| name | automation-nuclei-templates |
| description | Write custom nuclei templates to codify a finding into a repeatable, mass-scannable check. Load on "write a nuclei template", turning a manual bug into automation, checking a CVE across many hosts, or regression-scanning. Signals: a reproducible request→match, YAML templates, nuclei.
|
| domain | automation |
| type | technique |
| stability | learning |
| modes | ["bugbounty","defense"] |
| severity | info |
| tools | ["nuclei"] |
| schema_version | 1 |
Custom nuclei templates
When it applies
You confirmed a bug (or a CVE pattern) and want to (a) find every other affected host and
(b) keep a regression check. A nuclei template turns "one request + one match condition" into
a scalable, shareable detector.
Why it works
nuclei runs declarative YAML: send request(s), assert matchers on the response. If your finding
is expressible as request→observable signal, it's a template — and then it scans thousands of
hosts consistently, no manual repetition.
Method
- Capture the minimal repro: the exact request and the unambiguous signal that proves the
bug (status, a body string, a header, a reflected marker, response time).
- Write the template:
id, info (name/severity/tags), then http: with method,
path (use {{BaseURL}}), any payloads, and matchers (word/status/regex/dsl).
Use matchers-condition: and to avoid false positives; add an extractor to pull the proof.
- Reduce false positives: match a signal unique to the vuln (a computed reflection, a
specific error), not a generic 200; test against a known-good and known-bad host.
- Validate:
nuclei -t mytemplate.yaml -u https://known-vuln (should hit) and against a
safe host (should not). Lint with -validate.
- Scale/share: run across your live-hosts list; contribute non-sensitive templates upstream.
Gotchas
- Overbroad matchers = noisy, untrusted results; require a signal that only the vuln produces.
- Interpolate
{{BaseURL}}/variables correctly; hardcoded hosts don't scale.
- Destructive checks (writes/DoS) don't belong in a mass template — keep them read-only.
Verify success
The template fires only on genuinely-affected hosts (true on the known-vuln, quiet on the
known-good) and extracts a clear proof.
References
nuclei templating guide; nuclei-templates repo (examples); PDTM docs.
