Skip to content

Native service fingerprinting#1667

Draft
Mzack9999 wants to merge 9 commits intodevfrom
1594-native-service-fingerprinting
Draft

Native service fingerprinting#1667
Mzack9999 wants to merge 9 commits intodevfrom
1594-native-service-fingerprinting

Conversation

@Mzack9999
Copy link
Copy Markdown
Member

@Mzack9999 Mzack9999 commented Mar 27, 2026

Native Service Fingerprinting (-sV)

Adds a built-in nmap-compatible service fingerprinting engine that runs directly inside naabu, no external nmap binary required. The engine parses standard nmap-service-probes files (11,951 match rules, 1,200+ identifiable services), sends protocol-specific probes to discovered ports, and matches responses against regex patterns to identify services, versions, and CPEs. Supports TLS-aware probing, probe intensity levels, fast mode, configurable concurrency, and custom probe files.

Benchmarked against nmap 7.98 on 8 mock TCP services (SSH, FTP, SMTP, IMAP, POP3, MySQL, HTTP nginx, HTTP Apache):

  • 100% accuracy (8/8 correct, 0 false positives), matching nmap exactly
  • 92x to 812x faster than nmap on banner-based services (SSH 2ms vs 185ms, POP3 <1ms vs 260ms, MySQL <1ms vs 147ms)
  • 6,000x faster on HTTP standard ports (port-hinted match in <1ms vs nmap's 6s)
  • 1.9x faster total scan time across all 8 services (6s vs 11.2s)
root@box:~# naabu -host scanme.sh -sV
scanme.sh:22 [ssh/OpenSSH/9.7p1]
scanme.sh:80 [http/Apache httpd/2.4.52]

New flags: -sD (service discovery), -sV (service version), -sV-fast (port-hinted only), -sV-timeout, -sV-workers, -sV-probes.

Mzack9999 and others added 6 commits March 26, 2026 13:33
* parse Darwin routing table with golang.org/x/net/route

* add subnet mask to destination

* add LinkAddr support

* consolidate darwin and freebsd routing logic into one file

* use windows api to get routing table instead of os.exec

* fix potential nil pointer dereference

* fixing minor issues

---------

Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
* fix: add system DNS fallback for split‑DNS/VPN resolution

* make system resolver optional

---------

Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
* fix: scan type inconsistency after scanner initialization

If SYN scan type is specified for the runner, but NewScanner failed to acquire
a listen handler, NewScanner will fallback to CONNECT scan without updating
the runner's scan type option. This causes the runner to later attempt to use
raw packet scan with an empty listen handler when it should have used a normal
connect scan.

* minor fix

---------

Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
@Mzack9999 Mzack9999 self-assigned this Mar 27, 2026
@Mzack9999 Mzack9999 added the Type: Enhancement Most issues will probably ask for additions or changes. label Mar 27, 2026
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Mar 27, 2026

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1169f5ed-1c4e-4c40-be8d-fad04fe868f5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch 1594-native-service-fingerprinting

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@ehsandeep ehsandeep linked an issue Mar 28, 2026 that may be closed by this pull request
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Type: Enhancement Most issues will probably ask for additions or changes.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Native Service Discovery & Banner Grabbing Support

4 participants