Menu
Nuclei CLI parameter reference and usage patterns - YAML-template vulnerability scanning, target input modes, template filters, output formats, rate limits, ProjectDiscovery dashboard upload, and common scan commands.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
Benchmark mode marker — engagement objective is flag capture. Generic engagement rules apply unchanged.
Exploit Active Directory Certificate Services ESC1 — vulnerable template allows arbitrary SAN, enabling user impersonation up to domain admin.
BloodHound ingestion + canonical Cypher queries for AD attack-path enumeration. Run after collector dumps zip; promotes findings into the knowledge graph.
NetExec (CrackMapExec successor) — unified SMB/LDAP/MSSQL/WinRM/RDP/SSH/FTP/VNC protocol auth + post-auth modules. 200+ modules incl. BloodHound auto-ingest, ESC1-15 scanning, PrintNightmare, LDAP relay.
Active Directory attack lane — BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction.
Red team engagement lifecycle management — initiation, phase transitions, go/no-go gates, deconfliction, emergency procedures, completion.
| name | nuclei |
| description | Nuclei CLI parameter reference and usage patterns - YAML-template vulnerability scanning, target input modes, template filters, output formats, rate limits, ProjectDiscovery dashboard upload, and common scan commands. |
| allowed-tools | Bash Read |
| metadata | {"subdomain":"shared-tool-params","when_to_use":"nuclei, nuclei scanner, vulnerability scan, template scan, nuclei templates, projectdiscovery, yaml templates, cve scan, dast, oast, interactsh","tags":"nuclei, projectdiscovery, vulnerability-scanning, templates, yaml, cve, dast, oast"} |
Nuclei is a modern, high-performance vulnerability scanner that uses simple YAML-based templates. It helps design custom vulnerability detection scenarios that mimic real-world conditions, reducing false positives by verifying vulnerabilities with realistic steps.
Use this reference when constructing or reviewing nuclei commands. The flags below are expanded from nuclei -h.
Install Nuclei locally for CLI scanning, or use the ProjectDiscovery cloud tier to store and visualize findings, manage templates, access the latest nuclei templates, and discover/store targets.
Important notes:
Nuclei requires Go >= 1.24.2 for source installation:
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
Installation docs: https://docs.projectdiscovery.io/tools/nuclei/install
nuclei [flags]
./nuclei [flags]
Quick, findings-only scan:
nuclei -u https://example.com -silent
High-signal scan for serious findings:
nuclei -u https://example.com -severity high,critical -silent
Scan a target list and write JSONL output:
nuclei -l urls.txt -jsonl -o nuclei_findings.jsonl
Scan only selected tags:
nuclei -u https://example.com -tags cve,exposure,misconfig
Exclude noisy severities or tags:
nuclei -l urls.txt -es info,low -etags intrusive,dos
Run specific template paths:
nuclei -u https://example.com -t http/cves/ -t ssl/
Run a specific template ID or wildcard:
nuclei -u https://example.com -id cves/2021/CVE-2021-44228
nuclei -u https://example.com -id '*jenkins*'
Use authenticated headers:
nuclei -u https://example.com -H 'Authorization: Bearer <TOKEN>' -H 'Cookie: session=<VALUE>'
Use variables consumed by templates:
nuclei -u https://example.com -V username=admin -V password='<PASSWORD>'
Throttle scans for fragile or shared environments:
nuclei -l urls.txt -rl 20 -c 10 -bs 10 -timeout 15 -retries 2
Route traffic through a proxy:
nuclei -u https://example.com -proxy http://127.0.0.1:8080
Store evidence and redact sensitive keys:
nuclei -u https://example.com -jsonl -o findings.jsonl -sresp -srd nuclei_evidence -rd token,authorization,cookie
Export reports:
nuclei -l urls.txt -me nuclei_report/
nuclei -l urls.txt -se nuclei.sarif
nuclei -l urls.txt -je nuclei.json
Upload findings to ProjectDiscovery Cloud dashboard:
nuclei -l urls.txt -dashboard
Update engine and templates:
nuclei -update
nuclei -update-templates
Validate custom templates before running:
nuclei -validate -t /path/to/templates/
Use DAST fuzzing templates with a scoped target:
nuclei -u https://example.com -dast -fuzz-scope '^https://example\.com/' -fa low
| Flag | Description |
|---|---|
-u, -target string[] | Target URLs/hosts to scan. |
-l, -list string | Path to file containing target URLs/hosts to scan, one per line. |
-eh, -exclude-hosts string[] | Hosts to exclude from the input list: IP, CIDR, hostname. |
-resume string | Resume scan from and save to the specified file. Clustering is disabled. |
