nuclei vulnerability scanning

When it applies

Recon has produced live in-scope hosts (automation-recon-pipeline) and you want fast coverage of known issues — CVEs, exposed panels, misconfigurations — before spending manual time. Also the right tool for re-checking a fixed finding across all hosts. For writing a template that codifies your own finding, load automation-nuclei-templates (that skill is the deep guide; the essentials are below).

Why it works

nuclei runs declarative YAML templates (9000+ community templates, HTTP/DNS/TCP/SSL/file protocols) against many targets in parallel with matchers on the response. You trade stealth for breadth: it's fast and consistent, and loud.

Method

1. Install/update: apt install nuclei (Kali) or go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest; always nuclei -update-templates first.
2. Scope the run — never full-template blindly:

   nuclei -u https://target.com -severity critical,high        # single host, high signal
   nuclei -u https://target.com -tags cve,exposure             # by tag
   nuclei -l urls.txt -severity critical,high -o results.txt   # bulk targets
   nuclei -u https://target.com -t http/cves/2024/             # one template dir after fingerprinting
   

3. Pipe from recon (the standard pipeline): subfinder -d target.com -silent | httpx -silent | nuclei -severity critical,high -o report.txt
4. Be a good citizen (and stay under WAF/IDS thresholds): -rate-limit 10 -bulk-size 5 to slow down; -proxy http://127.0.0.1:8080 to route through Burp for visibility; -exclude-tags dos,fuzz to skip destructive/noisy checks; -new-templates for only-recently-added templates on a re-visit.
5. Capture machine-readable output for triage: -json -o results.json.
6. Custom template essentials (full guide: automation-nuclei-templates): id in vendor-product-vulnerability form; info with honest severity/tags; http: block with {{BaseURL}} paths; combine matchers with condition: and and match a signal unique to the vuln (a computed reflection like 49 from {{7*7}}, a specific error string) — never a bare 200; add an extractor that pulls the proof. Validate with -validate, then against a known-vulnerable and a known-good host.

Gotchas

• A nuclei hit is a candidate, not a finding — templates false-positive on version banners and lookalike strings. Manually reproduce every hit (reporting-triage-validation) before it goes in notes/findings; this is the #1 way automated scanning burns reporter credibility.
• Full-template runs are loud and slow — fingerprint first (recon-techstack-fingerprinting), then run only relevant tags/dirs.
• Rate limiting cuts both ways — too fast gets you WAF-banned (and can breach bug-bounty RoE on request rates); too slow on a big scope never finishes. Tune -rate-limit/-bulk-size to the RoE.
• Windows naming collision — the httpx command on Windows may resolve to the Python httpx library's CLI, not ProjectDiscovery's httpx; verify with httpx -version before piping.
• Keep templates read-only — anything that writes state or can DoS doesn't belong in a mass scan.

Verify success

Each nuclei hit either reproduces manually with a concrete impact (and gets a findings entry) or is recorded as a false positive with the reason. The scan config (severity/tags/rate) is logged so the run is reproducible.

References

ProjectDiscovery docs; nuclei-templates repo. Writing templates: automation-nuclei-templates. Pipeline context: automation-recon-pipeline.

---

Portions adapted from reverse-skill by zhaoxuya520, MIT License.