Nuclei vulnerability scanner: techniques

Basic Usage #

Scanning a Single Target #

bash

# Scan a single URL
nuclei -u https://example.com

# Scan with increased verbosity
nuclei -u https://example.com -v

# Scan with debug information
nuclei -u https://example.com -debug

Scanning Multiple Targets #

bash

# Scan multiple URLs
nuclei -u https://example.com,https://test.com

# Scan from a list of URLs
nuclei -l urls.txt

# Scan from STDIN
cat urls.txt|nuclei

Template Selection #

bash

# Scan with specific template
nuclei -u https://example.com -t cves/2021/CVE-2021-44228.yaml

# Scan with multiple templates
nuclei -u https://example.com -t cves/2021/CVE-2021-44228.yaml,cves/2021/CVE-2021-40438.yaml

# Scan with template directory
nuclei -u https://example.com -t cves/

# Scan with tags
nuclei -u https://example.com -tags cve,oast

# Exclude templates by tags
nuclei -u https://example.com -exclude-tags dos,fuzz

Output Options #

bash

# Save results to a file
nuclei -u https://example.com -o results.txt

# Save results in JSON format
nuclei -u https://example.com -o results.json -j

# Save results in SARIF format
nuclei -u https://example.com -o results.sarif -sarif

# Save results in Markdown format
nuclei -u https://example.com -o results.md -markdown

Rate Limiting #

bash

# Limit requests per second
nuclei -u https://example.com -rate-limit 100

# Limit requests per minute
nuclei -u https://example.com -rate-limit-minute 300

# Bulk size for concurrent requests
nuclei -u https://example.com -bulk-size 25

# Concurrency for template execution
nuclei -u https://example.com -c 50

Advanced Usage #

Severity Filtering #

bash

# Scan only for critical severity issues
nuclei -u https://example.com -severity critical

# Scan for high and critical severity issues
nuclei -u https://example.com -severity high,critical

# Exclude low severity issues
nuclei -u https://example.com -exclude-severity low,info

Automatic Template Updates #

bash

# Update templates to the latest version
nuclei -update-templates

# Update to a specific templates directory
nuclei -update-directory /path/to/templates

# Update templates and exit
nuclei -update-templates -ut

Proxy and Network Options #

bash

# Use a proxy for HTTP requests
nuclei -u https://example.com -proxy http://127.0.0.1:8080

# Use SOCKS5 proxy
nuclei -u https://example.com -proxy socks5://127.0.0.1:1080

# Follow redirects
nuclei -u https://example.com -follow-redirects

# Follow host redirects
nuclei -u https://example.com -follow-host-redirects

Authentication #

bash

# Basic authentication
nuclei -u https://example.com -auth-type basic -auth-user username -auth-pass password

# Bearer token authentication
nuclei -u https://example.com -H "Authorization: Bearer YOUR_TOKEN"

# Cookie-based authentication
nuclei -u https://example.com -H "Cookie: session=123456"

Interactsh Integration #

bash

# Enable Interactsh for OOB testing
nuclei -u https://example.com -interactsh-server https://your-interactsh-server.com

# Disable Interactsh
nuclei -u https://example.com -no-interactsh

# Set Interactsh polling and timeout
nuclei -u https://example.com -interactsh-server https://your-interactsh-server.com -interactions-poll-duration 60 -interactions-cooldown-period 30

Workflow Execution #

bash

# Execute a workflow
nuclei -u https://example.com -w workflows/wordpress-workflow.yaml

# Execute multiple workflows
nuclei -u https://example.com -w workflows/wordpress-workflow.yaml,workflows/jira-workflow.yaml

Headless Browser Support #

bash

# Enable headless browser support
nuclei -u https://example.com -headless

# Set browser path
nuclei -u https://example.com -headless -browser-path /path/to/chrome

# Set page timeout
nuclei -u https://example.com -headless -page-timeout 20

Template Management #

Template Structure #

Nuclei templates are YAML files with the following basic structure:

yaml

id: template-id
info:
  name: Template Name
  author: Author Name
  severity: info|low|medium|high|critical
  description: Template description
  tags: tag1,tag2

requests:
  - method: GET
    path:
      - "\\\\{\\\\{BaseURL\\\\}\\\\}/path"
    matchers:
      - type: word
        words:
          - "sensitive data"

Creating Custom Templates #

bash

# Create a basic template structure
cat > custom-template.yaml << EOF
id: custom-template
info:
  name: Custom Template
  author: Your Name
  severity: medium
  description: Detects a custom vulnerability
  tags: custom

requests:
  - method: GET
    path:
      - "\\\\{\\\\{BaseURL\\\\}\\\\}/admin"
    matchers:
      - type: word
        words:
          - "Admin Panel"
EOF


# Test the custom template
nuclei -u https://example.com -t custom-template.yaml

Template Validation #

bash

# Validate a template
nuclei -validate -t custom-template.yaml

# Validate all templates in a directory
nuclei -validate -t templates/

Template Listing #

bash

# List all available templates
nuclei -tl

# List templates by tags
nuclei -tl -tags cve,2021

# List templates by severity
nuclei -tl -severity critical

Integration with Other Tools #

Pipeline with httpx #

bash

# Discover subdomains and scan them
subfinder -d example.com|httpx|nuclei -t cves/

# Scan specific ports
naabu -host example.com -top-ports 100 -silent|httpx -silent|nuclei -t cves/

Integration with Notify #

bash

# Send results to Slack
nuclei -u https://example.com -o results.txt|notify -provider slack

# Send critical findings to Discord
nuclei -u https://example.com -severity critical -json|notify -provider discord

Integration with GitHub Actions #

yaml

# Example GitHub Action workflow
name: Nuclei Scan

on:
  schedule:
    - cron: '0 0 * * *'  # Run daily at midnight

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Nuclei Scan
        uses: projectdiscovery/nuclei-action@main
        with:
          target: https://example.com
          templates: cves/
          output: nuclei-results.txt

