Nuclei
Template-based scanner — 10,000+ community templates covering CVEs, misconfigs, exposures, default creds.
Quick Start
# Update templates first (always)
nuclei -update-templates
# Scan a target
nuclei -u https://target.com
# Scan a list
nuclei -l urls.txt -exclude-severity info -stats
Core Flags
| Flag |
Description |
-u <url> |
Single target URL |
-l <file> |
File with list of URLs |
-im <mode> |
Input mode: list, burp, jsonl, yaml, openapi, swagger |
-t <path> |
Template file/directory/URL |
-tags <tags> |
Run templates by tag (e.g., cve,rce,lfi) |
-as |
Automatic technology-mapped scan |
-ni |
Disable interactsh/OAST requests |
-id <id> |
Run specific template by ID |
-severity <s> |
Filter by severity: info,low,medium,high,critical |
-exclude-severity <s> |
Exclude severity levels (alias: -es) |
-exclude-tags <tags> |
Exclude tags (alias: -etags) |
-et <path> |
Exclude template path |
-V <var=val> |
Template variable override |
-nt |
Run only new templates (since last update) |
-H <header> |
Custom HTTP header |
-c <n> |
Concurrent templates (default 25) |
-bs <n> |
Bulk size (targets per template batch) |
-rl <n> |
Rate limit req/sec (default 150) |
-timeout <n> |
HTTP timeout (default 5s) |
-retries <n> |
Retries on timeout |
-proxy <url> |
HTTP/SOCKS5 proxy |
-o <file> |
Output file |
-json |
JSON output |
-jsonl, -j |
JSON Lines output |
-silent |
Print findings only |
-v |
Verbose |
-stats |
Show real-time stats |
-update-templates |
Update community templates |
-tl |
List all available templates |
Template Categories (Tags)
| Tag |
Description |
cve |
CVE-based exploits and detections |
panel |
Admin/login panel detection |
exposure |
Exposed files, tokens, secrets |
misconfig |
Misconfigurations |
default-login |
Default credentials |
takeover |
Subdomain takeover |
tech |
Technology fingerprinting |
xss |
Cross-site scripting |
sqli |
SQL injection |
ssrf |
Server-side request forgery |
lfi |
Local file inclusion |
rce |
Remote code execution |
network |
Network-level checks |
dns |
DNS-level checks |
wordpress |
WordPress-specific |
jira |
Jira-specific |
gitlab |
GitLab-specific |
Common Workflows
# Attack surface map (fast, no heavy scanning)
nuclei -l hosts.txt -tags tech,panel -severity info,low -silent
# CVE scan (high impact only)
nuclei -l hosts.txt -tags cve -severity critical,high -o cve_findings.jsonl -jsonl
# Agent-safe controlled baseline
nuclei -l targets.txt -as -severity critical,high -rl 50 -c 20 -bs 20 -timeout 10 -retries 1 -silent -j -o nuclei.jsonl
# Deterministic scan without OAST/interactsh traffic
nuclei -l targets.txt -as -severity critical,high -ni -stats -rl 30 -c 10 -bs 10 -timeout 10 -retries 1 -j -o nuclei_no_oast.jsonl
# Exposed panels + default creds
nuclei -l hosts.txt -tags panel,default-login -severity medium,high,critical
# Find exposed secrets/tokens
nuclei -l urls.txt -tags exposure -silent
# Subdomain takeover check
nuclei -l subs.txt -tags takeover
# Injection testing (active)
nuclei -l urls.txt -tags xss,sqli,ssrf,lfi -severity medium,high,critical
# WordPress scan
nuclei -u https://target.com -tags wordpress -severity medium,high,critical
# Full scan (skip info noise)
nuclei -l hosts.txt -exclude-severity info -o findings.jsonl -jsonl -stats
# New templates only (post-update quick check)
nuclei -l hosts.txt -nt -severity high,critical
# Pipeline: subfinder → httpx → nuclei
subfinder -d target.com -silent | \
httpx -silent | \
nuclei -tags cve,panel,exposure,misconfig -severity high,critical
# Through Burp proxy
nuclei -u https://target.com -proxy http://127.0.0.1:8080
Template Management
# Update templates
nuclei -update-templates
# List all templates
nuclei -tl
# List by tag
nuclei -tl -tags cve | head -20
# Run specific template
nuclei -u https://target.com -t cves/2021/CVE-2021-44228.yaml
# Run custom template directory
nuclei -l hosts.txt -t ~/custom-templates/
# Override template variable
nuclei -u https://target.com -t custom.yaml -V "target_path=/admin"
Resources
| File |
When to load |
references/templates.md |
Template structure, custom writing, matcher/extractor types, output parsing, rate tuning |
