Nuclei

Vulnerability Analysis

Intermediatemedium risk

Nuclei is used to send requests across targets based on templates, allowing zero false positives and providing rapid scanning over large infrastructure footprints.

Installation

sudo apt install nuclei

Basic Syntax

nuclei -u <target> [options]

Quick Facts

Full Name

Nuclei Scanner

License

MIT

Language

Go

Templates

5000+ community

Category

Vulnerability Scanner

Speed

Very Fast

Tool Overview

Nuclei is a fast, template-based vulnerability scanner that sends requests across targets based on template definitions. It provides zero false positives and rapid scanning over large infrastructure footprints.

The tool uses YAML-based templates to define vulnerability checks, including HTTP requests, DNS checks, TCP probes, and more. Templates are community-maintained and cover CVEs, misconfigurations, exposures, and more.

Nuclei is designed for mass scanning with low resource usage. It can scan thousands of targets efficiently using concurrency control and provides clean, actionable output for security professionals.

Common Commands

nuclei -u http://example.comDefault scan - Download and execute default community scanning templates against a target

nuclei -u http://example.com -t vulnerabilities/Targeted templates - Run specific template categories targeting known exploits

nuclei -u https://target.comBasic scan

nuclei -l urls.txt -t cves/CVE scanning

nuclei -u target.com -t exposures/Exposure scan

nuclei -u target.com -severity critical,highSeverity filter

nuclei -u https://example.comScan URL with default templates

nuclei -u https://example.com -t cves/Run CVE templates

nuclei -l urls.txtScan multiple URLs from file

nuclei -u https://example.com -severity critical,highFilter by severity

nuclei -u https://example.com -tags sqli,xssRun tagged templates

nuclei -u https://example.com -o results.json -jsonJSON output

nuclei -u https://example.com -o results.csv -csvCSV output

nuclei -u https://example.com -rl 100Rate limit 100 rps

nuclei -u https://example.com -c 2525 concurrent requests

Step-by-Step Guide

1Ensure your signatures are current: nuclei -update-templates
2Execute the tool against your designated target URL
3Apply filters to only show high or critical severity results
4Examine the output for matched exploitation templates
5Manually confirm the findings to ensure they are actionable

Use Cases

CVE Detection

Scan for known CVEs using community templates.

Mass Scanning

Scan thousands of targets efficiently.

Misconfiguration

Detect security misconfigurations across services.

Exposure Detection

Find exposed services and sensitive data.

Key Features

Template Engine: YAML-based vulnerability templates.
Mass Scanning: Scan thousands of targets efficiently.
Low False Positives: Zero false positive template matching.
Multi-Protocol: HTTP, DNS, TCP, and more.
Active Community: 5000+ community-maintained templates.

Related Tools

HTTPX

Information Gathering

Fast HTTP probing toolkit.

Nmap

Information Gathering

Network port scanner.

Frequently Asked Questions

What is Nuclei used for?

Nuclei is used for fast vulnerability scanning using templates. It sends requests based on template definitions, allowing zero false positives and rapid scanning across large infrastructure.

How do Nuclei templates work?

Templates define specific vulnerability checks with HTTP requests, matchers, and extractors. Nuclei executes templates against targets and reports matches.

Can Nuclei scan thousands of targets?

Yes, Nuclei is designed for mass scanning. Use -l urls.txt to scan thousands of targets efficiently with concurrency control.

Are Nuclei templates safe?

Templates from the official repository are generally safe, but custom templates could be aggressive. Always review templates before running against production systems.

How do I install Nuclei?

Install Nuclei using: sudo apt install nuclei on Kali Linux. On other systems, install via Go: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest.

How do I use Nuclei for a basic scan?

Run nuclei -u http://example.com to perform a basic scan. Update templates first: nuclei -update-templates.

What are the most common Nuclei commands?

Common commands include: nuclei -u target (basic scan), nuclei -l urls.txt (mass scan), nuclei -u target -t cves/ (CVE templates), nuclei -u target -severity critical,high (severity filter).

How do I update Nuclei templates?

Run nuclei -update-templates to download the latest community templates. Update regularly to catch new vulnerabilities.

How does Nuclei compare to Nikto?

Nuclei is faster with 5000+ community templates and mass scanning. Nikto has 6700+ built-in tests but is slower. Use Nuclei for speed and breadth; Nikto for depth.

Is Nuclei legal to use?

Nuclei itself is legal software. However, scanning systems without permission from the owner may violate laws. Always obtain written authorization before scanning.

What is the -severity flag in Nuclei?

The -severity flag filters templates by severity level: critical, high, medium, low, info. Use -severity critical,high to focus on the most important vulnerabilities.

How do I scan multiple targets with Nuclei?

Use -l urls.txt to scan targets from a file, one URL per line. Nuclei processes them concurrently with configurable concurrency.

What is the -rate-limit flag in Nuclei?

The -rate-limit flag controls requests per second to avoid overwhelming targets. Use -rate-limit 100 for 100 requests/sec.

How do I write custom Nuclei templates?

Create YAML files with HTTP requests, matchers, and extractors. See the official documentation for template syntax and examples.

What output formats does Nuclei support?

Nuclei supports text (-o), JSON (-json), and JSON Lines (-jsonl) output formats. JSON format is useful for automated processing.

How long does a Nuclei scan take?

A basic scan of a single target takes 1-5 minutes. Mass scanning of thousands of targets depends on concurrency settings and can take hours.

What is the -tags flag in Nuclei?

The -tags flag filters templates by tags: wordpress, cve, misconfiguration, etc. Use -tags wordpress to scan only WordPress-related vulnerabilities.

How do I exclude certain templates?

Use -exclude-tags to exclude specific template categories: -exclude-tags dos to avoid denial-of-service templates.