Nerva
_{Nerva: Fast Service Fingerprinting CLI}

Features • Installation • Quick Start • Usage • Protocols • Library • Use Cases • Troubleshooting

High-performance service fingerprinting written in Go. Identify 170+ network protocols across TCP, UDP, and SCTP transports with rich metadata extraction.

Nerva rapidly detects and identifies services running on open network ports. Use it alongside port scanners like Naabu to fingerprint discovered services, or integrate it into your security pipelines for automated reconnaissance.

Features

• 170+ Protocol Plugins — Databases, remote access, web services, messaging, industrial, and telecom protocols
• 76 HTTP Fingerprinters — Detect web technologies including firewalls, databases, AI/LLM servers, and more
• Security Misconfiguration Detection — Identify common security issues like unauthenticated APIs and cleartext protocols (--misconfigs)
• Multi-Transport Support — TCP (default), UDP (--udp), and SCTP (--sctp, Linux only)
• Proxy Support — Route scanning traffic transparently through SOCKS5 or HTTP proxies with configurable DNS resolution
• Rich Metadata — Extract versions, configurations, and security-relevant details from each service
• Fast Mode — Scan only default ports for rapid reconnaissance (--fast)
• Flexible Output — JSON, CSV, or human-readable formats
• Pipeline Friendly — Pipe from Naabu, Nmap, or any tool that outputs host:port
• Go Library — Import directly into your Go applications

Installation

Releases

Download a prebuilt binary from the Releases page.

From GitHub

go install github.com/praetorian-inc/nerva/cmd/nerva@latest

From Source

git clone https://github.com/praetorian-inc/nerva.git
cd nerva
go build ./cmd/nerva
./nerva -h

Docker

git clone https://github.com/praetorian-inc/nerva.git
cd nerva
docker build -t nerva .
docker run --rm nerva -h
docker run --rm nerva -t example.com:80 --json

Quick Start

Fingerprint a single target:

nerva -t example.com:22
# ssh://example.com:22

Get detailed JSON metadata:

nerva -t example.com:22 --json
# {"host":"example.com","ip":"93.184.216.34","port":22,"protocol":"ssh","transport":"tcp","metadata":{...}}

Pipe from a port scanner:

naabu -host example.com -silent | nerva
# http://example.com:80
# ssh://example.com:22
# https://example.com:443

Usage

nerva [flags]

TARGET SPECIFICATION:
  Requires host:port or ip:port format. Assumes ports are open.

EXAMPLES:
  nerva -t example.com:80
  nerva -t example.com:80,example.com:443
  nerva -l targets.txt
  nerva --json -t example.com:80
  cat targets.txt | nerva

Flags

Examples

Multiple targets:

nerva -t example.com:22,example.com:80,example.com:443

From file:

nerva -l targets.txt --json -o results.json

UDP scanning (may require root):

sudo nerva -t example.com:53 -U
# dns://example.com:53

SCTP scanning (Linux only):

nerva -t telecom-server:3868 -S
# diameter://telecom-server:3868

Fast mode (default ports only):

nerva -l large-target-list.txt --fast --json

Proxy routing with remote DNS resolution:

nerva -t target.internal:80 --proxy socks5://127.0.0.1:1080 --dns-order p

Security Misconfiguration Detection

Nerva can identify common security misconfigurations when enabled with --misconfigs:

nerva -t example.com:2375 --misconfigs --json

Detected misconfigurations:

Example output with misconfigs:

{
  "host": "example.com",
  "port": 2375,
  "protocol": "docker",
  "anonymous_access": true,
  "security_findings": [
    {
      "id": "docker-unauth-api",
      "severity": "critical",
      "description": "Docker API accessible without authentication",
      "evidence": "Successfully queried /version endpoint without credentials"
    }
  ]
}

Proxy Support

Nerva supports routing scanning traffic through SOCKS5 and HTTP proxies with configurable DNS resolution.

Supported proxy schemes:

• socks5:// - SOCKS5 proxy with local DNS resolution
• socks5h:// - SOCKS5 proxy with proxy-side DNS resolution (always)
• http:// - HTTP CONNECT proxy
• https:// - HTTPS CONNECT proxy

Proxy authentication:

# Inline authentication (URL format)
nerva -t example.com:80 --proxy socks5://username:[email protected]:1080

# Separate authentication flag
nerva -t example.com:80 --proxy socks5://127.0.0.1:1080 --proxy-auth username:password

DNS resolution strategies (--dns-order):

Note: socks5h:// scheme automatically forces proxy-side DNS (equivalent to --dns-order p)

Tor scanning example:

# Scan .onion services through Tor (SOCKS5 proxy on port 9050)
nerva -t http://example.onion:80 --proxy socks5h://127.0.0.1:9050

UDP through proxy:

# UDP scanning through SOCKS5 proxy (limited support)
nerva -t target.com:161 --proxy socks5://127.0.0.1:1080 --udp

⚠️ UDP Limitations: UDP through SOCKS5 has limited support. Not all SOCKS5 servers support UDP association. Local UDP fallback may occur.

