Nuclei Scan

nuclei-scan

When to Use

• When vulnerability scanning is needed against web applications or infrastructure
• When scanning for specific CVEs, misconfigurations, or exposures
• When security assessment requires template-based detection
• When validating potential vulnerabilities with real-world conditions
• When scanning for technology-specific vulnerabilities
• When automated security testing is required in CI/CD pipelines
• When generating vulnerability reports in various formats

Quick Start

Scan a single target with all default templates:

nuclei -u https://example.com

Step-by-Step Process

1. Install Nuclei (if needed):

   go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
   

2. Update Templates to get latest vulnerability checks:

   nuclei -update-templates
   

3. Basic Scan against target:

   nuclei -u https://target.com -o results.txt
   

4. Targeted Scan by severity and tags:

   nuclei -u https://target.com -s critical,high -tags cve -o findings.txt
   

5. Export Results in structured format:

   nuclei -u https://target.com -je results.json
   

Examples

Example 1: Single Target Quick Scan

Scenario: Basic vulnerability scan against one target

Command:

nuclei -u https://example.com

Output:

[CVE-2021-44228] [http] [critical] https://example.com/api
[git-config] [http] [medium] https://example.com/.git/config
[robots-txt] [http] [info] https://example.com/robots.txt

Example 2: Bulk Scanning from File

Scenario: Scan multiple targets from a list

Command:

nuclei -l targets.txt -o results.txt

Output:

[2024-01-15 10:30:45] [CVE-2023-1234] [http] [high] https://app1.example.com/login
[2024-01-15 10:30:47] [exposed-panels] [http] [medium] https://app2.example.com/admin
[2024-01-15 10:30:49] [ssl-cert-expired] [ssl] [low] https://app3.example.com:443

Example 3: Severity-Based Scanning

Scenario: Scan for critical and high severity vulnerabilities only

Command:

nuclei -u https://example.com -s critical,high -o critical-findings.txt

Output:

[CVE-2021-44228] [http] [critical] https://example.com/api [Log4Shell RCE]
[CVE-2023-22515] [http] [critical] https://example.com/confluence [Confluence Auth Bypass]
[CVE-2022-41040] [http] [high] https://example.com/owa [ProxyNotShell]

Example 4: Tag-Based Scanning

Scenario: Scan for specific vulnerability types

Command:

nuclei -u https://example.com -tags cve,sqli,xss,rce

Output:

[sqli-error-based] [http] [high] https://example.com/search?q=test
[reflected-xss] [http] [medium] https://example.com/page?param=value
[CVE-2024-12345] [http] [critical] https://example.com/api/v1/users

Example 5: Technology-Specific Scanning

Scenario: Scan for WordPress vulnerabilities

Command:

nuclei -u https://example.com -tags wordpress -o wp-findings.txt

Output:

[wordpress-version] [http] [info] https://example.com [WordPress 6.2.1]
[wp-plugin-vuln] [http] [high] https://example.com/wp-content/plugins/vuln-plugin
[wp-xmlrpc-enabled] [http] [medium] https://example.com/xmlrpc.php

Example 6: Template Directory Scanning

Scenario: Scan using specific template directories

Command:

nuclei -u https://example.com -t cves/ -t exposures/ -t misconfigurations/

Output:

[CVE-2023-44487] [http] [high] https://example.com [HTTP/2 Rapid Reset]
[aws-credentials-exposed] [http] [critical] https://example.com/.env
[phpinfo-disclosure] [http] [low] https://example.com/phpinfo.php

Example 7: JSON Export for Automation

Scenario: Export structured results for downstream processing

Command:

nuclei -u https://example.com -je results.json -silent

Output (results.json):

{
  "template-id": "CVE-2021-44228",
  "info": {
    "name": "Apache Log4j RCE",
    "severity": "critical",
    "tags": ["cve", "cve2021", "rce", "log4j"]
  },
  "host": "https://example.com",
  "matched-at": "https://example.com/api/login",
  "timestamp": "2024-01-15T10:30:45.123Z"
}

Example 8: JSONL Output for Streaming

Scenario: Generate line-by-line JSON for real-time processing

Command:

nuclei -l targets.txt -j -o results.jsonl

Output:

{"template-id":"git-config","severity":"medium","host":"https://app1.com","matched-at":"https://app1.com/.git/config"}
{"template-id":"CVE-2023-1234","severity":"high","host":"https://app2.com","matched-at":"https://app2.com/api"}

