Nuclei Vulnerability Scanner: Template-Based Scanning Guide

Modern application security testing requires rapid, accurate scanning across extensive external attack surfaces. Traditional vulnerability scanners often struggle on modern cloud setups because their monolithic engines trigger excessive false positives and take days to complete sweeps. Nuclei by ProjectDiscovery solves this operational bottleneck by offering an ultrafast, community-driven template-based vulnerability scanner designed for highly configurable security assessments.

Written in Go, Nuclei enables penetration testers, bug bounty hunters, and security operations teams to validate known security flaws, misconfigurations, and newly published CVEs. By defining vulnerability checks in declarative YAML templates, security researchers can test thousands of assets in minutes with near-zero false positive rates.

What Is Nuclei?

Nuclei is an open-source, template-powered automated scanner engineered to send protocol-specific requests across vast collections of target URLs. Instead of relying on hardcoded heuristics, the engine executes community-curated YAML files that describe exact request structures, match conditions, and extraction rules.

The scanner supports multiple network protocols, including HTTP, DNS, TCP, SSL, and WebSocket. When security teams run Nuclei in Kali Linux, they can inspect web servers, API gateways, and cloud endpoints using an unified CLI interface.

Because its underlying network communications are powered by ProjectDiscovery’s retryablehttp-go library, Nuclei handles edge cases gracefully. The engine implements automatic retries, exponential backoffs, and connection pooling to navigate restrictive Web Application Firewalls (WAFs) and rate limits. Review the official source code on the ProjectDiscovery Nuclei GitHub repository.

Why Security Teams Choose Nuclei

Nuclei bridges the gap between manual payload testing and noisy automated scanning engines through several key design advantages:

• Declarative YAML Templates: Security checks are stored as readable, version-controlled YAML files that describe requests, matchers, and extractors.
• High-Concurrency Scanning: Leverages Go goroutines to scan hundreds of endpoints concurrently without exhausting system resources.
• Zero False Positive Design: Multi-condition matchers check HTTP status codes, headers, response bodies, and regex strings before flagging a vulnerability.
• Robust WAF Resilience: Built-in connection retries and adaptive timeouts prevent incomplete scans caused by network drops.
• Pipeline Integration: Fully supports UNIX piping (STDIN/STDOUT), making it easy to chain alongside subdomain discovery and reconnaissance tools.

Compliance Notice: Vulnerability scanning against external assets must always be authorized by formal rules of engagement. Only execute Nuclei against owned infrastructure, bug bounty targets with explicit scopes, or authorized enterprise networks.

How to Install Nuclei on Linux

You can deploy Nuclei easily using precompiled standalone binaries, Go source compilation, or package managers.

Option 1: Installing Pre-Built Binaries (Recommended)

Download the latest release tarball directly from GitHub, extract the archive, and move the binary into your system execution path. If you need help organizing command files, consult our walkthrough on using the cat command to review local configurations.

# Download and unpack the release archive
tar -xzvf nuclei-linux-amd64.tar.gz

# Move binary to system PATH and verify installation
sudo mv nuclei /usr/local/bin/
nuclei -version

Option 2: Installing from Source Using Go

If you have Go (version 1.21 or newer) configured on your system, install the latest development branch using Go modules:

# Install the latest release directly via Go
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# Add Go binary path to current shell if needed
export PATH=$PATH:$(go env GOPATH)/bin

Nuclei Command-Line Options Reference

Nuclei features extensive flags to control scanning concurrency, template selection, output formatting, and network timing.

Option Flag	Parameter Type	Description
-l, -list	File Path	Specifies a text file containing target URLs or hostnames to scan.
-t, -templates	Path / Glob	Specifies a template file or directory path containing YAML checks.
-c, -concurrency	Integer	Sets the number of concurrent templates executed simultaneously (default: 25).
-bulk-size	Integer	Sets the number of concurrent hosts scanned per template (default: 25).
-o, -output	File Path	Saves scan findings directly to a designated text file.
-j, -jsonl	None	Writes output findings in structured JSON Lines format for log ingestion.
-silent	None	Suppresses terminal banners, showing only confirmed vulnerability findings.
-retries	Integer	Sets the number of retry attempts for failed HTTP requests (default: 1).
-timeout	Integer	Specifies request timeout duration in seconds before aborting (default: 5).
-nc, -no-color	None	Disables terminal ANSI color codes for clean text logging.

