Merge pull request #1667 from projectdiscovery/1594-native-service-fingerprinting

Native service fingerprinting

Author: dogancanbakir

.gitignore

@@ -6,5 +6,6 @@ cmd/functional-test/naabu_dev
 cmd/functional-test/functional-test
 cmd/functional-test/naabu
 cmd/functional-test/*.cfg
+cmd/tools/portcorr/
 .vscode
 dist

README.md

@@ -86,6 +86,14 @@ OUTPUT:
    -j, -json           write output in JSON lines format
    -csv                write output in csv format
 
+SERVICES-DISCOVERY:
+   -sD, -service-discovery           identify services by port number
+   -sV, -service-version             detect service versions using nmap-service-probes
+   -sV-fast                          only probe port-hinted services (faster, skips fallback)
+   -sV-timeout duration              timeout for service version probes (default 5s)
+   -sV-workers int                   number of concurrent service version workers (default 25)
+   -sV-probes string                 custom nmap-service-probes file path (auto-detected if empty)
+
 CONFIGURATION:
    -config string                   path to the naabu configuration file (default $HOME/.config/naabu/config.yaml)
    -scan-all-ips, -sa               scan all the IP's associated with DNS record
@@ -368,6 +376,35 @@ PORT     STATE SERVICE       VERSION
 8443/tcp open  ssl/https-alt cloudflare
 ```
 
+# Service Version Detection
+
+Naabu has built-in service version detection using nmap's service probes database. This runs in parallel with port scanning for maximum performance.
+
+```sh
+naabu -host scanme.sh -sV
+```
+
+```console
+scanme.sh:22 [ssh OpenSSH/6.6.1p1]
+scanme.sh:80 [http Apache httpd/2.4.7]
+scanme.sh:9929 [nping-echo Nping echo]
+
+[INF] Found 3 ports on host scanme.sh (45.33.32.156) with 3 services identified
+```
+
+Available flags:
+
+| Flag | Description |
+|------|-------------|
+| `-sV` | Enable service version detection |
+| `-sV-fast` | Only probe port-hinted services (faster, skips fallback probes) |
+| `-sV-timeout duration` | Timeout for service version probes (default 5s) |
+| `-sV-workers int` | Number of concurrent service version workers (default 25) |
+| `-sV-probes string` | Custom nmap-service-probes file path (auto-detected if empty) |
+| `-sD` | Service discovery (match port number to service name, no active probing) |
+
+The `-sV` flag requires the `nmap-service-probes` database file. Naabu automatically looks for it in standard nmap installation paths. To use a custom file, specify the path with `-sV-probes`.
+
 # CDN/WAF Exclusion
 
 Naabu also supports excluding CDN/WAF IPs being port scanned. If used, only `80` and `443` ports get scanned for those IPs. This feature can be enabled by using `exclude-cdn` flag.

go.mod

@@ -8,6 +8,7 @@ require (
 	github.com/Ullaakut/nmap/v3 v3.0.6
 	github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
+	github.com/dlclark/regexp2 v1.11.5
 	github.com/logrusorgru/aurora v2.0.3+incompatible
 	github.com/miekg/dns v1.1.62
 	github.com/pkg/errors v0.9.1
@@ -57,7 +58,6 @@ require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dimchansky/utfbom v1.1.1 // indirect
 	github.com/djherbis/times v1.6.0 // indirect
-	github.com/dlclark/regexp2 v1.11.5 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
 	github.com/ebitengine/purego v0.10.0 // indirect