The scan pipeline

Stage 1 — port discovery (naabu)#

naabu sweeps TCP ports to find what is reachable. The free tier covers the top 1,000 ports. Paid tiers cover all 65,535. Everything downstream only looks at ports that answered here.

Stage 2 — service and CVE detection (nmap + vulners)#

nmap runs -sV --script vulners on every open port. -sV fingerprints the service and version behind the port. The vulners script matches those versions against known CVEs. This stage is identical across all three tiers.

Stage 3 — vulnerability checks (nuclei)#

nuclei runs template based checks against what was detected:

Free and Full Pro: roughly 2,000 curated high signal templates.
Deep: the full set of roughly 10,500 templates plus custom checks.

Templates cover exposures, default logins, takeovers, TLS issues, and KEV plus critical or high CVEs matched to your detected services.

Versions we run#

naabu 2.6.1, nmap 7.93 with vulners, and nuclei 3.3.9 with the public nuclei-templates. No proprietary scanning engine sits in the path.

Where the scan comes from#

The scan originates from our scanner nodes, which gives you an outside in view. Nothing runs on your host, so there is no agent, no install and no inbound rule to add.