Example 9: Markdown Report Generation

Scenario: Generate human-readable markdown report

Command:

nuclei -u https://example.com -me nuclei-report/

Output (nuclei-report/index.md):

# Nuclei Scan Report

## Critical Findings

- [CVE-2021-44228] Apache Log4j RCE - https://example.com/api

## High Findings

- [SQL Injection] https://example.com/search?id=1

Example 10: Rate-Limited Scanning

Scenario: Controlled scan rate for production targets

Command:

nuclei -u https://example.com -rl 50 -bs 10 -c 5 -o results.txt

Output:

[info] Rate limit set to 50 requests/second
[info] Bulk size: 10 hosts per template
[info] Concurrency: 5 templates parallel
[CVE-2023-1234] [http] [high] https://example.com/api

Example 11: Exclude Specific Templates or Tags

Scenario: Skip certain checks during scan

Command:

nuclei -u https://example.com -tags cve -etags dos,fuzz -et cves/2020/ -o results.txt

Output:

[info] Excluding tags: dos, fuzz
[info] Excluding template directory: cves/2020/
[CVE-2023-44487] [http] [high] https://example.com
[CVE-2024-12345] [http] [critical] https://example.com/api

Example 12: Custom Headers for Bug Bounty

Scenario: Include identification headers for program compliance

Command:

nuclei -l targets.txt -H "X-Bug-Bounty: HackerOne-username" -H "User-Agent: Nuclei-Scanner" -o findings.txt

Output:

[info] Custom headers applied to all requests
[CVE-2023-1234] [http] [high] https://target.com/api
[exposed-panel] [http] [medium] https://target.com/admin

Example 13: Automatic Technology Detection

Scenario: Auto-detect technologies and run relevant templates

Command:

nuclei -u https://example.com -as -o tech-findings.txt

Output:

[tech-detect] Detected: nginx, php, wordpress
[info] Running templates matching detected technologies
[wordpress-vuln] [http] [high] https://example.com/wp-admin
[php-info-leak] [http] [low] https://example.com/info.php

Example 14: SARIF Export for CI/CD

Scenario: Generate SARIF format for GitHub Actions integration

Command:

nuclei -u https://example.com -se results.sarif -s critical,high

Output:

[info] SARIF export enabled
[info] Scanning for critical,high severity
[CVE-2023-1234] [http] [critical] https://example.com/api
Results exported to: results.sarif

Error Handling

Flag Reference

Target Flags

Template Flags

Filtering Flags

Output Flags

Rate Control Flags

Special Flags

Common Tags

Severity Levels

Advanced Template Conditions

Complex filtering using -tc flag:

# Severity equals critical
nuclei -tc "severity=='critical'" -l targets.txt

# Tags containing cve
nuclei -tc "contains(tags,'cve')" -l targets.txt

# Protocol type http
nuclei -tc "protocol=='http'" -l targets.txt

# Multiple conditions (AND)
nuclei -tc "contains(tags,'cve') && severity=='critical'" -l targets.txt

# Multiple conditions (OR)
nuclei -tc "contains(id,'xss') || contains(tags,'xss')" -l targets.txt

Workflow Execution

# Run workflows
nuclei -u https://example.com -w workflows/
nuclei -l targets.txt -w workflows/wordpress-workflow.yaml -s critical,high

Configuration File

Create ~/.config/nuclei/config.yaml:

header:
  - "X-Bug-Bounty: username"
tags: cve,exposure,misconfig
severity: critical,high,medium
rate-limit: 100
exclude-tags: dos,fuzz

Proxy and Debug

nuclei -u https://example.com -p http://127.0.0.1:8080     # HTTP proxy
nuclei -u https://example.com -p socks5://127.0.0.1:1080  # SOCKS5 proxy
nuclei -u https://example.com -debug                       # Debug mode
nuclei -u https://example.com -tlog trace.log             # Trace log

OOB and Headless

nuclei -u https://example.com -ni                          # Disable OOB
nuclei -u https://example.com -headless                    # Headless browser
nuclei -u https://example.com -headless -page-timeout 30   # With timeout

Best Practices

1. Layer severity - Start critical/high, then expand
2. Rate limit - Use -rl flag for production targets
3. Bug bounty headers - Use -H for identification
4. Export structured - Use -je/-jle for automation
5. Update regularly - Run nuclei -update-templates
6. Exclude dangerous - Use -etags dos,fuzz
7. Monitor progress - Use -stats flag
8. Resume scans - Use -resume for checkpoints

References

• Nuclei Documentation
• Nuclei GitHub Repository
• Nuclei Templates Repository
• Template Writing Guide