Pentesting.Site - Nuclei Cheat Sheet

Nuclei is a fast, template-based vulnerability scanner designed to automate the detection of security vulnerabilities and misconfigurations across modern applications and infrastructure. It utilizes a vast library of community-driven YAML templates to perform targeted scans, allowing security researchers and DevOps teams to identify exposures and known CVEs with high precision and speed.

Download Nuclei

Installation

1
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

1
brew install nuclei

1
docker pull projectdiscovery/nuclei:latest

1
git clone https://github.com/projectdiscovery/nuclei.git
2
cd nuclei/cmd/nuclei
3
go build
4
mv nuclei /usr/local/bin/
5
nuclei -version

1
git clone https://github.com/projectdiscovery/nuclei.git
2
cd nuclei/helm
3
helm upgrade --install nuclei . -f values.yaml

Updating Templates

1
nuclei -update-templates  #Update nuclei templates to latest version
2
nuclei -ut                #Shortcut to update templates
3
nuclei -update            #Update nuclei binary
4
nuclei -tl                #List installed templates

Basic Usage

1
nuclei -u https://example.com                           #Scan a single target
2
nuclei -u https://target.com -v                         #Scan target with verbose output
3
nuclei -u https://target.com -fr                        #Scan target and follow redirects
4
nuclei -l targets.txt                                   #Scan multiple targets from file
5
nuclei -u https://example.com -t vulnerabilities/       #Run vulnerability templates
6
nuclei -u https://example.com -severity critical,high   #Scan for critical/high vulnerabilities
7
nuclei -u https://target.com -timeout 15 -retries 3     #Scan with timeout and retries
8
nuclei -u https://target.com -stream                    #Stream scan (faster large input processing)
9
nuclei -u https://target.com -p http://127.0.0.1:8080   #Route traffic through Burp

Target Input Options

1
nuclei -u https://example.com        #Scan a single URL
2
nuclei -l targets.txt                #Scan targets from list
3
cat urls.txt | nuclei                #Pipe targets into nuclei
4
subfinder -d example.com | nuclei    #Scan discovered subdomains
5
echo https://example.com | nuclei    #Scan piped input
6
nuclei -resume resume.cfg            #Resume a previous scan
7
nuclei -u example.com -iv 4          #Scan IPv4 only
8
nuclei -u example.com -iv 4,6        #Scan both IPv4 and IPv6

Template Selection

1
nuclei -u https://example.com -t cves/                #Run CVE templates
2
nuclei -u https://example.com -t exposures/           #Run exposure templates
3
nuclei -u https://example.com -t misconfiguration/    #Run misconfiguration templates
4
nuclei -u https://example.com -t vulnerabilities/     #Run vulnerability templates
5
nuclei -u https://example.com -t technologies/        #Run technology detection templates

Severity Filtering

1
nuclei -u https://example.com -severity critical          #Scan only critical vulnerabilities
2
nuclei -u https://example.com -severity high,critical     #Scan high and critical findings
3
nuclei -u https://example.com -severity medium,high       #Scan medium and high severity templates
4
nuclei -u https://example.com -s critical                 #Short option for severity filter

Template Tags

1
nuclei -u https://example.com -tags cve    #Run templates tagged with CVE
2
nuclei -u https://example.com -tags rce    #Scan for remote code execution vulnerabilities
3
nuclei -u https://example.com -tags lfi    #Scan for Local File Inclusion vulnerabilities
4
nuclei -u https://example.com -tags sqli   #Scan for SQL injection vulnerabilities
5
nuclei -u https://example.com -tags xss    #Scan for Cross-Site Scripting vulnerabilities

Technology Detection

1
nuclei -u https://example.com -t technologies/     #Detect technologies used by target
2
nuclei -u https://example.com -as                  #Automatic scan using tech detection
3
nuclei -u https://example.com -tags tech           #Run technology detection templates

Running Specific Templates

1
nuclei -u https://example.com -t cves/2021/                  #Run CVE templates from 2021
2
nuclei -u https://example.com -t cves/CVE-2021-44228.yaml    #Run specific template
3
nuclei -u https://example.com -t http/exposures/             #Run HTTP exposure templates
4
nuclei -u https://example.com -t dns/                        #Run DNS templates

