arsenal/nuclei

nuclei

template vuln scanner · MIT

A fast, template-driven scanner that checks hosts against a huge community library of known vulnerabilities and misconfigurations.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01Scanning by template

nuclei checks a target against templates: small YAML files that each describe how to detect one specific thing, a known CVE, an exposed panel, a misconfiguration, a default credential. The community maintains thousands of them, updated constantly as new issues appear. That design is the strength: nuclei is only as current as its templates, and its templates track the real world closely. It is fast, scriptable, and low on false positives because each template encodes an exact signature.

↑ contents

02Install and update templates

nuclei is a single Go binary. The first thing to do, and to repeat often, is update the templates; an out-of-date template set misses recent issues, which defeats the point.

$ sudo apt install nuclei # Debian / Kali

$ go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest # Gentoo / Fedora / any (Go)

$ nuclei -update-templates # fetch the template library

03A first scan

Point it at a URL and it runs the full template set by default. On one host this is quick; the output names the template that matched, its severity, and the matched URL.

$ nuclei -u https://target

04Targeting severity and tags

The full set is broad; narrow it to what matters. Filter by severity to focus on the serious findings, or by tags to run only a class of checks (cves, exposures, a specific technology). This is how you keep a large scan signal-rich.

$ nuclei -u https://target -severity critical,high

$ nuclei -u https://target -tags cve,exposure

$ nuclei -u https://target -tags wordpress

05Scanning many hosts

nuclei is built for scale. Feed it a list of hosts (the output of your recon and masscan work) and it scans them all, rate-limited so you do not overwhelm anything. This is where it fits the pipeline: recon finds the hosts, nuclei checks them all for known issues.

$ nuclei -l live-hosts.txt -severity critical,high -o findings.txt -rl 150

↑ contents

06Getting good results

» Update templates before every serious scan; coverage is only as fresh as the template set.

» Start with -severity critical,high to triage, then widen; the full set includes many info-level notes.

» -o writes findings to a file; -json gives machine-readable output for tracking over time.

» You can write your own templates for issues specific to your apps; the YAML format is approachable.

07nuclei as continuous self-assessment

nuclei's real power for a defender is repetition. Run it against your own hosts on a schedule and it tells you the day a known vulnerability or exposure appears on your surface, because the templates track public disclosures. A critical finding like an exposed .git or a log4j-vulnerable endpoint is an alarm to act on now. Many teams wire it into CI so a new deployment is checked automatically.

» Schedule it against your external hosts so new exposures are caught early, not at pentest time.

» Treat critical and high findings as incidents; they are usually known-exploited issues.

» Write templates for your own recurring mistakes so they can never ship unnoticed again.

↑ contents