javimosch nuclei Quickstart Guide
nuclei is a fast, modular vulnerability scanner built with Go. It uses YAML-based templates to scan for vulnerabilities across HTTP, DNS, TCP, SSL/TLS, File, Whois, WebSocket, and headless browser protocols. Powered by 12,000+ community templates.
Installation
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
Or download pre-built binaries from GitHub releases.
Basic Usage
Scan a single URL
nuclei -u http://example.com
Scan multiple URLs
nuclei -l urls.txt
Scan with specific template
nuclei -u http://example.com -t cves/2024
Output results as JSON
nuclei -u http://example.com -json
Common Options
-u <URL>- Target URL-l <FILE>- Load URLs from file-t <TEMPLATE>- Template or template directory-template-ratio <RATIO>- Filter templates by severity-severity <LEVEL>- Filter by severity: critical, high, medium, low, info-json- Output as JSON-json-export <FILE>- Export JSON to file-markdown-export <FILE>- Export Markdown report-timeout <SECONDS>- Scan timeout-rate-limit <RATE>- Requests per second-concurrency <NUM>- Parallel targets-headless- Enable headless browser templates-exclude-template <TEMPLATE>- Exclude specific templates-silent- Suppress output (show only results)
Template Types
nuclei supports vulnerability detection across:
- HTTP: Web applications, APIs, misconfigurations
- DNS: DNS vulnerabilities, zone transfers
- TCP: Network services, protocols
- SSL/TLS: Certificate issues, weak ciphers
- File: Local file vulnerabilities, hardcoded secrets
- Websocket: WebSocket protocol vulnerabilities
- Headless: JavaScript-heavy applications, browser exploits
Real-world Use Cases
Scan website for CVEs
nuclei -u https://example.com -severity critical,high
Batch scan from list
nuclei -l targets.txt -json-export results.json
Scan internal network
nuclei -l internal-ips.txt -rate-limit 10 -concurrency 5
Generate Markdown report
nuclei -u http://example.com -markdown-export report.md
Test API endpoints
nuclei -u http://api.example.com -t http/api
Understanding Results
nuclei outputs findings with:
- Severity: critical, high, medium, low, info
- Name: Vulnerability name
- Template: Template that detected it
- Timestamp: When detected
- Matcher: How it was detected
Example output:
[critical] SQL Injection (Generic)
[http] http://example.com/search?q=test
[cves/2024/sql-injection] Detected via matcher
Performance Tips
- Use
-rate-limitto avoid overwhelming targets - Use
-concurrencyto scan multiple targets in parallel - Filter templates by severity to reduce scan time
- Use
-timeoutfor slow targets - Exclude non-critical templates with
-exclude-template
Advanced Usage
Custom template scanning
# Create custom template
cat > custom.yaml <<EOF
id: custom-check
info:
name: Custom Vulnerability Check
severity: high
requests:
- method: GET
path: /admin
matchers:
- type: word
words: ["Dashboard"]
EOF
nuclei -u http://example.com -t custom.yaml
Chaining with other tools
# Find domains and scan with nuclei
subfinder -d example.com | nuclei -json
CI/CD Integration
# Fail on critical findings
nuclei -u http://example.com -severity critical && exit 1 || true
Template Management
Update templates
nuclei -update-templates
List all templates
nuclei -list-templates
List templates by severity
nuclei -tl -type critical
Ethical Usage
- Always get written permission before scanning systems you don't own
- Use for authorized penetration testing only
- Respect rate limits and target resource constraints
- Follow responsible disclosure practices
- Document all findings appropriately
Compliance & Reporting
nuclei is widely used for:
- OWASP Top 10 vulnerability scanning
- CVE assessment and verification
- Security compliance testing
- Penetration testing engagements
- Continuous vulnerability monitoring
Resources
Troubleshooting
Templates not found
Update templates:
nuclei -update-templates
Timeout issues
Increase timeout:
nuclei -u http://example.com -timeout 30
Too many requests
Reduce rate limit:
nuclei -u http://example.com -rate-limit 5