Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Discovery

Get open ports without probing from your host

Routes port checks through public websites so probes do not leave your host.

Agent
Port-scan without direct trafficCompare results across scannersPick or randomize the scanner

overview

What scanless does

scanless asks a public port-scan website to check a --target IP or domain, so probe traffic originates from that third-party service rather than your infrastructure.

Point --scanner at one service (default hackertarget), spread load with --random, or compare readings with --all. Output is a file and folder of reported open ports.

Coverage and accuracy depend on whichever site answers. Treat results as a low-footprint first read, then confirm with a direct scanner such as nmap or rustscan.

source github.com/vesche/scanless

use cases

Where scanless fits

Port-scan without direct traffic

Route the scan through a public website so the probe comes from that service, keeping your own infrastructure off the target's logs.

Compare results across scanners

Run every service with --all and compare their port readings, since each third-party scanner sees the target slightly differently.

Pick or randomize the scanner

Choose a specific service with --scanner or spread requests across the pool with --random when one site is rate-limiting or down.

Open recon with a light touch

Get an early open-port reading on an IP or domain before committing to a direct, higher-footprint scan with another tool.

reference

scanless inputs and flags

4 inputs
NameTypeFlagDescription
targetSTRING--targetIP or domain to scan.
scannerSTRING--scannerScanner to use (default: hackertarget).
allBOOLEAN--allUse all the scanners.
randomBOOLEAN--randomUse a random scanner.

Showing key inputs. scanless exposes 4 inputs in total.

example

Run scanless

scanless · command
# route a port scan through the default service (HackerTarget)scanless --target example.com --scanner hackertarget
sample output
Starting Nmap 7.94 ( https://nmap.org ) at 2026-06-22 14:03 UTCNmap scan report for example.com (203.0.113.34)Host is up (0.052s latency).Not shown: 995 closed portsPORT     STATE SERVICE22/tcp   open  ssh80/tcp   open  http443/tcp  open  https3306/tcp open  mysql8080/tcp open  http-proxy

guidance

Choosing scanless

Reach for scanless when you want a port reading without sending packets from your own host. For controllable depth and speed, use rustscan or nmap instead.

rustscan

Fast direct port scanner when you can send traffic from your own infrastructure.

nmap

Deep direct scanner with service detection and scripting.

naabu

Fast Go port scanner for direct, controllable discovery.

faq

scanless questions

Pass the address with --target, for example `scanless --target example.com`. It defaults to the HackerTarget service and prints the open ports that come back.

related

More Discovery tools

  1. apkurlgrep

    Extract URLs and endpoints from Android APK files.

  2. cariddi

    Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.

  3. crawlergo

    Browser-driven crawler that harvests requests for downstream scanners.

  4. dirsearch

    Web path scanner.

  5. fallparams

    Crawl pages, harvest potential parameters, write a custom wordlist.

  6. feroxbuster

    Recursive content discovery with smart defaults and rich response filters.

Run scanless yourself

A target feeds scanless, which routes the port scan through public websites and writes the reported open ports as a queryable output.

Run scanless in TrickestBrowse the library

Facts on this page come from the live Trickest tool library.