IntermediateTools

Nuclei Guide: Automated Vulnerability Scanning

Learn Nuclei for fast template-based vulnerability scanning with customizable templates, workflow automation, and integration into CI/CD pipelines.

#nuclei#vulnerability scanning#template-based#automation#security testing

Why You Need Nuclei

You need to scan targets against hundreds of known CVEs and misconfiguration checks — Nuclei runs YAML-based templates that define exactly what to detect. Its community-driven template library covers everything from critical CVEs to cloud misconfigurations, and new templates are published daily.

Prerequisites

Understanding of HTTP and network protocols

Knowledge of common vulnerability types

Authorization for scanning targets

How Nuclei Works

Requests: HTTP or network requests to the target.

Matchers: Conditions that determine if a vulnerability exists.

Extractors: Rules to extract information from responses.

Installation

sudo apt install nuclei
nuclei -update-templates

Basic Usage

nuclei -u http://target.com
nuclei -u http://target.com -severity critical,high,medium

Essential Options

| Option | Description |

|--------|-------------|

| -u URL | Target URL |

| -t TEMPLATE | Template file/directory |

| -severity LEVELS | Severity filter |

| -tags TAGS | Template tags |

| -o FILE | Output file |

| -json | JSON output |

| -rate-limit RATE | Rate limit |

Template Categories

nuclei -u http://target.com -tags cve
nuclei -u http://target.com -tags wordpress
nuclei -u http://target.com -tags misconfig
nuclei -u http://target.com -tags exposure

Advanced Usage

nuclei -l targets.txt -t cves/ -o results.txt
nuclei -u http://target.com -rate-limit 50 -headless

Custom Template Example

id: custom-check
info:
  name: Custom Security Check
  severity: medium
  description: Detects a specific misconfiguration
requests:
  - method: GET
    path:
      - "{{BaseURL}}/sensitive-file.txt"
    matchers:
      - type: word
        words:
          - "sensitive"

Common Mistakes

Running without updated templates. No rate limiting. Not verifying results.

Best Practices

Update templates regularly. Use severity filters. Integrate into CI/CD.

Related Tools

**Nikto**: Traditional web server scanner

**WPScan**: WordPress-specific scanner

**Nmap with NSE**: Network vulnerability scripts

[Nikto Guide](/articles/nikto-guide)

[WPScan Guide](/articles/wpscan-guide)

[Ffuf Guide](/articles/ffuf-guide)

Summary

Nuclei is a modern template-based vulnerability scanner. Its community-driven template library covers thousands of security checks.

Knowledge Check

What format are Nuclei templates?

How to update templates?

Purpose of `-severity` filter?

How to scan with CVE templates only?

Command to generate report directory?

Frequently Asked Questions

What is Nuclei?

Nuclei is a fast, template-based vulnerability scanner from ProjectDiscovery that uses YAML templates to define security checks. It scans targets for thousands of known vulnerabilities, misconfigurations, and exposures with high accuracy.

What format are Nuclei templates in?

Nuclei templates are written in YAML and define HTTP requests, matchers (conditions), and extractors. The community maintains thousands of templates on GitHub covering CVEs, misconfigurations, and exposures.

How do you update Nuclei templates?

Run `nuclei -update-templates` to pull the latest templates from the ProjectDiscovery GitHub repository. Always update before scanning to detect the newest vulnerabilities.

What does the -severity filter do?

The `-severity` flag filters results by severity level (info, low, medium, high, critical). For example, `-severity high,critical` shows only high-severity findings, reducing noise in large scans.

How do you scan with only CVE templates?

Use `nuclei -u target.com -tags cve` to run only CVE-related templates. Combine with `-severity critical,high` to focus on the most impactful vulnerabilities.

What is the rate-limit option?

The `-rate-limit` flag controls requests per second to avoid overwhelming the target. Use lower rates on production systems (e.g., `-rate-limit 50`) to prevent service disruption.

How do you scan multiple targets with Nuclei?

Use `nuclei -l targets.txt` where each line is a target URL. Nuclei processes them in parallel with configurable concurrency for efficient bulk scanning.

What is the difference between Nuclei and Nikto?

Nuclei uses community-driven YAML templates for specific vulnerability detection with low false positives. Nikto is a traditional web scanner checking for thousands of generic issues. Nuclei is faster and more precise.

How do you generate HTML reports from Nuclei?

Use `nuclei -u target.com -o results.html -of html` to generate formatted HTML reports. JSON output (`-of json`) is better for automated processing and integration with SIEM systems.