Nerva: Why Elite Hackers Ditched Nmap for This 170+ Protocol Beast

Nerva: Why Elite Hackers Ditched Nmap for This 170+ Protocol Beast

What if your port scanner is lying to you?

You've been there. You run Nmap, get back open port 80, and call it a day. But what's actually running? Is it Apache? Nginx? A misconfigured Docker^{↗ Bright Coding Blog} Registry exposing your entire container infrastructure? A hidden AI inference server with zero authentication? The difference between a script kiddie and a professional operator isn't finding open ports—it's understanding what breathes behind them.

Here's the brutal truth: traditional service detection is broken. Nmap's -sV flag crawls. Masscan finds ports but stays blind to services. Zgrab2 forces you to guess protocols in advance. Meanwhile, your attack window shrinks, your bug bounty competition moves faster, and that critical misconfiguration stays hidden in plain sight.

Enter Nerva—the open-source service fingerprinting CLI that Praetorian's elite red team built to solve exactly this pain. Written in blazing-fast Go, Nerva identifies 170+ network protocols across TCP, UDP, and SCTP transports with sub-second precision. It doesn't just find services—it extracts versions, configurations, and security-relevant metadata that turns reconnaissance into actionable intelligence.

Ready to stop guessing and start knowing? Let's dissect why security professionals are quietly replacing their old toolchain with this precision instrument.

What is Nerva?

Nerva is a high-performance service fingerprinting command-line interface developed by Praetorian, one of the cybersecurity industry's most respected offensive security firms. Born as a maintained fork of their earlier fingerprintx project (created by Praetorian's 2022 intern class), Nerva represents a complete architectural evolution in network service identification.

The name itself evokes the Roman Emperor Nerva—known for strategic consolidation and laying groundwork for empire-wide transformation. Fitting, because this tool consolidates fragmented reconnaissance workflows into a single, devastatingly efficient pipeline component.

Why it's trending now:

The cybersecurity landscape has shifted dramatically. Cloud-native architectures exploded protocol diversity. AI/LLM infrastructure created entirely new attack surfaces. Industrial IoT and 5G telecom networks introduced protocols most tools ignore entirely. Traditional scanners were built for a simpler internet—Nerva was engineered for this internet.

Praetorian open-sourced Nerva because they needed it for their own client engagements. When a top-tier offensive security firm dogfoods a tool through hundreds of real-world pentests, you pay attention. The GitHub repository has accumulated significant traction among bug bounty hunters, red teamers, and DevSecOps engineers who've discovered what happens when you pair modern protocol coverage with pipeline-native design.

Unlike monolithic scanners that try to do everything mediocrely, Nerva follows the Unix philosophy: do one thing exceptionally well. It fingerprints services. Period. You bring your own port scanner (Naabu, Masscan, Nmap), pipe the results through Nerva, and receive structured intelligence ready for automated analysis or human decision-making.

Key Features That Destroy the Competition

170+ Protocol Plugins — The Widest Coverage Available

Nerva's plugin architecture spans databases, remote access, web services, messaging queues, industrial control systems, telecom protocols, and VPN infrastructure. Where competitors stop at common ports, Nerva dives into SCADA/PLC protocols (Modbus, S7comm, EtherNet/IP), 5G core network signaling (Diameter, M3UA, PFCP), and emerging AI infrastructure (Ollama, LocalAI, Triton inference servers).

76 HTTP Fingerprinting Modules — Web Technology X-Ray

The HTTP detection engine doesn't just identify servers—it pinpoints exact technology stacks. Firewall detection includes Check Point, Cisco ASA/FTD, FortiGate, Palo Alto GlobalProtect, and Juniper SRX. AI/LLM infrastructure fingerprinting covers Ollama, LocalAI, Open WebUI, NVIDIA Triton, Weaviate, and ChromaDB. DevOps^{↗ Bright Coding Blog} tools? Grafana, Jenkins, Kubernetes, Vault, Harbor, and twelve more. This isn't banner grabbing—it's deep behavioral analysis.

Security Misconfiguration Detection — Find Exploitable Weaknesses

Enable --misconfigs and Nerva transforms from passive identifier to active security assessor. It detects Docker APIs without authentication, X11 servers allowing unauthenticated connections, SMB signing disabled (hello, relay attacks), SSH password authentication enabled, weak cryptographic suites (RC4, 3DES, Blowfish), and cleartext credential transmission via Telnet or FTP. Each finding includes severity ratings and evidence—ready for your report.

