loading
Loading content
loading
Discovery
Routes port checks through public websites so probes do not leave your host.
overview
scanless asks a public port-scan website to check a --target IP or domain, so probe traffic originates from that third-party service rather than your infrastructure.
Point --scanner at one service (default hackertarget), spread load with --random, or compare readings with --all. Output is a file and folder of reported open ports.
Coverage and accuracy depend on whichever site answers. Treat results as a low-footprint first read, then confirm with a direct scanner such as nmap or rustscan.
source github.com/vesche/scanless
use cases
Route the scan through a public website so the probe comes from that service, keeping your own infrastructure off the target's logs.
Run every service with --all and compare their port readings, since each third-party scanner sees the target slightly differently.
Choose a specific service with --scanner or spread requests across the pool with --random when one site is rate-limiting or down.
Get an early open-port reading on an IP or domain before committing to a direct, higher-footprint scan with another tool.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| target | STRING | --target | IP or domain to scan. |
| scanner | STRING | --scanner | Scanner to use (default: hackertarget). |
| all | BOOLEAN | --all | Use all the scanners. |
| random | BOOLEAN | --random | Use a random scanner. |
Showing key inputs. scanless exposes 4 inputs in total.
example
# route a port scan through the default service (HackerTarget)scanless --target example.com --scanner hackertargetStarting Nmap 7.94 ( https://nmap.org ) at 2026-06-22 14:03 UTCNmap scan report for example.com (203.0.113.34)Host is up (0.052s latency).Not shown: 995 closed portsPORT STATE SERVICE22/tcp open ssh80/tcp open http443/tcp open https3306/tcp open mysql8080/tcp open http-proxyguidance
Reach for scanless when you want a port reading without sending packets from your own host. For controllable depth and speed, use rustscan or nmap instead.
Fast direct port scanner when you can send traffic from your own infrastructure.
Deep direct scanner with service detection and scripting.
Fast Go port scanner for direct, controllable discovery.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
A target feeds scanless, which routes the port scan through public websites and writes the reported open ports as a queryable output.
Facts on this page come from the live Trickest tool library.