aeondave/nuclei

Nuclei

Template-based scanner — 10,000+ community templates covering CVEs, misconfigs, exposures, default creds.

Quick Start

# Update templates first (always)
nuclei -update-templates

# Scan a target
nuclei -u https://target.com

# Scan a list
nuclei -l urls.txt -exclude-severity info -stats

Core Flags

| Flag | Description | |------|-------------| | -u <url> | Single target URL | | -l <file> | File with list of URLs | | -im <mode> | Input mode: list, burp, jsonl, yaml, openapi, swagger | | -t <path> | Template file/directory/URL | | -tags <tags> | Run templates by tag (e.g., cve,rce,lfi) | | -as | Automatic technology-mapped scan | | -ni | Disable interactsh/OAST requests | | -id <id> | Run specific template by ID | | -severity <s> | Filter by severity: info,low,medium,high,critical | | -exclude-severity <s> | Exclude severity levels (alias: -es) | | -exclude-tags <tags> | Exclude tags (alias: -etags) | | -et <path> | Exclude template path | | -V <var=val> | Template variable override | | -nt | Run only new templates (since last update) | | -H <header> | Custom HTTP header | | -c <n> | Concurrent templates (default 25) | | -bs <n> | Bulk size (targets per template batch) | | -rl <n> | Rate limit req/sec (default 150) | | -timeout <n> | HTTP timeout (default 5s) | | -retries <n> | Retries on timeout | | -proxy <url> | HTTP/SOCKS5 proxy | | -o <file> | Output file | | -json | JSON output | | -jsonl, -j | JSON Lines output | | -silent | Print findings only | | -v | Verbose | | -stats | Show real-time stats | | -update-templates | Update community templates | | -tl | List all available templates |

Template Categories (Tags)

| Tag | Description | |-----|-------------| | cve | CVE-based exploits and detections | | panel | Admin/login panel detection | | exposure | Exposed files, tokens, secrets | | misconfig | Misconfigurations | | default-login | Default credentials | | takeover | Subdomain takeover | | tech | Technology fingerprinting | | xss | Cross-site scripting | | sqli | SQL injection | | ssrf | Server-side request forgery | | lfi | Local file inclusion | | rce | Remote code execution | | network | Network-level checks | | dns | DNS-level checks | | wordpress | WordPress-specific | | jira | Jira-specific | | gitlab | GitLab-specific |

Common Workflows

# Attack surface map (fast, no heavy scanning)
nuclei -l hosts.txt -tags tech,panel -severity info,low -silent

# CVE scan (high impact only)
nuclei -l hosts.txt -tags cve -severity critical,high -o cve_findings.jsonl -jsonl

# Agent-safe controlled baseline
nuclei -l targets.txt -as -severity critical,high -rl 50 -c 20 -bs 20 -timeout 10 -retries 1 -silent -j -o nuclei.jsonl

# Deterministic scan without OAST/interactsh traffic
nuclei -l targets.txt -as -severity critical,high -ni -stats -rl 30 -c 10 -bs 10 -timeout 10 -retries 1 -j -o nuclei_no_oast.jsonl

# Exposed panels + default creds
nuclei -l hosts.txt -tags panel,default-login -severity medium,high,critical

# Find exposed secrets/tokens
nuclei -l urls.txt -tags exposure -silent

# Subdomain takeover check
nuclei -l subs.txt -tags takeover

# Injection testing (active)
nuclei -l urls.txt -tags xss,sqli,ssrf,lfi -severity medium,high,critical

# WordPress scan
nuclei -u https://target.com -tags wordpress -severity medium,high,critical

# Full scan (skip info noise)
nuclei -l hosts.txt -exclude-severity info -o findings.jsonl -jsonl -stats

# New templates only (post-update quick check)
nuclei -l hosts.txt -nt -severity high,critical

# Pipeline: subfinder → httpx → nuclei
subfinder -d target.com -silent | \
  httpx -silent | \
  nuclei -tags cve,panel,exposure,misconfig -severity high,critical

# Through Burp proxy
nuclei -u https://target.com -proxy http://127.0.0.1:8080

Template Management

# Update templates
nuclei -update-templates

# List all templates
nuclei -tl

# List by tag
nuclei -tl -tags cve | head -20

# Run specific template
nuclei -u https://target.com -t cves/2021/CVE-2021-44228.yaml

# Run custom template directory
nuclei -l hosts.txt -t ~/custom-templates/

# Override template variable
nuclei -u https://target.com -t custom.yaml -V "target_path=/admin"

Resources

| File | When to load | |------|--------------| | references/templates.md | Template structure, custom writing, matcher/extractor types, output parsing, rate tuning |