Multi-Transport Support — TCP, UDP, and SCTP

Most tools ignore UDP. Almost none handle SCTP (Stream Control Transmission Protocol), the transport powering LTE and 5G core networks. Nerva treats all three as first-class citizens, with intelligent transport selection based on target ports.

Proxy Integration with Surgical DNS Control

Route through SOCKS5 or HTTP proxies with configurable DNS resolution strategies. Scan .onion services via Tor (socks5h://127.0.0.1:9050). Force proxy-side DNS to prevent leakage. The --dns-order flag (l, p, lp, pl) gives you precise control over resolution behavior—critical for operational security.

Pipeline-Native Architecture

Nerva speaks the language of modern security automation. Pipe from any tool outputting host:port format. Emit JSON, CSV, or human-readable text. Graceful shutdown preserves partial results when you Ctrl+C massive scans. Rate limiting (-R), connection throttling (-H), and worker pools (-W) prevent target disruption while maintaining speed.

Use Cases: Where Nerva Dominates

1. Penetration Testing & Red Team Operations

You've gained network access. Now what? Nerva rapidly characterizes the attack surface to identify high-value pivot points. That "unknown service" on port 8443? Nerva identifies it as VMware Horizon—your path to VDI compromise. The weird port 3868? Diameter over SCTP, exposing 5G authentication infrastructure. Speed matters when dwell time is measured in minutes.

2. Large-Scale Asset Discovery Pipelines

Modern enterprises have dynamic, cloud-spanning infrastructure. Combine Nerva with Naabu for continuous asset inventory:

naabu -host 10.0.0.0/8 -silent | nerva --json | jq '. | select(.protocol == "docker" or .protocol == "kubernetes")'

This single pipeline identifies container infrastructure across a /8 network—work that would take hours with manual analysis.

3. CI/CD Security Gates

Deploy Nerva in your deployment pipeline to verify exposed services match expectations. Did someone accidentally expose the Docker API? Is Redis unauthenticated? Nerva catches drift before it reaches production, with structured JSON output perfect for policy enforcement.

4. Bug Bounty Reconnaissance at Scale

Bug bounty programs reward novel findings, not common vulnerabilities. Nerva's AI/LLM infrastructure detection (Ollama, LocalAI, Triton) and industrial protocol coverage reveal targets others miss. Fast mode (--fast) lets you sweep thousands of hosts against default ports, then deep-dive interesting targets.

5. Telecom & Critical Infrastructure Assessment

SCTP support makes Nerva uniquely valuable for 5G and LTE network analysis. Diameter, M3UA, M2UA, SGsAP, X2AP—these protocols control authentication, handover, and circuit-switched fallback in mobile networks. Most security tools can't even speak SCTP, let alone fingerprint these services.

Step-by-Step Installation & Setup Guide

Method 1: Prebuilt Binary (Fastest)

Download the latest release for your platform from the GitHub Releases page. Extract and move to your PATH:

# Linux/macOS example
wget https://github.com/praetorian-inc/nerva/releases/download/vX.Y.Z/nerva_Linux_x86_64.tar.gz
tar -xzf nerva_Linux_x86_64.tar.gz
sudo mv nerva /usr/local/bin/
nerva -h

Method 2: Go Install (Requires Go 1.21+)

go install github.com/praetorian-inc/nerva/cmd/nerva@latest

Ensure $GOPATH/bin or $HOME/go/bin is in your PATH.

Method 3: Build from Source

# Clone the repository
git clone https://github.com/praetorian-inc/nerva.git
cd nerva

# Build the binary
go build ./cmd/nerva

# Verify installation
./nerva -h

Method 4: Docker (Isolated, Cross-Platform)

# Clone and build image
git clone https://github.com/praetorian-inc/nerva.git
cd nerva
docker build -t nerva .

# Run basic help
docker run --rm nerva -h

# Execute scan with JSON output
docker run --rm nerva -t example.com:80 --json

Environment Setup Tips

• UDP scanning requires root privileges on most systems: sudo nerva -t target:53 -U
• SCTP scanning is Linux-only—use Docker on macOS/Windows: docker run --rm nerva -t telecom:3868 -S
• For Tor scanning, ensure Tor service is running locally on port 9050
• Add to your shell profile for convenience: alias nerva-udp='sudo nerva -U'

REAL Code Examples from the Repository

Example 1: Basic Service Fingerprinting

The simplest possible invocation—yet Nerva extracts remarkable detail:

# Fingerprint SSH service on standard port
nerva -t example.com:22
# Output: ssh://example.com:22

What's happening under the hood: Nerva's SSH plugin performs protocol handshake analysis, extracts the server version string, identifies supported authentication methods, and flags password authentication if enabled. The ssh:// URI format provides instant protocol recognition for downstream tools.

