Nuclei – Practical Guide for Beginners

What is Nuclei?#

Nuclei is a fast and modern vulnerability scanner used in penetration testing and bug bounty hunting. It works with templates that describe how to detect specific vulnerabilities.

Instead of writing complexe scripts, Nuclei allows you to run a lot of security checks using pre-built templates.

Nuclei can detect:

• Misconfigurations
• Exposed panels
• Known CVEs
• XSS
• Open Redirect ...
• Sensitive files
• Default credentials

Because of its speed and flexibility, Nuclei is widely used in recon automation pipelines.

Installation#

Most security distributions already include Nuclei.

Check if it is installed#

nuclei -version

Install (Debian / Kali)#

sudo apt install nuclei

Updating Templates#

Nuclei relies on a large template library.

Update them before scanning:

nuclei -update-templates

Templates are stored locally and updated from the official repository.

Basic Usage#

Scan a single website#

nuclei -u https://example.com

Scan multiple targets#

Create a file:

targets.txt

Example:

site1.com
site2.com
test.site.com

Run the scan:

nuclei -l targets.txt

Important Options#

Target Options#

Scan one URL

-u https://target.com

Scan list of targets

-l targets.txt

Scan a CIDR range (ip range)

-targets targets.txt

Severity Filtering#

You can filter vulnerabilities by severity.

nuclei -u https://target.com -severity low,medium,high,critical

Example (only high risk):

nuclei -u https://target.com -severity high,critical

Scan by Tags#

Templates are categorized by tags.

Example: scan for XSS

nuclei -u https://target.com -tags xss

Example: scan for Open Redirect

nuclei -u https://target.com -tags redirect

Example: scan for Exposed panels

nuclei -u https://target.com -tags exposed-panels

Example: scan for Sensitive files

nuclei -u https://target.com -tags sensitive-files

Example: scan for Default credentials

nuclei -u https://target.com -tags default-credentials

Example: scan for Misconfigurations

nuclei -u https://target.com -tags misconfigurations

Example: scan for SQL Injection

nuclei -u https://target.com -tags sql-injection

.... and more

Scan by CVEs#

Scan for CVEs

nuclei -u https://target.com -tags cve

or you can scan for specific CVEs using the -cve flag.

nuclei -u https://target.com -cve CVE-2021-44228

exemple NEXT JS authentication bypass middleware

nuclei -u https://target.com -cve CVE-2024-21626

Scan Specific Template#

If you want to run a single template:

nuclei -u https://target.com -t templates/xss

Or a specific file:

nuclei -u https://target.com -t xss-detection.yaml

but you need to know the path of the template.

Output Options#

Save scan results to a file.

nuclei -u https://target.com -o results.txt

JSON output (useful for automation):

nuclei -u https://target.com -json

Rate Control#

Limit requests per second:

nuclei -u https://target.com -rate-limit 100

Control concurrency:

nuclei -u https://target.com -c 50 -silent -nc 

-silent : no output of the scan. (only findings) -nc : no color output.

These options help avoid overwhelming a target.

Real Bug Bounty Workflow#

Nuclei is often used after subdomain discovery.

Example workflow:

1. Find subdomains#

subfinder -d target.com > subs.txt

2. Find live hosts#

httpx -l subs.txt > live.txt

3. Scan with Nuclei#

nuclei -l live.txt -severity medium,high,critical

This pipeline is very common in bug bounty reconnaissance.

Useful Flags#

Build your own templates#

Exemple : build a template that scan for a specific vulnerability#

SQL Injection the idea is to send a request with a payload and check if the response contains a specific string.

But first let's understand the structure of a template.

Template Structure

• name: The name of the template.
• info: Information about the template.
• requests: The requests to send to the target.
• matchers: The matchers to check the response.

THIS IS THE WORKFLOW OF NUCLEI :

1. Template → 2. Parse YAML → 3. Build HTTP Request → 4. Send to Target → 5. Analyze Response → 6. Match Patterns → 7. Output Result

Exemple of a full template :

id: sqli-login-page-test
 
info:
  name: Login Page SQL Injection Test
  author: Anas
  severity: high
  description: Tests login page for SQL injection
 
requests:
  - method: POST
    path:
      - "{{BaseURL}}/login"  # This is the URL that will be tested
    body: |
      username={{username}}&password=test
    payloads:
      username:
        - "admin'--"                 # payload 1
        - "admin' OR '1'='1"         # payload 2  
        - "'"                        # payload 3
        - "admin' AND SLEEP(5)--"    # payload 4
        - "admin'OR 1=1--"           # payload 5
        - "admin'OR 1=1#"            # payload 6
    matchers:
      - type: word
        words:
          - "Welcome"          
          - "Dashboard"         
          - "SQL syntax"        

The template will test the login page for SQL injection by sending different payloads to the username parameter and checking if the response contains any of the specified words.

How matchers works :

matchers:
  - type: word
    words:
      - "Welcome"
      - "Dashboard"
      - "SQL syntax"

If the response contains any of these words → Nuclei will tell you "VULNERABILITY FOUND!" If the response does not contain any of these words → Nuclei will try the next payload.

How to run this template : first you need to save the template in a file in the same directory of nuclei.yaml you need to find the path of the template. for example :

/home/kali/nuclei-templates/sqli-login-page-test.yaml

to find the nuclei templates directory :

nuclei -update-templates

and to run the template :

nuclei -t /home/kali/nuclei-templates/sqli-login-page-test.yaml -u https://target.com

Or simply to see the debug information : that means you will see the request and the response of the template.

nuclei -t test-login.yaml -u https://anas.com/login -debug

THIS IS THE END OF THE BASIC GUIDE