Best Practices #

Performance Optimization #

bash

# Use fast templates for initial scanning
nuclei -u https://example.com -tags tech

# Exclude time-consuming templates
nuclei -u https://example.com -exclude-templates ssl,fuzzing

# Optimize concurrency based on target
nuclei -u https://example.com -c 50 -bulk-size 20

# Use rate limiting to avoid overwhelming the target
nuclei -u https://example.com -rate-limit 100

Targeted Scanning #

bash

# Scan for specific vulnerability types
nuclei -u https://example.com -tags wordpress,plugin

# Scan for recent CVEs
nuclei -u https://example.com -tags cve,2023

# Scan based on technology detection
httpx -u https://example.com -tech-detect|nuclei -t technologies/

Reducing Noise #

bash

# Exclude common false positives
nuclei -u https://example.com -exclude-templates false-positives/

# Focus on high-impact issues
nuclei -u https://example.com -severity high,critical

# Filter out noisy templates
nuclei -u https://example.com -exclude-tags fuzz,dos

Regular Updates #

bash

# Update templates regularly
nuclei -update-templates

# Update Nuclei to the latest version
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

Troubleshooting #

Common Issues #

Template Errors

bash

# Check template syntax
nuclei -validate -t custom-template.yaml
    
# Debug template execution
nuclei -u https://example.com -t custom-template.yaml -debug

Rate Limiting by Target

bash

# Reduce request rate
nuclei -u https://example.com -rate-limit 10
    
# Add random delays
nuclei -u https://example.com -rate-limit 10 -random-delay 5

Memory Issues

bash

# Limit template concurrency
nuclei -u https://example.com -c 10
    
# Limit bulk size
nuclei -u https://example.com -bulk-size 10

Network Issues

bash

# Increase timeout
nuclei -u https://example.com -timeout 10
    
# Increase retries
nuclei -u https://example.com -retries 3

Debugging #

bash

# Enable debug mode
nuclei -u https://example.com -debug

# Show verbose output
nuclei -u https://example.com -v

# Show request and response details
nuclei -u https://example.com -debug -show-request -show-response

# Store HTTP requests and responses
nuclei -u https://example.com -store-resp

Configuration #

Configuration File #

Nuclei uses a configuration file located at $HOME/.config/nuclei/config.yaml. You can customize various settings in this file:

yaml

# Example configuration file
concurrency: 25
rate-limit: 150
bulk-size: 20
templates-directory: /path/to/templates
output: /path/to/output.txt
json: true
severity:
  - critical
  - high
  - medium
exclude-severity:
  - info
  - low

Environment Variables #

bash

# Set Nuclei configuration via environment variables
export NUCLEI_CONCURRENCY=25
export NUCLEI_RATE_LIMIT=150
export NUCLEI_TEMPLATES_DIRECTORY=/path/to/templates
export NUCLEI_OUTPUT=/path/to/output.txt
export NUCLEI_JSON=true

Reference #

Command Line Options #

Flag	Description
`-u, -target`	Target URL to scan
`-l, -list`	Path to file containing list of URLs to scan
`-t, -templates`	Templates to use for scanning
`-tags`	Tags to include templates by
`-exclude-tags`	Tags to exclude templates by
`-o, -output`	File to write output to
`-j, -json`	Write output in JSON format
`-c, -concurrency`	Number of concurrent requests
`-rate-limit`	Maximum number of requests per second
`-timeout`	Timeout in seconds for HTTP requests
`-v, -verbose`	Show verbose output
`-debug`	Show debug information
`-update-templates`	Update templates to latest version
`-severity`	Filter templates by severity
`-exclude-severity`	Exclude templates by severity
`-interactsh-server`	Interactsh server URL for OOB testing
`-no-interactsh`	Disable Interactsh for OOB testing
`-follow-redirects`	Follow HTTP redirects
`-follow-host-redirects`	Follow redirects on the same host
`-max-redirects`	Maximum number of redirects to follow
`-headless`	Enable headless browser support
`-proxy`	HTTP/SOCKS5 proxy to use
`-H, -header`	Custom header to add to all requests
`-validate`	Validate templates
`-tl`	List available templates

Template Types #

Type	Description
HTTP	Web-based vulnerabilities
DNS	DNS-based vulnerabilities
File	Local file analysis
Network	Network protocol vulnerabilities
Headless	Browser-based vulnerabilities
SSL	SSL/TLS vulnerabilities
Websocket	Websocket vulnerabilities
Whois	Whois data analysis
Javascript	JavaScript analysis
Workflow	Multi-step vulnerability chains

Matcher Types #

Type	Description
`word`	Match based on response containing specific words
`regex`	Match based on regular expressions
`binary`	Match based on binary response
`status`	Match based on HTTP status code
`size`	Match based on response size
`dsl`	Match using DSL expressions
`xpath`	Match using XPath expressions
`jsonpath`	Match using JSONPath expressions
`gval`	Match using GVAL expressions
`kval`	Match using key-value expressions

Extractor Types #

Type	Description
`regex`	Extract data using regular expressions
`kval`	Extract key-value pairs
`xpath`	Extract data using XPath expressions
`jsonpath`	Extract data using JSONPath expressions
`dsl`	Extract data using DSL expressions
`gval`	Extract data using GVAL expressions