Example 2: Structured JSON Output for Automation

# Extract rich metadata as machine-parseable JSON
nerva -t example.com:22 --json

Sample output structure:

{
  "host": "example.com",
  "ip": "93.184.216.34",
  "port": 22,
  "protocol": "ssh",
  "transport": "tcp",
  "metadata": {
    "version": "OpenSSH_8.9p1",
    "auth_methods": ["publickey", "password"],
    "weak_algorithms": false
  }
}

Why this matters: JSON output enables seamless integration with SIEMs, ticketing systems, and custom analysis pipelines. The metadata object contains protocol-specific extractions—version strings, configurations, security-relevant capabilities—that fuel automated decision-making.

Example 3: Pipeline Integration with Naabu

# Chain port discovery directly into service fingerprinting
naabu -host example.com -silent | nerva
# Output:
# http://example.com:80
# ssh://example.com:22
# https://example.com:443

The power of composability: Naabu outputs host:port lines; Nerva consumes exactly that format. No intermediate parsing scripts. No fragile regex transformations. This pattern scales to thousands of hosts, with Nerva's worker pool (-W) and rate limiting (-R) preventing overwhelming targets.

Example 4: Security Misconfiguration Detection

# Enable active security assessment mode
nerva -t example.com:2375 --misconfigs --json

Critical finding example:

{
  "host": "example.com",
  "port": 2375,
  "protocol": "docker",
  "anonymous_access": true,
  "security_findings": [
    {
      "id": "docker-unauth-api",
      "severity": "critical",
      "description": "Docker API accessible without authentication",
      "evidence": "Successfully queried /version endpoint without credentials"
    }
  ]
}

Operational impact: This isn't theoretical. Exposed Docker APIs are among the most common container security failures, enabling full host compromise via container escape. Nerva's evidence field provides proof for your report, while severity ratings prioritize remediation.

Example 5: Advanced Proxy & DNS Configuration

# Scan through Tor with proxy-side DNS resolution
nerva -t http://example.onion:80 --proxy socks5h://127.0.0.1:9050

# Or explicit DNS control with separate auth
nerva -t target.internal:80 \
  --proxy socks5://127.0.0.1:1080 \
  --proxy-auth username:password \
  --dns-order p

DNS resolution strategies explained:

• l (local): Standard DNS through your resolver—fastest, but leaks target info to local DNS
• p (proxy): Forces proxy-side DNS—hides targets from local infrastructure, required for .onion
• lp (local, fallback proxy): Balances speed and privacy
• pl (proxy, fallback local): Privacy-first with reliability fallback

The socks5h:// scheme automatically enforces proxy-side DNS, equivalent to --dns-order p.

Example 6: Go Library Integration

Embed Nerva directly into your applications:

package main

import (
    "context"
    "fmt"
    "log"
    "net/netip"
    "time"

    "github.com/praetorian-inc/nerva/pkg/plugins"
    "github.com/praetorian-inc/nerva/pkg/scan"
)

func main() {
    // Configure scan parameters with sensible defaults
    config := scan.Config{
        DefaultTimeout: 2 * time.Second,  // Per-connection timeout
        FastMode:       false,             // Check all protocol plugins
        UDP:            false,             // TCP only for this scan
        Proxy:          "socks5://127.0.0.1:1080", // Optional proxy routing
        ProxyAuth:      "username:password",       // Proxy credentials
        DNSOrder:       "p",                // Proxy-side DNS resolution
    }

    // Create target from parsed IP and port
    ip, _ := netip.ParseAddr("93.184.216.34")
    target := plugins.Target{
        Address: netip.AddrPortFrom(ip, 22),  // IP:port as netip.AddrPort
        Host:    "example.com",               // Original hostname for SNI/certs
    }

    // Execute scan with context for cancellation control
    results, err := scan.ScanTargets(context.Background(), []plugins.Target{target}, config)
    if err != nil {
        log.Fatal(err)
    }

    // Process structured results
    for _, result := range results {
        fmt.Printf("%s:%d - %s (%s)\n",
            result.Host, result.Port,
            result.Protocol, result.Transport)
    }
}

Key architectural insight: The plugins.Target struct separates Address (resolved IP:port) from Host (original hostname). This dual representation enables accurate certificate validation, SNI negotiation, and result attribution—even when DNS resolution happens through proxies.

