Features • Installation • Quick Start • Usage • Protocols • Library • Use Cases • Troubleshooting

High-performance service fingerprinting written in Go. Identify 170+ network protocols across TCP, UDP, and SCTP transports with rich metadata extraction.

Nerva rapidly detects and identifies services running on open network ports. Use it alongside port scanners like Naabu to fingerprint discovered services, or integrate it into your security pipelines for automated reconnaissance.

• 170+ Protocol Plugins — Databases, remote access, web services, messaging, industrial, and telecom protocols
• 76 HTTP Fingerprinters — Detect web technologies including firewalls, databases, AI/LLM servers, and more
• Security Misconfiguration Detection — Identify common security issues like unauthenticated APIs and cleartext protocols (--misconfigs)
• Multi-Transport Support — TCP (default), UDP (--udp), and SCTP (--sctp, Linux only)
• Proxy Support — Route scanning traffic transparently through SOCKS5 or HTTP proxies with configurable DNS resolution
• Rich Metadata — Extract versions, configurations, and security-relevant details from each service
• Fast Mode — Scan only default ports for rapid reconnaissance (--fast)
• Flexible Output — JSON, CSV, or human-readable formats
• Pipeline Friendly — Pipe from Naabu, Nmap, or any tool that outputs host:port
• Go Library — Import directly into your Go applications

Download a prebuilt binary from the Releases page.

go install github.com/praetorian-inc/nerva/cmd/nerva@latest

git clone https://github.com/praetorian-inc/nerva.git
cd nerva
go build ./cmd/nerva
./nerva -h

git clone https://github.com/praetorian-inc/nerva.git
cd nerva
docker build -t nerva .
docker run --rm nerva -h
docker run --rm nerva -t example.com:80 --json

Fingerprint a single target:

nerva -t example.com:22
# ssh://example.com:22

Get detailed JSON metadata:

nerva -t example.com:22 --json
# {"host":"example.com","ip":"93.184.216.34","port":22,"protocol":"ssh","transport":"tcp","metadata":{...}}

Pipe from a port scanner:

naabu -host example.com -silent | nerva
# http://example.com:80
# ssh://example.com:22
# https://example.com:443

The full reference — every subcommand, alias and flag, including the ones hidden from --help — is generated into docs/CLI.md.

nerva [flags]

TARGET SPECIFICATION:
  Requires host:port or ip:port format. Assumes ports are open.

EXAMPLES:
  nerva -t example.com:80
  nerva -t example.com:80,example.com:443
  nerva -l targets.txt
  nerva --json -t example.com:80
  cat targets.txt | nerva

Multiple targets:

nerva -t example.com:22,example.com:80,example.com:443

From file:

nerva -l targets.txt --json -o results.json

UDP scanning:

nerva -t example.com:53 -U
# dns://example.com:53

SCTP scanning (Linux only):

nerva -t telecom-server:3868 -S
# diameter://telecom-server:3868

Fast mode (default ports only):

nerva -l large-target-list.txt --fast --json

Proxy routing with remote DNS resolution:

nerva -t target.internal:80 --proxy socks5://127.0.0.1:1080 --dns-order p

Nerva can identify common security misconfigurations when enabled with --misconfigs:

nerva -t example.com:2375 --misconfigs --json

Detected misconfigurations:

Example output with misconfigs:

{
  "host": "example.com",
  "port": 2375,
  "protocol": "docker",
  "anonymous_access": true,
  "security_findings": [
    {
      "id": "docker-unauth-api",
      "severity": "critical",
      "description": "Docker API accessible without authentication",
      "evidence": "Successfully queried /version endpoint without credentials"
    }
  ]
}

Nerva supports routing scanning traffic through SOCKS5 and HTTP proxies with configurable DNS resolution.

Supported proxy schemes:

• socks5:// - SOCKS5 proxy with local DNS resolution
• socks5h:// - SOCKS5 proxy with proxy-side DNS resolution (always)
• http:// - HTTP CONNECT proxy
• https:// - HTTPS CONNECT proxy

Proxy authentication:

# Inline authentication (URL format)
nerva -t example.com:80 --proxy socks5://username:[email protected]:1080

# Separate authentication flag
nerva -t example.com:80 --proxy socks5://127.0.0.1:1080 --proxy-auth username:password

DNS resolution strategies (--dns-order):

Note: socks5h:// scheme automatically forces proxy-side DNS (equivalent to --dns-order p)

Tor scanning example:

# Scan .onion services through Tor (SOCKS5 proxy on port 9050)
nerva -t http://example.onion:80 --proxy socks5h://127.0.0.1:9050

UDP through proxy:

# UDP scanning through SOCKS5 proxy (limited support)
nerva -t target.com:161 --proxy socks5://127.0.0.1:1080 --udp

⚠️ UDP Limitations: UDP through SOCKS5 has limited support. Not all SOCKS5 servers support UDP association. Local UDP fallback may occur.

