What is `port-threshold` for?

To drop hosts that look like CDN edges or honeypots with hundreds of open ports. Default is 10. A host above the threshold is excluded from all three outputs, not trimmed. Raise it for noisy ranges. Lower it for clean networks.

Can I scan custom ports?

Yes. `ports` includes, `exclude-ports` excludes. Without them you get the top 1000. There is no UDP option.

Does this name the service?

No. It tells you a TCP port answers, and which IP and hostname it belongs to. To get protocol, banner, and product, nest fingerprint network services on `port-details`.

Is this the port-scanner binary?

The module wraps a port-scan instrument so you can nest a typed FILE face. This page owns the job: `hosts` in, three port files out, threshold lever. Flags live on the [naabu](/tools/naabu) tool page. There is no `/tools/nmap` page; do not look for one.

2026-08-13

Attack Surface Management

Scan for Open Ports

Scan hostnames, IPs, and ranges for the top 1000 TCP ports. Set include and exclude ports and a per-host open-port threshold. Output feeds network service fingerprinting.

What Scan for Open Ports does

Before you can fingerprint a service, you need to know which ports are open. This module scans the top 1000 most common TCP ports on every IP behind every hostname, drops hosts that exceed your open-port threshold, and emits typed port records ready for the fingerprint step. It is the network-tail entry: hosts go in, port-details come out.

You feed hostnames, IPs, or CIDR ranges. The module scans which TCP ports answer on every IP behind every hostname, using the top 1000 frequency set unless you pass ports. Hosts over port-threshold (default 10) are dropped entirely. You get port-details for the fingerprint step, plus flat hostname-ports and ip-ports.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Upstream

Hostname enumerators (OSINT, crawl, DNS permutations, root-domain DNS brute force, recursive DNS brute force) produce hosts. DNS records can feed the same list.

Downstream

Fingerprint network services consumes port-details. Misconfig can take those raw records. Weak credentials cannot; it needs network-service-details from fingerprinting first. Findings from those scans feed the scan report.

Parallel

Probe live HTTP(S) runs on the same hosts and answers HTTP liveness, not open TCP ports. Do not cross into the web tail.

Network tail (this page is the first hop): hosts -> open-ports -> network FP -> (misconfig | weak-creds). Never hosts -> probe-web -> web FP.

When to use this

Nest this after you have a host list from DNS or OSINT, and before anything that needs to know which TCP ports answer. Fingerprinting, misconfig, and weak-credential testing all sit downstream of that record. If you only care whether HTTP is live, that is a different tail.

Inputs and outputs

Required: hosts (FILE): hostnames, IP addresses, or IP ranges, one per line.
Optional: ports (STRING): comma-separated ports to include. Omit this and the scan
exclude-ports (STRING): comma-separated ports to skip.
port-threshold (STRING): exclude hosts with more than this many open
Outputs: port-details: JSONL records (ip_address, port, hostname when known).
hostname-ports: hostname:port lines.
ip-ports: ip_address:port lines.

Data

The tables this module produces. Sample rows are illustrative.

port-details3 columns · 3 sample rows

JSONL records of open TCP ports. This is the input the fingerprint step consumes.

	ip_addresstext	portint	hostnametext
1	203.0.113.10	22	ssh.example.com
2	203.0.113.10	443	ssh.example.com
3	198.51.100.42	8080	NULL

hostname-ports1 column · 3 sample rows

Flat list of open ports formatted as hostname:port.

	host_porttext
1	ssh.example.com:22
2	ssh.example.com:443
3	web.example.com:8080

ip-ports1 column · 3 sample rows

Flat list of open ports formatted as ip_address:port.

	ip_porttext
1	203.0.113.10:22
2	203.0.113.10:443
3	198.51.100.42:8080

How it differs from similar modules

Scan for Open Ports

Artifact class it owns

Which TCP ports answer

Upstream it needs

hosts

Fingerprint network services

Artifact class it owns

Protocol, banner, product on each open port

Upstream it needs

port-details

Scan network services for misconfigurations

Artifact class it owns

Setup issues on named (or raw) services

Upstream it needs

port-details (FP optional)

Scan network services for weak credentials

Artifact class it owns

Vendor/default/weak logins on five protocols

Upstream it needs

network-service-details (FP required)

Probe live HTTP(S) is the web-tail entry on the same hosts. It does not emit port records.

questions