-sa, -scan-all-ips | Scan all IPs associated with a DNS record. |
-iv, -ip-version string[] | IP version to scan for hostname: 4, 6. Default: 4. |
| Flag | Description |
|---|---|
-im, -input-mode string | Input file mode: list, burp, jsonl, yaml, openapi, swagger. Default: list. |
-ro, -required-only | Use only required fields in input format when generating requests. |
-sfv, -skip-format-validation | Skip format validation, such as missing vars, when parsing input file. |
| Flag | Description |
|---|---|
-nt, -new-templates | Run only new templates added in the latest nuclei-templates release. |
-ntv, -new-templates-version string[] | Run new templates added in a specific version. |
-as, -automatic-scan | Automatic web scan using Wappalyzer technology detection to tags mapping. |
-t, -templates string[] | Template file or directory to run. Supports comma-separated values and file input. |
-turl, -template-url string[] | Template URL or list containing template URLs to run. Supports comma-separated values and file input. |
-ai, -prompt string | Generate and run a template using an AI prompt. |
-w, -workflows string[] | Workflow file or directory to run. Supports comma-separated values and file input. |
-wurl, -workflow-url string[] | Workflow URL or list containing workflow URLs to run. Supports comma-separated values and file input. |
-validate | Validate the passed templates. |
-nss, -no-strict-syntax | Disable strict syntax check on templates. |
-td, -template-display | Display template content. |
-tl | List all templates matching current filters. |
-tgl | List all available tags. |
-sign | Sign templates with private key from NUCLEI_SIGNATURE_PRIVATE_KEY. |
-code | Enable loading code protocol-based templates. |
-dut, -disable-unsigned-templates | Disable running unsigned templates or templates with mismatched signature. |
-esc, -enable-self-contained | Enable loading self-contained templates. |
-egm, -enable-global-matchers | Enable loading global matchers templates. |
-file | Enable loading file templates. |
| Flag | Description |
|---|---|
-a, -author string[] | Run templates by author. Supports comma-separated values and file input. |
-tags string[] | Run templates by tags. Supports comma-separated values and file input. |
-etags, -exclude-tags string[] | Exclude templates by tags. Supports comma-separated values and file input. |
-itags, -include-tags string[] | Execute tags even if they are excluded by default or configuration. |
-id, -template-id string[] | Run templates by template IDs. Supports comma-separated values, file input, and wildcards. |
-eid, -exclude-id string[] | Exclude templates by template IDs. Supports comma-separated values and file input. |
-it, -include-templates string[] | Template file or directory to execute even if excluded by default or configuration. |
-et, -exclude-templates string[] | Template file or directory to exclude. Supports comma-separated values and file input. |
-em, -exclude-matchers string[] | Template matchers to exclude in results. |
-s, -severity value[] | Run templates by severity: info, low, medium, high, critical, unknown. |
-es, -exclude-severity value[] | Exclude templates by severity: info, low, medium, high, critical, unknown. |
-pt, -type value[] | Run templates by protocol type: dns, file, http, headless, tcp, workflow, ssl, websocket, whois, code, javascript. |
-ept, -exclude-type value[] | Exclude templates by protocol type: dns, file, http, headless, tcp, workflow, ssl, websocket, whois, code, javascript. |
-tc, -template-condition string[] | Run templates by expression condition. |
| Flag | Description |
|---|---|
-o, -output string | Output file to write found issues/vulnerabilities. |
-sresp, -store-resp | Store all requests/responses passed through nuclei to output directory. |
-srd, -store-resp-dir string | Store all requests/responses to a custom directory. Default: output. |
-silent | Display findings only. |
-nc, -no-color | Disable ANSI color output. |
-j, -jsonl | Write output in JSON Lines format. |
-irr, -include-rr -omit-raw | Include request/response pairs in JSON, JSONL, and Markdown outputs for findings only. Deprecated; use -omit-raw. Default: true. |
-or, -omit-raw | Omit request/response pairs in JSON, JSONL, and Markdown outputs for findings only. |
-ot, -omit-template | Omit encoded template in JSON and JSONL output. |
-nm, -no-meta | Disable printing result metadata in CLI output. |
-ts, -timestamp | Enable printing timestamp in CLI output. |
-rdb, -report-db string | Nuclei reporting database. Always use this to persist report data. |