Parallel scanning with rate limiting:

nerva -l large-target-list.txt -W 100 -H 5 -R 50 -v

Graceful shutdown (Ctrl+C returns partial results):

nerva -l huge-target-list.txt -W 50 -v
# Press Ctrl+C to stop — collected results are still printed

170+ service detection plugins across TCP, UDP, and SCTP:

Technology detection for web services, organized by category:

The additional remote-access detectors in pkg/plugins/services/rat/ reuse Nerva's shared protocol and HTTP/HTTPS engines. They identify services, not installation or unattended-access settings. Port numbers alone are not detections.

Import Nerva into your Go applications:

package main

import (
    "context"
    "fmt"
    "log"
    "net/netip"
    "time"

    "github.com/praetorian-inc/nerva/pkg/plugins"
    "github.com/praetorian-inc/nerva/pkg/scan"
)

func main() {
    // Configure scan
    config := scan.Config{
        DefaultTimeout: 2 * time.Second,
        FastMode:       false,
        UDP:            false,
        Proxy:          "socks5://127.0.0.1:1080", // optional
        ProxyAuth:      "username:password",       // optional
        DNSOrder:       "p",                       // resolver strategy
    }

    // Create target
    ip, _ := netip.ParseAddr("93.184.216.34")
    target := plugins.Target{
        Address: netip.AddrPortFrom(ip, 22),
        Host:    "example.com",
    }

    // Run scan
    results, err := scan.ScanTargets(context.Background(), []plugins.Target{target}, config)
    if err != nil {
        log.Fatal(err)
    }

    // Process results
    for _, result := range results {
        fmt.Printf("%s:%d - %s (%s)\n",
            result.Host, result.Port,
            result.Protocol, result.Transport)
    }
}

See examples/service-fingerprinting-example.go for a complete working example.

Rapidly fingerprint services discovered during reconnaissance to identify potential attack vectors.

Combine with Naabu or Masscan for large-scale asset inventory:

naabu -host 10.0.0.0/24 -silent | nerva --json | jq '.protocol'

Integrate into deployment pipelines to verify only expected services are exposed.

Quickly enumerate services across scope targets to find interesting endpoints.

Fingerprint Diameter nodes in LTE/5G networks using SCTP transport (Linux):

nerva -t mme.telecom.local:3868 -S --json

graph LR
    A[host:port input] --> B[Target Parser]
    B --> C[Scan Engine]
    C --> D{Transport}
    D -->|TCP| E[TCP Plugins]
    D -->|UDP| F[UDP Plugins]
    D -->|SCTP| G[SCTP Plugins]
    E --> H[Service Detection]
    F --> H
    G --> H
    H --> I[Metadata Extraction]
    I --> J[JSON/CSV/Text Output]

• Smarter defaults: Nerva checks the most likely protocol first based on port number
• Structured output: Native JSON/CSV support for easy parsing and pipeline integration
• Focused: Service fingerprinting only — pair with dedicated port scanners for discovery

• Auto-detection: No need to specify protocol ahead of time
• Simpler usage: nerva -t host:port vs echo host | zgrab2 http -p port

Cause: Port is closed or no supported service detected.

Solution: Verify the port is open:

nc -zv example.com 80

Cause: Default 2-second timeout too short for slow services.

Solution: Increase timeout:

nerva -t example.com:80 -w 5000  # 5 seconds

Cause: UDP scanning disabled by default.

Solution: Enable with -U flag:

nerva -t example.com:53 -U

Nerva UDP scans use connected datagram sockets and do not require root.

Cause: SCTP only supported on Linux.

Solution: Run on a Linux system or container:

docker run --rm nerva -t telecom:3868 -S

• Service: A network service running on a port (SSH, HTTP, PostgreSQL, etc.)
• Fingerprinting: Detecting and identifying the service type, version, and configuration
• Plugin: A protocol-specific detection module
• Fast Mode: Scanning only the default port for each protocol (80/20 optimization)
• Transport: Network layer protocol (TCP, UDP, or SCTP)

If you find Nerva useful, please consider giving it a star:

We welcome contributions! See CONTRIBUTING.md for guidelines.

Apache 2.0 — see LICENSE for details.

Nerva is a maintained fork of fingerprintx, originally developed by Praetorian's intern class of 2022:

• Soham Roy
• Jue Huang
• Henry Jung
• Tristan Wiesepape
• Joseph Henry
• Noah Tutt
• Nathan Sportsman