Skip to content
Pwnversity

Nuclei

Nuclei is a fast TEMPLATE-based scanner: it checks for thousands of known vulnerabilities, exposures, and misconfigurations by sending requests defined in YAML files. It’s key in bug bounty recon and exposure management (see Recon automation, Vulnerability management).

What it is

Section titled “What it is”
- a TEMPLATE scanner (YAML): each template describes how to detect something specific
- a huge community of templates (nuclei-templates): CVEs, exposures, misconfig, tech-detect
- fast and precise (low false positives if templates are good)
- ideal for checking a list of hosts en masse (output of httpx, see bb-recon)

Basic use

Section titled “Basic use”
nuclei -u https://host                          # scan with default templates
nuclei -l live.txt                              # against a list of hosts
nuclei -l live.txt -severity critical,high      # filter by severity
nuclei -l live.txt -t cves/ -t exposures/       # specific template categories
nuclei -update-templates                         # update the templates

Template categories

Section titled “Template categories”
cves/           detection of known CVEs by version/behavior
exposures/      panels, files, backups, .git, exposed dashboards
misconfiguration/  insecure configurations
default-logins/  default credentials
technologies/   technology fingerprinting
takeovers/      subdomain takeover (see bb-recon)

In the recon pipeline

Section titled “In the recon pipeline”
# chain with the bb-recon pipeline:
subfinder -d target.com | httpx -silent | nuclei -severity medium,high,critical
# -> from subdomains to live hosts to findings, in one line

Writing your own templates

Section titled “Writing your own templates”
- simple YAML: request (method, path, headers) + matchers (status, word, regex)
- custom templates for a target's/organization's own patterns
- careful firing intrusive templates (some exploit) out of scope (bb-scope)

Blue Team / use

Section titled “Blue Team / use”
  • Nuclei checks CVEs/exposures/misconfig en masse over host lists: ideal after httpx (Recon automation).
  • Keep templates updated; filter by severity to prioritize.
  • Also useful in defense: scan your own surface for exposure management (Vulnerability management).
  • Careful with intrusive templates and the scope (Reading the scope & rules); some do exploit.

Tips and gotchas

Section titled “Tips and gotchas”
  • Keep templates updated (nuclei -update-templates); its value is the community template set.
  • Common mistake: running everything at max concurrency, downing the target or tripping the WAF; tune -rl/-c.
  • Filter by severity/tags (-severity critical,high, -tags cve) to focus; review hits (false positives exist).
  • Write your own templates for target-specific logic; that’s where it shines most.

Testing checklist

Section titled “Testing checklist”
  • Update templates (-update-templates)
  • Scan the live-host list (after httpx, Recon automation)
  • Filter by severity to prioritize
  • Key categories (cves, exposures, misconfig, takeovers)
  • Chain into the recon pipeline
  • Custom templates for specific patterns
  • Respect scope and avoid intrusive templates out of scope

References

Section titled “References”