-ms, -matcher-status | Display match failure status. |
-me, -markdown-export string | Directory to export results in Markdown format. |
-se, -sarif-export string | File to export results in SARIF format. |
-je, -json-export string | File to export results in JSON format. |
-jle, -jsonl-export string | File to export results in JSON Lines format. |
-rd, -redact string[] | Redact keys from query parameters, request headers, and body. |
| Flag | Description |
|---|---|
-config string | Path to nuclei configuration file. |
-tp, -profile string | Template profile config file to run. |
-tpl, -profile-list | List community template profiles. |
-fr, -follow-redirects | Enable following redirects for HTTP templates. |
-fhr, -follow-host-redirects | Follow redirects on the same host. |
-mr, -max-redirects int | Maximum redirects to follow for HTTP templates. Default: 10. |
-dr, -disable-redirects | Disable redirects for HTTP templates. |
-rc, -report-config string | Nuclei reporting module configuration file. |
-H, -header string[] | Custom header/cookie for all HTTP requests in header:value format. Supports CLI and file input. |
-V, -var value | Custom vars in key=value format. |
-r, -resolvers string | File containing resolver list for nuclei. |
-sr, -system-resolvers | Use system DNS resolving as error fallback. |
-dc, -disable-clustering | Disable request clustering. |
-passive | Enable passive HTTP response processing mode. |
-fh2, -force-http2 | Force HTTP/2 connection on requests. |
-ev, -env-vars | Enable environment variables in templates. |
-cc, -client-cert string | PEM client certificate file for authenticating against scanned hosts. |
-ck, -client-key string | PEM client key file for authenticating against scanned hosts. |
-ca, -client-ca string | PEM client certificate authority file for authenticating against scanned hosts. |
-sml, -show-match-line | Show match lines for file templates. Works with extractors only. |
-ztls | Use ztls library with autofallback to standard one for TLS 1.3. Deprecated; autofallback to ztls is enabled by default. |
-sni string | TLS SNI hostname to use. Default: input domain name. |
-dka, -dialer-keep-alive value | Keep-alive duration for network requests. |
-lfa, -allow-local-file-access | Allow file payload access anywhere on the system. |
-lna, -restrict-local-network-access | Block connections to local/private networks. |
-i, -interface string | Network interface to use for network scan. |
-at, -attack-type string | Payload combination type: batteringram, pitchfork, clusterbomb. |
-sip, -source-ip string | Source IP address to use for network scan. |
-rsr, -response-size-read int | Maximum response size to read, in bytes. |
-rss, -response-size-save int | Maximum response size to save, in bytes. Default: 1048576. |
-reset | Remove all nuclei configuration and data files, including nuclei-templates. |
-tlsi, -tls-impersonate | Enable experimental ClientHello/JA3 TLS randomization. |
-hae, -http-api-endpoint string | Experimental HTTP API endpoint. |
| Flag | Description |
|---|---|
-iserver, -interactsh-server string | Interactsh server URL for self-hosted instance. Default: oast.pro,oast.live,oast.site,oast.online,oast.fun,oast.me. |
-itoken, -interactsh-token string | Authentication token for self-hosted Interactsh server. |
-interactions-cache-size int | Number of requests to keep in the interactions cache. Default: 5000. |
-interactions-eviction int | Seconds to wait before evicting requests from cache. Default: 60. |
-interactions-poll-duration int | Seconds to wait before each interaction poll request. Default: 5. |
-interactions-cooldown-period int | Extra time for interaction polling before exiting. Default: 5. |
-ni, -no-interactsh | Disable Interactsh server for OAST testing and exclude OAST-based templates. |
| Flag | Description |
|---|---|
-ft, -fuzzing-type string | Override fuzzing type set in template: replace, prefix, postfix, infix. |
-fm, -fuzzing-mode string | Override fuzzing mode set in template: multiple, single. |
-fuzz | Enable loading fuzzing templates. Deprecated; use -dast. |
-dast | Enable/run DAST fuzz templates. |
-dts, -dast-server | Enable DAST server mode for live fuzzing. |
-dtr, -dast-report | Write DAST scan report to file. |
-dtst, -dast-server-token string | DAST server token. Optional. |
-dtsa, -dast-server-address string | DAST server address. Default: localhost:9055. |
-dfp, -display-fuzz-points | Display fuzz points in output for debugging. |
-fuzz-param-frequency int | Frequency of uninteresting parameters before skipping. Default: 10. |
