output:

example.com:22
example.com:80
example.com:443
example.com:8443

Example 13: Pipeline Integration

Scenario: Combine port scanning with service detection

Command:

cat hosts.txt | naabu -silent -top-ports 100 | httpx -silent -status-code

Output:

http://example.com:80 [200]
https://example.com:443 [301]
http://admin.example.com:8080 [401]

Example 14: Naabu with Nmap Integration

Scenario: Automatic service detection on discovered ports

Command:

naabu -host example.com -top-ports 100 -nmap-cli "nmap -sV -oX nmap.xml"

Output:

[INF] Found 4 ports on host example.com (104.16.99.52)
example.com:80
example.com:443
example.com:8080
example.com:8443
[INF] Running nmap command: nmap -sV -p 80,443,8080,8443 104.16.99.52

Scan Types Reference

TCP Scan Types

UDP Scanning

Timing and Rate Control

Error Handling

Output Formats

Naabu Output Options

Masscan Output Options

Nmap Output Options

Tool Reference

Key Flags Summary

Common Port Groups

Best Practices

1. Start with passive - Use -passive first to avoid detection
2. Rate limit - Start low, increase gradually
3. Exclude CDNs - Use -exclude-cdn to avoid protected IPs
4. Verify results - Cross-reference with multiple tools
5. Use pipelines - Combine tools for efficiency
6. Save all output - Use JSON for automation
7. Service detection last - Only on confirmed open ports
8. Respect scope - Stay within authorized targets

References

• Naabu GitHub
• Naabu Documentation
• Masscan GitHub
• Nmap Reference Guide
• Nmap Port Scanning
• Nmap Service Detection