nuclei

Template-based vulnerability scanner. Fast, customizable, and community-driven. ProjectDiscovery.

Quickstart

# Scan single target with all templates
nuclei -u https://target.com

# Scan with specific templates
nuclei -u https://target.com -t cves/

# Scan list of URLs
nuclei -l urls.txt

# Update templates
nuclei -ut

Core Concepts

Concept	Description
Templates	YAML files defining vulnerability checks
Tags	Categories like `cve`, `rce`, `xss`, `sqli`
Severity	info, low, medium, high, critical
Workflows	Chain multiple templates together

Syntax

nuclei -u <url> [options]
nuclei -l <file> [options]
cat urls.txt | nuclei [options]

Options

Input

Option	Description
`-u <url>`	Single target URL
`-l <file>`	List of URLs
`-`	Read from stdin
`-resume <file>`	Resume scan from file

Templates

Option	Description
`-t <path>`	Template path/directory
`-tl`	List available templates
`-tags <tags>`	Filter by tags
`-etags <tags>`	Exclude tags
`-s <severity>`	Filter by severity
`-es <severity>`	Exclude severity
`-author <name>`	Filter by author
`-nt`	New templates only
`-ut`	Update templates

Output

Option	Description
`-o <file>`	Output file
`-json`	JSON output
`-jsonl`	JSON lines output
`-silent`	Silent mode
`-nc`	No color
`-v`	Verbose
`-debug`	Debug mode

Performance

Option	Description
`-c <n>`	Concurrent templates (default 25)
`-rl <n>`	Rate limit per second
`-bs <n>`	Bulk size (hosts per template)
`-timeout <sec>`	Timeout
`-retries <n>`	Retries

Interactsh (OOB)

Option	Description
`-iserver <url>`	Interactsh server
`-itoken <token>`	Interactsh token
`-ni`	Disable interactsh

Misc

Option	Description
`-H "Header: val"`	Custom header
`-proxy <url>`	HTTP proxy
`-fr`	Follow redirects
`-ss`	Screenshot on match

Recipes

Basic Scanning

# Scan single target
nuclei -u https://target.com

# Scan URL list
nuclei -l urls.txt

# From stdin
cat urls.txt | nuclei

# Silent output
nuclei -u https://target.com -silent

Template Selection

# Specific template
nuclei -u https://target.com -t cves/2023/CVE-2023-1234.yaml

# Template directory
nuclei -u https://target.com -t cves/

# By tags
nuclei -u https://target.com -tags cve,rce
nuclei -u https://target.com -tags xss,sqli

# By severity
nuclei -u https://target.com -s critical,high
nuclei -u https://target.com -s medium,low,info

# Exclude tags
nuclei -u https://target.com -etags dos,fuzz

# Exclude severity
nuclei -u https://target.com -es info

Common Scan Types

# CVE scanning
nuclei -l urls.txt -t cves/

# Technology detection
nuclei -l urls.txt -t technologies/

# Exposed panels
nuclei -l urls.txt -t exposed-panels/

# Misconfigurations
nuclei -l urls.txt -t misconfiguration/

# Default logins
nuclei -l urls.txt -t default-logins/

# Takeovers
nuclei -l urls.txt -t takeovers/

# Exposures (tokens, keys)
nuclei -l urls.txt -t exposures/

Full Recon Scan

# All templates, high/critical only
nuclei -l urls.txt -s high,critical -o critical_findings.txt

# Full scan with JSON
nuclei -l urls.txt -json -o results.json

# Exclude noisy stuff
nuclei -l urls.txt -etags dos,fuzz -es info -o findings.txt

Integration Pipeline

# Subfinder → httpx → nuclei
subfinder -d target.com -silent | httpx -silent | nuclei -t cves/

# katana → nuclei
katana -u https://target.com -silent | nuclei -silent

# Full pipeline
subfinder -d target.com -silent | \
  httpx -silent | \
  nuclei -s high,critical -o vulns.txt

Custom Templates

# Use custom template
nuclei -u https://target.com -t /path/to/custom.yaml

# Validate template
nuclei -t custom.yaml -validate

# Template with proxy for debugging
nuclei -u https://target.com -t custom.yaml -proxy http://127.0.0.1:8080

Rate Limiting & Stealth

# Rate limited scan
nuclei -l urls.txt -rl 10 -c 5

# With delays
nuclei -l urls.txt -rl 5 -c 2

# Through proxy
nuclei -l urls.txt -proxy http://127.0.0.1:8080

Template Management

# Update templates
nuclei -ut

# List all templates
nuclei -tl

# List templates by tag
nuclei -tl -tags cve

# Show new templates
nuclei -nt -tl

Output & Parsing

# JSON output
nuclei -l urls.txt -json -o results.json

# Parse JSON results
cat results.json | jq -r 'select(.info.severity == "high") | .host'

# JSONL for streaming
nuclei -l urls.txt -jsonl -o results.jsonl

# Markdown report
nuclei -l urls.txt -me report/

Custom Template Structure

id: custom-check

info:
  name: Custom Vulnerability Check
  author: yourname
  severity: medium
  tags: custom

requests:
  - method: GET
    path:
      - "{{BaseURL}}/admin"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "admin panel"

Troubleshooting

Issue	Solution
No results	Check templates exist, try `-v`
Too slow	Reduce `-c`, check network
Rate limited	Add `-rl`, reduce concurrency
OOB not working	Check interactsh server, use `-debug`
Template errors	Run with `-validate`

References

← Retour aux cheat sheets