-fa, -fuzz-aggression string | Fuzzing aggression level controlling payload count: low, medium, high. Default: low. |
-cs, -fuzz-scope string[] | In-scope URL regex followed by the fuzzer. |
-cos, -fuzz-out-scope string[] | Out-of-scope URL regex excluded by the fuzzer. |
| Flag | Description |
|---|---|
-uc, -uncover | Enable uncover engine. |
-uq, -uncover-query string[] | Uncover search query. |
-ue, -uncover-engine string[] | Uncover search engine: shodan, censys, fofa, shodan-idb, quake, hunter, zoomeye, netlas, criminalip, publicwww, hunterhow, google. Default: shodan. |
-uf, -uncover-field string | Fields to return: ip, port, host. Default: ip:port. |
-ul, -uncover-limit int | Number of uncover results to return. Default: 100. |
-ur, -uncover-ratelimit int | Override rate limit of engines with unknown rate limit. Default: 60 req/min. |
| Flag | Description |
|---|---|
-rl, -rate-limit int | Maximum requests per second. Default: 150. |
-rld, -rate-limit-duration value | Rate-limit duration window. Default: 1s. |
-rlm, -rate-limit-minute int | Maximum requests per minute. Deprecated. |
-bs, -bulk-size int | Maximum hosts analyzed in parallel per template. Default: 25. |
-c, -concurrency int | Maximum templates executed in parallel. Default: 25. |
-hbs, -headless-bulk-size int | Maximum headless hosts analyzed in parallel per template. Default: 10. |
-headc, -headless-concurrency int | Maximum headless templates executed in parallel. Default: 10. |
-jsc, -js-concurrency int | Maximum JavaScript runtimes executed in parallel. Default: 120. |
-pc, -payload-concurrency int | Maximum payload concurrency for each template. Default: 25. |
-prc, -probe-concurrency int | HTTP probe concurrency with httpx. Default: 50. |
-tlc, -template-loading-concurrency int | Maximum concurrent template loading operations. Default: 50. |
| Flag | Description |
|---|---|
-timeout int | Timeout in seconds. Default: 10. |
-retries int | Retry count for failed requests. Default: 1. |
-ldp, -leave-default-ports | Leave default HTTP/HTTPS ports, such as host:80 and host:443. |
-mhe, -max-host-error int | Maximum errors for a host before skipping scan. Default: 30. |
-te, -track-error string[] | Add errors to the max-host-error watchlist. Supports standard and file input. |
-nmhe, -no-mhe | Disable skipping host based on errors. |
-project | Use a project folder to avoid sending the same request multiple times. |
-project-path string | Set project path. Default: /tmp. |
-spm, -stop-at-first-match | Stop processing HTTP requests after first match. May break template/workflow logic. |
-stream | Stream mode: start processing without sorting input. |
-ss, -scan-strategy value | Scan strategy: auto, host-spray, template-spray. Default: auto. |
-irt, -input-read-timeout value | Timeout on input read. Default: 3m0s. |
-nh, -no-httpx | Disable httpx probing for non-URL input. |
-no-stdin | Disable stdin processing. |
| Flag | Description |
|---|---|
-headless | Enable templates that require headless browser support. Root user on Linux disables sandbox. |
-page-timeout int | Seconds to wait for each page in headless mode. Default: 20. |
-sb, -show-browser | Show the browser on screen when running headless templates. |
-ho, -headless-options string[] | Start headless Chrome with additional options. |
-sc, -system-chrome | Use locally installed Chrome instead of nuclei-installed Chrome. |
-cdpe, -cdp-endpoint string | Use remote browser via Chrome DevTools Protocol endpoint. |
-lha, -list-headless-action | List available headless actions. |
| Flag | Description |
|---|---|
-debug | Show all requests and responses. |
-dreq, -debug-req | Show all sent requests. |
-dresp, -debug-resp | Show all received responses. |
-p, -proxy string[] | HTTP/SOCKS5 proxy list. Supports comma-separated values or file input. |
-pi, -proxy-internal | Proxy all internal requests. |
-ldf, -list-dsl-function | List supported DSL function signatures. |
-tlog, -trace-log string | File to write sent request trace log. |
-elog, -error-log string | File to write sent request error log. |
-version | Show nuclei version. |
-hm, -hang-monitor | Enable nuclei hang monitoring. |
-v, -verbose | Show verbose output. |
-profile-mem string | Generate memory heap profile and trace files. |
-vv | Display templates loaded for scan. |
-svd, -show-var-dump | Show variables dump for debugging. |
-vdl, -var-dump-limit int | Limit number of characters in variable dump. Default: 255. |
-ep, -enable-pprof | Enable pprof debugging server. |
-tv, -templates-version | Show installed nuclei-templates version. |
