Menu
Naabu port-scanning syntax with host input, scan-type, verification, and rate controls.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | naabu-tooling |
| description | Naabu port-scanning syntax with host input, scan-type, verification, and rate controls. |
penkit51 AI — professional penetration testing skill pack. Authorized testing only.
Official docs:
Canonical syntax:
naabu [flags]
High-signal flags:
-host <host> single host-list, -l <file> hosts list-p <ports> explicit ports (supports ranges)-top-ports <n|full> top ports profile-exclude-ports <ports> exclusions-scan-type <s|c|syn|connect> SYN or CONNECT scan-Pn skip host discovery-rate <n> packets per second-c <n> worker count-timeout <ms> per-probe timeout in milliseconds-retries <n> retry attempts-proxy <socks5://host:port> SOCKS5 proxy-verify verify discovered open ports-j, -json JSONL output-silent compact output-o <file> output fileAgent-safe baseline for automation:
naabu -list hosts.txt -top-ports 100 -scan-type c -Pn -rate 300 -c 25 -timeout 1000 -retries 1 -verify -silent -j -o naabu.jsonl
Common patterns:
naabu -list hosts.txt -top-ports 100 -scan-type c -rate 300 -c 25 -timeout 1000 -retries 1 -verify -silent -o naabu.txtnaabu -list hosts.txt -p 80,443,8080,8443 -scan-type c -rate 300 -c 25 -timeout 1000 -retries 1 -verify -silentnaabu -host target.tld -p 22,80,443 -scan-type c -rate 300 -c 25 -timeout 1000 -retries 1 -verifysudo naabu -list hosts.txt -top-ports 100 -scan-type syn -rate 500 -c 25 -timeout 1000 -retries 1 -verify -silentCritical correctness rules:
-scan-type connect when running without root/privileged raw socket access.-timeout explicitly; it is in milliseconds.-rate explicitly to avoid unstable or noisy scans.-timeout is in milliseconds, not seconds.-top-ports value unless broader coverage is explicitly required.-verify before handing ports to follow-up scanners.Usage rules:
-Pn or default discovery).-j -o <file> for automation pipelines.-p 22,80,443,8080,8443 or -top-ports 100 before considering larger sweeps.-h/--help for normal flow unless absolutely necessary.Failure recovery:
-scan-type c.-rate, lower -c, and tighten -p/-top-ports.-Pn.If uncertain, query web_search with:
site:docs.projectdiscovery.io naabu <flag> usage
penkit51 AI — professional penetration testing skill pack. Authorized testing only.
Official docs:
Canonical syntax:
naabu [flags]
High-signal flags:
-host <host> single host-list, -l <file> hosts list-p <ports> explicit ports (supports ranges)-top-ports <n|full> top ports profile-exclude-ports <ports> exclusions-scan-type <s|c|syn|connect> SYN or CONNECT scan-Pn skip host discovery-rate <n> packets per second-c <n> worker count-timeout <ms> per-probe timeout in milliseconds-retries <n> retry attempts-proxy <socks5://host:port> SOCKS5 proxy-verify verify discovered open ports-j, -json JSONL output-silent compact output-o <file> output fileAgent-safe baseline for automation:
naabu -list hosts.txt -top-ports 100 -scan-type c -Pn -rate 300 -c 25 -timeout 1000 -retries 1 -verify -silent -j -o naabu.jsonl
Common patterns:
naabu -list hosts.txt -top-ports 100 -scan-type c -rate 300 -c 25 -timeout 1000 -retries 1 -verify -silent -o naabu.txtnaabu -list hosts.txt -p 80,443,8080,8443 -scan-type c -rate 300 -c 25 -timeout 1000 -retries 1 -verify -silentnaabu -host target.tld -p 22,80,443 -scan-type c -rate 300 -c 25 -timeout 1000 -retries 1 -verifysudo naabu -list hosts.txt -top-ports 100 -scan-type syn -rate 500 -c 25 -timeout 1000 -retries 1 -verify -silentCritical correctness rules:
-scan-type connect when running without root/privileged raw socket access.-timeout explicitly; it is in milliseconds.-rate explicitly to avoid unstable or noisy scans.-timeout is in milliseconds, not seconds.-top-ports value unless broader coverage is explicitly required.-verify before handing ports to follow-up scanners.Usage rules:
-Pn or default discovery).-j -o <file> for automation pipelines.-p 22,80,443,8080,8443 or -top-ports 100 before considering larger sweeps.-h/--help for normal flow unless absolutely necessary.Failure recovery:
-scan-type c.-rate, lower -c, and tighten -p/-top-ports.-Pn.If uncertain, query web_search with:
site:docs.projectdiscovery.io naabu <flag> usage
record_vulnerability when running inside the penkit51 platformrecord_vulnerability when running inside the penkit51 platformAuthorized AI penetration testing assistant for web applications, APIs, and infrastructure. Performs reconnaissance, vulnerability assessment, PoC validation, exploit chaining, and professional reporting. Use when the user asks for pentest, penetration test, security assessment, vulnerability scan, bug bounty research, authorized hacking, SQLi/XSS/IDOR/SSRF testing, API security audit, or exploit validation.
Authorized AI penetration testing for web apps, APIs, cloud, and infrastructure. Full kill-chain methodology with PoC validation, vulnerability chaining, and professional reporting. Triggers on: pentest, penetration test, security assessment, vuln scan, bug bounty, red team, authorized hack, SQL injection test, XSS test, IDOR, SSRF, API security, exploit validation, security audit.
Authorized AI penetration testing assistant — full-spectrum security testing with deep exploitation skills and integrated tooling. Use for web app pentests, API security, vuln validation, PoC development, bug bounty, and security assessments. Triggers on pentest, penetration test, security audit, exploit, SQLi, XSS, IDOR, SSRF.
API安全测试的专业技能和方法论
JWT and OIDC security testing covering token forgery, algorithm confusion, and claim manipulation
AWS cloud security testing covering IAM misconfigurations, S3 exposure, metadata abuse, and privilege escalation paths