Workflow Scans

1
nuclei -u https://example.com -w workflows/                            #Run nuclei workflows
2
nuclei -l targets.txt -w workflows/                                    #Run workflow scan on multiple targets
3
nuclei -u https://example.com -w workflows/wordpress-workflow.yaml     #Run WordPress workflow

Performance Tuning

1
nuclei -l targets.txt -c 50                 #Set concurrency to 50
2
nuclei -l targets.txt -rate-limit 200       #Limit requests per second
3
nuclei -l targets.txt -rlm 1000             #Limit requests per minute
4
nuclei -l targets.txt -bs 100               #Increase bulk host processing
5
nuclei -l targets.txt -timeout 10           #Set request timeout
6
nuclei -l targets.txt -retries 2            #Retry failed requests
7
nuclei -l targets.txt -rl 20 -c 10          #Slow safe scanning
8
nuclei -l targets.txt -rl 500 -c 200        #High speed scanning

Stealth & Evasion

1
nuclei -u https://example.com -random-agent                      #Use random user agent
2
nuclei -u https://example.com -proxy http://127.0.0.1:8080       #Use HTTP proxy
3
nuclei -u https://example.com -proxy socks5://127.0.0.1:9050     #Use SOCKS proxy
4
nuclei -u https://example.com -H "X-Forwarded-For: 127.0.0.1"    #Add custom header

Custom Headers

1
nuclei -u https://example.com -H "Authorization: Bearer TOKEN"    #Add authorization header
2
nuclei -u https://example.com -H "Cookie: session=abc123"         #Send session cookie
3
nuclei -u https://example.com -H "User-Agent: Mozilla/5.0"        #Custom user agent

Authentication Scans

1
nuclei -u https://example.com -H "Cookie: sessionid=12345"              #Scan authenticated session
2
nuclei -u https://example.com -H "Authorization: Basic dXNlcjpwYXNz"    #Basic authentication
3
nuclei -u https://example.com -header "Authorization: Bearer TOKEN"     #Bearer token authentication

Output Options

1
nuclei -u https://example.com -o results.txt   #Save output to file
2
nuclei -l targets.txt -json -o results.json    #Export results as JSON
3
nuclei -u https://example.com -silent          #Show only results
4
nuclei -u https://example.com -nc              #No color output

Debugging & Verbose Mode

1
nuclei -u https://example.com -v       #Verbose output
2
nuclei -u https://example.com -debug   #Debug output
3
nuclei -u https://example.com -stats   #Show scan statistics
4
nuclei -u https://example.com -trace   #Trace requests

Chaining With Other Tools

Subdomain Enumeration

1
subfinder -d example.com | nuclei     #Scan discovered subdomains
2
assetfinder example.com | nuclei      #Scan assetfinder results
3
amass enum -d example.com | nuclei    #Scan amass results

URL Discovery

1
gau example.com | nuclei                       #Scan historical URLs
2
waybackurls example.com | nuclei               #Scan Wayback Machine URLs
3
katana -u https://example.com | nuclei         #Scan crawler results
4
echo 10.1.1.0/24 | httpx -silent | nuclei      #Scan httpx results

Bug Bounty Recon Pipelines

1
subfinder -d target.com | httpx | nuclei                                         #Subdomain discovery → HTTP probe → Nuclei scan
2
subfinder -d target.com | httpx -silent | nuclei -silent                         #Scan only alive HTTPS services
3
subfinder -d target.com | httpx -silent | nuclei -s high,critical                #Subdomains → httpx → high/critical vulnerabilities
4
subfinder -d target.com | httpx -silent | nuclei -as                             #Subdomains → tech detection → vulnerability scan
5
subfinder -d target.com | httpx -silent | nuclei -rl 100 -c 50                   #Scan discovered services with rate limiting
6
subfinder -d target.com | httpx -silent | nuclei -json -o nuclei_results.json    #Full recon pipeline with output storage