nuclei-scan

# nuclei-scan ## When to Use - When vulnerability scanning is needed against web applications or infrastructure - When scanning for specific CVEs, misconfigurations, or exposures - When security assessment requires template-based detection - When validating potential vulnerabilities with real-world conditions - When scanning for technology-specific vulnerabilities - When automated security testing is required in CI/CD pipelines - When generating vulnerability reports in various formats ## Quick Start Scan a single target with all default templates: ```bash nuclei -u https://example.com ``` ## Step-by-Step Process 1. **Install Nuclei** (if needed): ```bash go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest ``` 2. **Update Templates** to get latest vulnerability checks: ```bash nuclei -update-templates ``` 3. **Basic Scan** against target: ```bash nuclei -u https://target.com -o results.txt ``` 4. **Targeted Scan** by severity and tags: ```bash nuclei -u https://target.com -s critical,high -tags cve -o findings.txt ``` 5. **Export Results** in structured format: ```bash nuclei -u https://target.com -je results.json ``` ## Examples ### Example 1: Single Target Quick Scan **Scenario:** Basic vulnerability scan against one target **Command:** ```bash nuclei -u https://example.com ``` **Output:** ``` [CVE-2021-44228] [http] [critical] https://example.com/api [git-config] [http] [medium] https://example.com/.git/config [robots-txt] [http] [info] https://example.com/robots.txt ``` ### Example 2: Bulk Scanning from File **Scenario:** Scan multiple targets from a list **Command:** ```bash nuclei -l targets.txt -o results.txt ``` **Output:** ``` [2024-01-15 10:30:45] [CVE-2023-1234] [http] [high] https://app1.example.com/login [2024-01-15 10:30:47] [exposed-panels] [http] [medium] https://app2.example.com/admin [2024-01-15 10:30:49] [ssl-cert-expired] [ssl] [low] https://app3.example.com:443 ``` ### Example 3: Severity-Based Scanning **Scenario:** Scan for critical and high severity vulnerabilities only **Command:** ```bash nuclei -u https://example.com -s critical,high -o critical-findings.txt ``` **Output:** ``` [CVE-2021-44228] [http] [critical] https://example.com/api [Log4Shell RCE] [CVE-2023-22515] [http] [critical] https://example.com/confluence [Confluence Auth Bypass] [CVE-2022-41040] [http] [high] https://example.com/owa [ProxyNotShell] ``` ### Example 4: Tag-Based Scanning **Scenario:** Scan for specific vulnerability types **Command:** ```bash nuclei -u https://example.com -tags cve,sqli,xss,rce ``` **Output:** ``` [sqli-error-based] [http] [high] https://example.com/search?q=test [reflected-xss] [http] [medium] https://example.com/page?param=value [CVE-2024-12345] [http] [critical] https://example.com/api/v1/users ``` ### Example 5: Technology-Specific Scanning **Scenario:** Scan for WordPress vulnerabilities **Command:** ```bash nuclei -u https://example.com -tags wordpress -o wp-findings.txt ``` **Output:** ``` [wordpress-version] [http] [info] https://example.com [WordPress 6.2.1] [wp-plugin-vuln] [http] [high] https://example.com/wp-content/plugins/vuln-plugin [wp-xmlrpc-enabled] [http] [medium] https://example.com/xmlrpc.php ``` ### Example 6: Template Directory Scanning **Scenario:** Scan using specific template directories **Command:** ```bash nuclei -u https://example.com -t cves/ -t exposures/ -t misconfigurations/ ``` **Output:** ``` [CVE-2023-44487] [http] [high] https://example.com [HTTP/2 Rapid Reset] [aws-credentials-exposed] [http] [critical] https://example.com/.env [phpinfo-disclosure] [http] [low] https://example.com/phpinfo.php ``` ### Example 7: JSON Export for Automation **Scenario:** Export structured results for downstream processing **Command:** ```bash nuclei -u https://example.com -je results.json -silent ``` **Output (results.json):** ```json { "template-id": "CVE-2021-44228", "info": { "name": "Apache Log4j RCE", "severity": "critical", "tags": ["cve", "cve2021", "rce", "log4j"] }, "host": "https://example.com", "matched-at": "https://example.com/api/login", "timestamp": "2024-01-15T10:30:45.123Z" } ``` ### Example 