timsonner Nuclei
Purpose
Use this skill for focused templated checks after discovery and target prioritization are already complete.
Phase Fit
- Primary: Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure
Use When
- Need to confirm common exposures or misconfigurations on a narrowed target set.
- Need repeatable checks during retest.
- Need to compare similar assets consistently.
Avoid When
- Templates have not been reviewed for safety or relevance.
- Broad scanning would create unnecessary noise or risk.
- A critical issue would be reported without manual confirmation.
Inputs
- Confirmed targets and relevant technology context
- Approved template classes and exclusions
- Evidence threshold for manual confirmation
Procedure
- Select only template classes relevant to the current hypothesis and scope.
- Run on the smallest possible target set.
- Triage results for false positives and duplicate observations.
- Manually confirm material findings before elevating severity.
- Preserve the template context so retests can reproduce the same check safely.
Command Syntax
Replace sample targets with approved in-scope assets.
# Scan a single target with default templates
nuclei -u https://portal.contoso.com -o contoso-nuclei.txt
# Scan a list of live hosts
nuclei -l contoso-live.txt -o contoso-nuclei.txt
# Limit to medium severity and above
nuclei -l contoso-live.txt -severity medium,high,critical -o contoso-findings.txt
# Run exposure-only templates
nuclei -l contoso-live.txt -t exposures/ -o contoso-exposures.txt
# CVE-tagged templates only
nuclei -l contoso-live.txt -tags cve -o contoso-cves.txt
# Rate-limited scan to reduce alert noise
nuclei -l contoso-live.txt -rate-limit 10 -o contoso-rl.txt
# Authenticated scan with custom header
nuclei -u https://portal.contoso.com -H "Authorization: Bearer <token>" -o contoso-auth.txt
Evidence to Capture
- Target, template, and timestamp mapping
- Manually confirmed exposures
- False positive patterns worth excluding later
Safety Boundaries
- Review template behavior before use.
- Prefer safe, read-oriented validation where possible.
- Stop if a template behaves more aggressively than intended.