Nuclei

Vulnerability Scanner · Intermediate

Template-based scanner for known issues.

Knowledge reference only. Prefer in-browser Labs first. Use this tool only on systems you own or have written authorization to test.

What to learn

Core workflow and interface
Reading and interpreting output
Key configuration options
Integrating into a professional workflow

Legitimate use

Nuclei is used by professionals for legitimate defense, testing and research.

Official docs →

Nuclei — from one URL to template-driven checks

Exposure & misconfiguration detection (authorized assets)

1. Update templates
Run `nuclei -update-templates` (or projectdiscovery install flow). Templates define checks — not exploit payloads by default.
2. Single URL smoke
`nuclei -u https://your-lab.local -tags exposure,misconfig` — start narrow; review matches manually.
3. Scale to lists
Feed httpx/subfinder output: `nuclei -l urls.txt -severity medium,high,critical -rate-limit 50`.
- Rate limit set
- Resume file for long runs
4. Triage
False positives happen — confirm with curl/browser, check version fingerprints, patch or accept risk.
5. CI integration
Run low-rate nuclei against staging on deploy; fail build on critical confirmed issues only after tuning.

Case study: Template-based scanning is widely used in attack surface management; 2023–2025 disclosures often started with exposed admin panels found via nuclei/exposure tags.

Example commands (lab VMs only)

nuclei -u http://localhost:3000
Safe example against your own lab data or localhost