1---2name: nuclei3description: Auth/lab ref: Template-based vulnerability and exposure scanner from ProjectDiscovery.4license: MIT5---67# Nuclei89Template-based scanner — 10,000+ community templates covering CVEs, misconfigs, exposures, default creds.1011## Quick Start1213```bash14# Update templates first (always)15nuclei -update-templates1617# Scan a target18nuclei -u https://target.com1920# Scan a list21nuclei -l urls.txt -exclude-severity info -stats22```2324## Core Flags2526| Flag | Description |27|------|-------------|28| `-u <url>` | Single target URL |29| `-l <file>` | File with list of URLs |30| `-im <mode>` | Input mode: list, burp, jsonl, yaml, openapi, swagger |31| `-t <path>` | Template file/directory/URL |32| `-tags <tags>` | Run templates by tag (e.g., `cve,rce,lfi`) |33| `-as` | Automatic technology-mapped scan |34| `-ni` | Disable interactsh/OAST requests |35| `-id <id>` | Run specific template by ID |36| `-severity <s>` | Filter by severity: `info,low,medium,high,critical` |37| `-exclude-severity <s>` | Exclude severity levels (alias: `-es`) |38| `-exclude-tags <tags>` | Exclude tags (alias: `-etags`) |39| `-et <path>` | Exclude template path |40| `-V <var=val>` | Template variable override |41| `-nt` | Run only new templates (since last update) |42| `-H <header>` | Custom HTTP header |43| `-c <n>` | Concurrent templates (default 25) |44| `-bs <n>` | Bulk size (targets per template batch) |45| `-rl <n>` | Rate limit req/sec (default 150) |46| `-timeout <n>` | HTTP timeout (default 5s) |47| `-retries <n>` | Retries on timeout |48| `-proxy <url>` | HTTP/SOCKS5 proxy |49| `-o <file>` | Output file |50| `-json` | JSON output |51| `-jsonl`, `-j` | JSON Lines output |52| `-silent` | Print findings only |53| `-v` | Verbose |54| `-stats` | Show real-time stats |55| `-update-templates` | Update community templates |56| `-tl` | List all available templates |5758## Template Categories (Tags)5960| Tag | Description |61|-----|-------------|62| `cve` | CVE-based exploits and detections |63| `panel` | Admin/login panel detection |64| `exposure` | Exposed files, tokens, secrets |65| `misconfig` | Misconfigurations |66| `default-login` | Default credentials |67| `takeover` | Subdomain takeover |68| `tech` | Technology fingerprinting |69| `xss` | Cross-site scripting |70| `sqli` | SQL injection |71| `ssrf` | Server-side request forgery |72| `lfi` | Local file inclusion |73| `rce` | Remote code execution |74| `network` | Network-level checks |75| `dns` | DNS-level checks |76| `wordpress` | WordPress-specific |77| `jira` | Jira-specific |78| `gitlab` | GitLab-specific |7980## Common Workflows8182```bash83# Attack surface map (fast, no heavy scanning)84nuclei -l hosts.txt -tags tech,panel -severity info,low -silent8586# CVE scan (high impact only)87nuclei -l hosts.txt -tags cve -severity critical,high -o cve_findings.jsonl -jsonl8889# Agent-safe controlled baseline90nuclei -l targets.txt -as -severity critical,high -rl 50 -c 20 -bs 20 -timeout 10 -retries 1 -silent -j -o nuclei.jsonl9192# Deterministic scan without OAST/interactsh traffic93nuclei -l targets.txt -as -severity critical,high -ni -stats -rl 30 -c 10 -bs 10 -timeout 10 -retries 1 -j -o nuclei_no_oast.jsonl9495# Exposed panels + default creds96nuclei -l hosts.txt -tags panel,default-login -severity medium,high,critical9798# Find exposed secrets/tokens99nuclei -l urls.txt -tags exposure -silent100101# Subdomain takeover check102nuclei -l subs.txt -tags takeover103104# Injection testing (active)105nuclei -l urls.txt -tags xss,sqli,ssrf,lfi -severity medium,high,critical106107# WordPress scan108nuclei -u https://target.com -tags wordpress -severity medium,high,critical109110# Full scan (skip info noise)111nuclei -l hosts.txt -exclude-severity info -o findings.jsonl -jsonl -stats112113# New templates only (post-update quick check)114nuclei -l hosts.txt -nt -severity high,critical115116# Pipeline: subfinder → httpx → nuclei117subfinder -d target.com -silent | \118 httpx -silent | \119 nuclei -tags cve,panel,exposure,misconfig -severity high,critical120121# Through Burp proxy122nuclei -u https://target.com -proxy http://127.0.0.1:8080123```124125## Template Management126127```bash128# Update templates129nuclei -update-templates130131# List all templates132nuclei -tl133134# List by tag135nuclei -tl -tags cve | head -20136137# Run specific template138nuclei -u https://target.com -t cves/2021/CVE-2021-44228.yaml139140# Run custom template directory141nuclei -l hosts.txt -t ~/custom-templates/142143# Override template variable144nuclei -u https://target.com -t custom.yaml -V "target_path=/admin"145```146147## Resources148149| File | When to load |150|------|--------------|151| `references/templates.md` | Template structure, custom writing, matcher/extractor types, output parsing, rate tuning |
AeonDave