8: JSONL Output for Streaming **Scenario:** Generate line-by-line JSON for real-time processing **Command:** ```bash nuclei -l targets.txt -j -o results.jsonl ``` **Output:** ```json {"template-id":"git-config","severity":"medium","host":"https://app1.com","matched-at":"https://app1.com/.git/config"} {"template-id":"CVE-2023-1234","severity":"high","host":"https://app2.com","matched-at":"https://app2.com/api"} ``` ### Example 9: Markdown Report Generation **Scenario:** Generate human-readable markdown report **Command:** ```bash nuclei -u https://example.com -me nuclei-report/ ``` **Output (nuclei-report/index.md):** ```markdown # Nuclei Scan Report ## Critical Findings - [CVE-2021-44228] Apache Log4j RCE - https://example.com/api ## High Findings - [SQL Injection] https://example.com/search?id=1 ``` ### Example 10: Rate-Limited Scanning **Scenario:** Controlled scan rate for production targets **Command:** ```bash nuclei -u https://example.com -rl 50 -bs 10 -c 5 -o results.txt ``` **Output:** ``` [info] Rate limit set to 50 requests/second [info] Bulk size: 10 hosts per template [info] Concurrency: 5 templates parallel [CVE-2023-1234] [http] [high] https://example.com/api ``` ### Example 11: Exclude Specific Templates or Tags **Scenario:** Skip certain checks during scan **Command:** ```bash nuclei -u https://example.com -tags cve -etags dos,fuzz -et cves/2020/ -o results.txt ``` **Output:** ``` [info] Excluding tags: dos, fuzz [info] Excluding template directory: cves/2020/ [CVE-2023-44487] [http] [high] https://example.com [CVE-2024-12345] [http] [critical] https://example.com/api ``` ### Example 12: Custom Headers for Bug Bounty **Scenario:** Include identification headers for program compliance **Command:** ```bash nuclei -l targets.txt -H "X-Bug-Bounty: HackerOne-username" -H "User-Agent: Nuclei-Scanner" -o findings.txt ``` **Output:** ``` [info] Custom headers applied to all requests [CVE-2023-1234] [http] [high] https://target.com/api [exposed-panel] [http] [medium] https://target.com/admin ``` ### Example 13: Automatic Technology Detection **Scenario:** Auto-detect technologies and run relevant templates **Command:** ```bash nuclei -u https://example.com -as -o tech-findings.txt ``` **Output:** ``` [tech-detect] Detected: nginx, php, wordpress [info] Running templates matching detected technologies [wordpress-vuln] [http] [high] https://example.com/wp-admin [php-info-leak] [http] [low] https://example.com/info.php ``` ### Example 14: SARIF Export for CI/CD **Scenario:** Generate SARIF format for GitHub Actions integration **Command:** ```bash nuclei -u https://example.com -se results.sarif -s critical,high ``` **Output:** ``` [info] SARIF export enabled [info] Scanning for critical,high severity [CVE-2023-1234] [http] [critical] https://example.com/api Results exported to: results.sarif ``` ## Error Handling | Error | Cause | Resolution | | ------------------------------- | --------------------- | ----------------------------------- | | `no templates found` | Template path invalid | Run `nuclei -update-templates` | | `could not connect` | Target unreachable | Check URL, verify connectivity | | `rate limit exceeded` | Too many requests | Reduce `-rl` value | | `template parsing error` | Malformed YAML | Use `nuclei -validate -t file.yaml` | | `interactsh server error` | OOB unavailable | Use `-ni` to disable | | `context deadline exceeded` | Timeout | Increase `-timeout` | | `signature verification failed` | Unsigned template | Use `-dut` flag | ## Flag Reference ### Target Flags | Flag | Description | | -------------------- | ----------------- | | `-u/-target` | Single target URL | | `-l/-list` | File with targets | | `-eh/-exclude-hosts` | Hosts to skip | | `-sa/-scan-all-ips` | Scan all DNS IPs | | `-resume` | Resume scan | ### Template Flags | Flag | Description | | --------------------- | ----------------- | | `-t/-templates` | Template path/dir | | `-w/-workflows` | Workflow path/dir | | `-nt/-new-templates` | Latest only | | `-as/-automatic-scan` | Auto tech-detect |