Parallel scanning with rate limiting:

nerva -l large-target-list.txt -W 100 -H 5 -R 50 -v

Graceful shutdown (Ctrl+C returns partial results):

nerva -l huge-target-list.txt -W 50 -v
# Press Ctrl+C to stop — collected results are still printed

Supported Protocols

170+ service detection plugins across TCP, UDP, and SCTP:

HTTP Fingerprint Modules (66)

Technology detection for web services, organized by category:

Firewalls & Network Security (12)

AI/LLM & Machine Learning (6)

Databases & Data Stores (12)

DevOps & Infrastructure (14)

Web Servers & Frameworks (10)

Enterprise & Business (8)

Home & IoT (2)

Other (2)

Databases (20)

Remote Access (6)

Web & API (2)

Messaging & Queues (10)

File & Directory Services (7)

Network Services (11)

Industrial Control Systems (18)

Telecom & VoIP (17)

VPN & Security (11)

Remote Access & Management (10)

Developer Tools (8)

Library Usage

Import Nerva into your Go applications:

package main

import (
    "context"
    "fmt"
    "log"
    "net/netip"
    "time"

    "github.com/praetorian-inc/nerva/pkg/plugins"
    "github.com/praetorian-inc/nerva/pkg/scan"
)

func main() {
    // Configure scan
    config := scan.Config{
        DefaultTimeout: 2 * time.Second,
        FastMode:       false,
        UDP:            false,
        Proxy:          "socks5://127.0.0.1:1080", // optional
        ProxyAuth:      "username:password",       // optional
        DNSOrder:       "p",                       // resolver strategy
    }

    // Create target
    ip, _ := netip.ParseAddr("93.184.216.34")
    target := plugins.Target{
        Address: netip.AddrPortFrom(ip, 22),
        Host:    "example.com",
    }

    // Run scan
    results, err := scan.ScanTargets(context.Background(), []plugins.Target{target}, config)
    if err != nil {
        log.Fatal(err)
    }

    // Process results
    for _, result := range results {
        fmt.Printf("%s:%d - %s (%s)\n",
            result.Host, result.Port,
            result.Protocol, result.Transport)
    }
}

See examples/service-fingerprinting-example.go for a complete working example.

Use Cases

Penetration Testing

Rapidly fingerprint services discovered during reconnaissance to identify potential attack vectors.

Asset Discovery Pipelines

Combine with Naabu or Masscan for large-scale asset inventory:

naabu -host 10.0.0.0/24 -silent | nerva --json | jq '.protocol'

CI/CD Security Scanning

Integrate into deployment pipelines to verify only expected services are exposed.

Bug Bounty Reconnaissance

Quickly enumerate services across scope targets to find interesting endpoints.

Telecom Network Analysis

Fingerprint Diameter nodes in LTE/5G networks using SCTP transport (Linux):

nerva -t mme.telecom.local:3868 -S --json

Architecture

graph LR
    A[host:port input] --> B[Target Parser]
    B --> C[Scan Engine]
    C --> D{Transport}
    D -->|TCP| E[TCP Plugins]
    D -->|UDP| F[UDP Plugins]
    D -->|SCTP| G[SCTP Plugins]
    E --> H[Service Detection]
    F --> H
    G --> H
    H --> I[Metadata Extraction]
    I --> J[JSON/CSV/Text Output]

Why Nerva?

vs Nmap

• Smarter defaults: Nerva checks the most likely protocol first based on port number
• Structured output: Native JSON/CSV support for easy parsing and pipeline integration
• Focused: Service fingerprinting only — pair with dedicated port scanners for discovery

vs zgrab2

• Auto-detection: No need to specify protocol ahead of time
• Simpler usage: nerva -t host:port vs echo host | zgrab2 http -p port

Troubleshooting

No output

Cause: Port is closed or no supported service detected.

Solution: Verify the port is open:

nc -zv example.com 80

Timeout errors

Cause: Default 2-second timeout too short for slow services.

Solution: Increase timeout:

nerva -t example.com:80 -w 5000  # 5 seconds

UDP services not detected

Cause: UDP scanning disabled by default.

Solution: Enable with -U flag (may require root):

sudo nerva -t example.com:53 -U

SCTP not working

Cause: SCTP only supported on Linux.

Solution: Run on a Linux system or container:

docker run --rm nerva -t telecom:3868 -S

Terminology

• Service: A network service running on a port (SSH, HTTP, PostgreSQL, etc.)
• Fingerprinting: Detecting and identifying the service type, version, and configuration
• Plugin: A protocol-specific detection module
• Fast Mode: Scanning only the default port for each protocol (80/20 optimization)
• Transport: Network layer protocol (TCP, UDP, or SCTP)

Support

If you find Nerva useful, please consider giving it a star:

Contributing

We welcome contributions! See CONTRIBUTING.md for guidelines.

License

Apache 2.0 — see LICENSE for details.

Acknowledgements

Nerva is a maintained fork of fingerprintx, originally developed by Praetorian's intern class of 2022:

• Soham Roy
• Jue Huang
• Henry Jung
• Tristan Wiesepape
• Joseph Henry
• Noah Tutt
• Nathan Sportsman