Advanced Usage & Best Practices

Optimize for Speed with Fast Mode

When sweeping massive ranges, --fast checks only default ports per protocol. This 80/20 optimization typically identifies 80% of services in 20% of the time—perfect for initial triage before deep inspection.

nerva -l massive-targets.txt --fast --json -o triage.json

Tune Concurrency for Target Resilience

Default settings assume healthy targets. For fragile infrastructure, throttle aggressively:

nerva -l targets.txt -W 20 -H 2 -R 10 -v
# 20 global workers, max 2 per host, 10 scans/second, verbose progress

Graceful Shutdown for Long Scans

Press Ctrl+C during massive scans—Nerva prints all collected results instead of dying silently. Critical for time-boxed engagements.

UDP Scanning Requires Privilege Elevation

Raw UDP socket operations need root on most Unix systems. Always use sudo for UDP mode, or expect silent failures.

SCTP in Docker for Cross-Platform

macOS and Windows lack native SCTP. Build once, run everywhere:

docker build -t nerva . 
docker run --rm nerva -t telecom:3868 -S --json

Combine with jq for Targeted Analysis

# Find only exposed databases
nerva -l targets.txt --json | jq 'select(.protocol | test("postgres|mysql↗ Bright Coding Blog|mongo|redis|elasticsearch"))'

# Flag critical misconfigurations only
nerva -l targets.txt --misconfigs --json | jq '. | select(.security_findings[]?.severity == "critical")'

Comparison with Alternatives

The Verdict: Nmap remains indispensable for host discovery and OS fingerprinting. Masscan rules for internet-scale port sweeping. But for service identification at speed with structured output, Nerva occupies a unique position—especially when protocol diversity (SCTP, industrial, telecom) or pipeline automation matters.

FAQ

Q: Does Nerva replace Nmap entirely?

No—Nerva complements Nmap. Use Nmap or Masscan for host discovery and port scanning, then pipe open ports through Nerva for precise service identification. They're teammates, not competitors.

Q: Why does UDP scanning require root privileges?

Raw UDP sockets require elevated privileges on most operating systems to craft and receive protocol-specific probes. This is a system-level restriction, not a Nerva limitation.

Q: Can I scan SCTP protocols on macOS or Windows?

SCTP is Linux-only in Nerva. Use Docker (docker run --rm nerva -t target:3868 -S) to scan SCTP targets from any platform.

Q: How does Nerva handle false positives?

Nerva uses behavioral protocol analysis rather than simple banner matching. Each plugin implements protocol-specific handshakes and validates responses against expected behavior patterns, dramatically reducing false positives compared to banner-grabbing approaches.

Q: Is commercial support available?

Nerva is open-source under Apache 2.0. For enterprise support, consult Praetorian's professional services—after all, they built this for their own client engagements.

Q: Can I contribute new protocol plugins?

Absolutely! The plugin architecture is designed for extensibility. See CONTRIBUTING.md for guidelines. The Go-based implementation makes plugin development accessible.

Q: How does --fast mode affect accuracy?

Fast mode checks only default ports for each protocol (e.g., 22 for SSH, 80 for HTTP). If services run on non-standard ports, use full mode. For standard deployments, fast mode catches 80%+ of services at 5x speed.

Conclusion

Nerva isn't just another scanner—it's a paradigm shift in service identification. In an era where AI infrastructure, 5G networks, and industrial IoT create attack surfaces traditional tools can't comprehend, Praetorian delivered an instrument built for modern complexity.

The combination of 170+ protocols, 76 HTTP fingerprinting modules, active misconfiguration detection, and pipeline-native architecture makes Nerva indispensable for serious security practitioners. Whether you're hunting bug bounties, hardening CI/CD pipelines, or assessing critical infrastructure, this tool transforms raw port data into actionable intelligence.

My take? After years of wrestling with Nmap's verbosity and zgrab2's protocol rigidity, Nerva feels like upgrading from a magnifying glass to a scanning electron microscope. The Go library integration alone justifies adoption for teams building custom reconnaissance platforms.

Stop guessing what's behind port 8080. Start knowing.

⭐ Star Nerva on GitHub — and join the professionals who've already made the switch.

go install github.com/praetorian-inc/nerva/cmd/nerva@latest

Your next target is waiting. Fingerprint it properly.