Practical Scanning Labs and Workflows

You can execute these operational workflows directly from your favorite Linux shell to inspect individual targets, directory trees, and piped asset lists.

Lab 1: Running a Targeted CVE Scan Against an Asset List

In this workflow, we test a list of active web endpoints (urls.txt) against a specific template to check for sensitive exposed Git directories.

# Scan an input list using a specific template and save results
nuclei -l urls.txt -t http/misconfiguration/git-config.yaml -o git_exposure_results.txt

Nuclei requests the designated path across every host in the list. When match criteria confirm that an exposed .git/config file is accessible, it displays the severity, matching URL, and verified response title directly on screen.

Lab 2: Passing Targets via UNIX Pipeline (STDIN)

Nuclei integrates smoothly into standard command line pipelines. You can pass raw target lists into standard input using basic utility tools:

# Pipe targets directly to nuclei from standard input
cat urls.txt | nuclei -t http/cves/ -severity critical,high -o critical_cves.txt

This command instructs Nuclei to filter loaded templates, executing only critical and high-severity checks against the streamed target endpoints.

Lab 3: Building an Automated Reconnaissance Pipeline

Security teams regularly combine Nuclei with reconnaissance utilities like Subfinder and HTTP probe tools to create automated attack-surface pipelines:

# Run end-to-end reconnaissance from discovery to vulnerability check
subfinder -d example.com -silent | httpx -silent | nuclei -t "cves/*.yaml" -o findings.txt

To automate recurring daily discovery sweeps and parse output files into ticketing systems, check out our tutorial on writing Python automation scripts.

Understanding Nuclei YAML Template Architecture

The true strength of Nuclei lies in its transparent template syntax. A template defines the protocol, payload structure, and exact conditions needed to confirm a finding.

id: exposed-env-file

info:
  name: Environment Configuration File Exposure
  author: security-researcher
  severity: high
  description: Detects publicly accessible .env files containing credentials.

http:
  - method: GET
    path:
      - "{{BaseURL}}/.env"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "DB_PASSWORD"
          - "APP_KEY"
        condition: or

When this template runs, Nuclei sends a GET request to /.env. A finding is flagged only if the server returns an HTTP 200 status code and the response body contains database credentials or application keys. This multi-layered matching logic prevents false alerts caused by custom 404 pages.

Nuclei vs. Traditional Scanners: A Quick Comparison

Comparing Nuclei against traditional vulnerability assessment scanners highlights key operational differences.

Capability	Nuclei	Legacy Scanners (Nessus, OpenVAS)
Rule Engine	Open, human-readable YAML templates	Proprietary closed scripts or complex plugins
Community Updates	Immediate (CVE templates released within hours)	Vendor update cycles (days to weeks)
False Positive Rate	Minimal (deterministic multi-condition matching)	Moderate to High (broad heuristic probing)
CI/CD & CLI Integration	Native STDIN/STDOUT stream support	Heavyweight APIs or web-based dashboards
Speed	Ultra-fast asynchronous Go goroutines	Sequential host scanning cycles

For network-level port auditing before launching Nuclei templates, pair your assessments with dedicated port reconnaissance using the Nmap network scanner.

Frequently Asked Questions

How do I keep my Nuclei templates updated?

Nuclei includes a built-in update command. Run nuclei -update-templates regularly to download newly published CVE checks from the official community repository.

Can I run Nuclei behind an HTTP proxy like Burp Suite?

Yes. Pass the -proxy flag (e.g., nuclei -proxy http://127.0.0.1:8080) to route all outbound template requests through your intercepting proxy for detailed traffic inspection.

How does Nuclei avoid crashing web applications?

Nuclei only transmits requests explicitly defined in chosen templates. It avoids aggressive fuzzing unless specifically directed. You can also throttle traffic using the -rate-limit flag to protect fragile endpoints.

Conclusion

Nuclei sets a modern standard for modular vulnerability scanning by combining fast Go performance with transparent YAML templates. Its ability to execute rapid checks, filter false positives, and plug directly into automated command line workflows makes it an indispensable tool for penetration testers, security engineers, and DevOps teams alike.