-hc, -health-check | Run diagnostic check up. |
| Flag | Description |
|---|---|
-up, -update | Update nuclei engine to latest released version. |
-ut, -update-templates | Update nuclei-templates to latest released version. |
-ud, -update-template-dir string | Custom directory to install/update nuclei-templates. |
-duc, -disable-update-check | Disable automatic nuclei/templates update check. |
| Flag | Description |
|---|---|
-hpd, -honeypot-detect | Detect potential honeypot hosts based on match concentration. |
-hpt, -honeypot-threshold int | Distinct template IDs required to flag a honeypot host. Default: 15. |
-shp, -suppress-honeypot | Suppress output for flagged honeypot hosts. |
| Flag | Description |
|---|---|
-stats | Display statistics about running scan. |
-sj, -stats-json | Display statistics in JSON Lines format. |
-si, -stats-interval int | Seconds between statistics updates. Default: 5. |
-mp, -metrics-port int | Port to expose nuclei metrics on. Default: 9092. |
-hps, -http-stats | Enable HTTP status capturing. Experimental. |
| Flag | Description |
|---|---|
-auth | Configure ProjectDiscovery Cloud API key. Default: true. |
-tid, -team-id string | Upload scan results to given team ID. Optional. Default: none. |
-cup, -cloud-upload | Upload scan results to ProjectDiscovery Cloud dashboard. Deprecated; use -dashboard. |
-sid, -scan-id string | Upload scan results to existing scan ID. Optional. |
-sname, -scan-name string | Scan name to set. Optional. |
-pd, -dashboard | Upload/view nuclei results in ProjectDiscovery Cloud dashboard. |
-pdu, -dashboard-upload string | Upload/view nuclei results file, JSONL, in ProjectDiscovery Cloud dashboard. |
| Flag | Description |
|---|---|
-sf, -secret-file string[] | Path to config file containing secrets for authenticated scan. |
-ps, -prefetch-secrets | Prefetch secrets from secrets file. |
Headers in secrets files preserve exact casing, which is useful for case-sensitive APIs.
Run nuclei on a single host:
nuclei -target example.com
Run nuclei with specific template directories:
nuclei -target example.com -t http/cves/ -t ssl
Run nuclei against a list of hosts:
nuclei -list hosts.txt
Run nuclei with JSON output:
nuclei -target example.com -json-export output.json
Run nuclei with sorted Markdown output using environment variables:
MARKDOWN_EXPORT_SORT_MODE=template nuclei -target example.com -markdown-export nuclei_report/
Perform a quick scan against one web application:
nuclei -target https://example.com
Provide a file containing multiple URLs or hosts:
nuclei -list urls.txt
Scan an entire subnet for network-related issues, such as open ports or misconfigured services:
nuclei -target 192.168.1.0/24
Create a YAML template that defines the request and matching logic, then run it with -t:
nuclei -u https://example.com -t /path/to/your-template.yaml
Run scans locally and upload results to the ProjectDiscovery Cloud dashboard for analysis and remediation:
nuclei -target https://example.com -dashboard
The dashboard upload feature can be used without a subscription. See ProjectDiscovery documentation for the full setup guide.
Nuclei templates are YAML files that define how requests are sent and how responses are processed. This gives Nuclei a simple, human-readable extension model for building custom checks quickly.
Templates are open source and community-developed by security researchers. They commonly include metadata such as severity, detection methods, and vulnerability context so findings can be identified and communicated consistently.
ProjectDiscovery also provides a free AI-powered Nuclei Templates Editor for trying template ideas online.
| Use case | Example template category |
|---|---|
| Detect known CVEs | CVE templates, such as Log4Shell checks |
| Identify out-of-band vulnerabilities | Blind SQL injection via OOB |
| SQL injection detection | Generic SQL injection |
| Cross-site scripting | Reflected XSS detection |
| Default or weak passwords | Default credentials checks |
| Secret files or data exposure | Sensitive file disclosure |
| Open redirects | Open redirect detection |
| Subdomain takeovers | Subdomain takeover templates |
| Security misconfigurations | Unprotected Jenkins console |
| Weak SSL/TLS configurations | SSL certificate expiry |
| Misconfigured cloud services | Open S3 bucket detection |
| Remote code execution | RCE detection templates |
| Directory traversal | Path traversal detection |
| File inclusion vulnerabilities | Local/remote file inclusion |
Additional documentation: https://docs.projectdiscovery.io/getting-started/running