The Ultimate Guide to Nuclei: Automating Vulnerability Scanning Like a Pro

Welcome, cyber defenders and bug bounty hunters! In the modern era of cybersecurity, speed is everything. If you are waiting for heavy, legacy GUI scanners to finish their crawl, you are already falling behind. The landscape moves fast, and new CVEs drop daily. Enter Nuclei by ProjectDiscovery—the fast, customizable, and template-based vulnerability scanner that has taken the security world by storm.

In this massive, highly detailed tutorial, we’re diving deep into Nuclei. We'll cover everything from basic installation and running your first scan to writing complex, custom YAML templates to hunt down zero-days. Grab your terminal; it’s time to secure the web.

---

What is Nuclei?

Nuclei is an incredibly fast vulnerability scanner based on simple YAML-based templates. Unlike traditional scanners that use opaque, hard-coded checks, Nuclei's engine is entirely transparent. Every vulnerability check, misconfiguration test, and credential exposure rule is defined in human-readable YAML templates.

This means that when a new vulnerability (like Log4Shell or a new Confluence RCE) drops, the community can push a YAML template within hours, allowing you to scan your entire infrastructure immediately.

Why Use Nuclei?

• Speed & Concurrency: Written in Go, Nuclei is incredibly fast and can scan thousands of hosts in minutes.
• Transparency: No black-box magic. You can see exactly what HTTP requests are being sent and what responses are being matched.
• Community-Driven: The nuclei-templates repository contains thousands of up-to-date checks maintained by top security researchers.
• DevSecOps Integration: Easily integrate Nuclei into CI/CD pipelines to catch vulnerabilities before they hit production.

---

Part 1: Installation & Setup

Getting started with Nuclei is simple. Since it's written in Go, you can grab the pre-compiled binary or install it via Go.

Method 1: Using Go (Recommended)

If you have Go installed, you can simply run:

go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

Method 2: Using Homebrew (macOS/Linux)

brew install nuclei

Method 3: Docker

If you prefer not to install anything on your host machine, you can run Nuclei directly from a Docker container:

docker run -it projectdiscovery/nuclei -h

Updating Templates

Nuclei's real power comes from its templates. Before running your first scan, ensure your templates are up to date:

nuclei -update-templates

---

Part 2: Running Your First Scan

Nuclei is designed to be highly targeted. You can scan a single URL, a list of URLs, or even use standard input (stdin) to pipe results from other tools like subfinder or httpx. To see how these tools fit into a complete workflow, check our Modern Web Recon Workflow.

Scanning a Single Target

To scan a single target with the default community templates:

nuclei -u https://example.com

Scanning a List of Targets

If you have a list of subdomains or URLs in a file called targets.txt, you can pass it to Nuclei using the -l flag:

nuclei -l targets.txt

Chaining Tools (The Bug Bounty Way)

The true power of ProjectDiscovery tools lies in chaining them together. For example, you can find subdomains, filter for active HTTP servers, and scan them all in one fluid pipeline:

subfinder -d example.com | httpx | nuclei -t cves/

In this command, we use the -t cves/ flag to tell Nuclei to only run templates related to known CVEs, saving time and reducing noise.

---

Part 3: Understanding the Dashboard and Templates

While running community templates is great, understanding how they work is where you elevate from a script kiddie to a professional security engineer.

A Nuclei template is essentially a recipe. It tells the engine:

1. What to send (e.g., an HTTP GET request to /config.json).
2. What to look for (e.g., the string "database_password" in the response).
3. How to classify it (e.g., High severity, Information Disclosure).

Here is the anatomy of a basic Nuclei template:

id: exposed-config-file

info:
  name: Exposed config.json File
  author: YourNameHere
  severity: high
  description: An exposed config.json file was found, potentially leaking database credentials.
  tags: exposure,config,credentials

requests

Breaking Down the Template

• id: A unique identifier for the template (no spaces).
• info: Metadata about the vulnerability. This is what shows up in the terminal when a match is found.
• requests: The core logic. We define an HTTP GET request to the {{BaseURL}}/config.json. The {{BaseURL}} is a variable that Nuclei replaces with your target URL.
• matchers: The conditions that must be met to flag a vulnerability. In this case, the response must return a 200 OK status code AND contain either "database_password" or "api_key".

---

Part 4: Advanced Features

Rate Limiting and Stealth

By default, Nuclei runs very fast. If you are scanning a fragile target or trying to avoid a Web Application Firewall (WAF), you need to slow it down.

• -rate-limit (or -rl): Restricts the number of requests per second.
• -concurrency (or -c): Restricts the number of concurrent templates running.

nuclei -l targets.txt -rl 10 -c 10

Writing Results to a File

Always save your findings! You can export results to a plain text file, JSON, or Markdown format for easy reporting.

nuclei -u https://example.com -o results.txt -jsonl json_results.json

Custom Workflows

Instead of running a massive directory of templates, you can define Workflows. Workflows allow you to chain templates conditionally. For example, a workflow might run a technology detection template first (e.g., "Is this a WordPress site?"). If it returns true, it then triggers all WordPress-specific vulnerability templates.

---

Conclusion

Nuclei has revolutionized the way security professionals approach vulnerability scanning. By ditching opaque, monolithic scanners in favor of transparent, community-driven YAML templates, ProjectDiscovery has created an ecosystem that adapts to new threats at the speed of the modern internet.

Whether you are a bug bounty hunter looking to automate your recon, or a DevSecOps engineer aiming to catch misconfigurations in CI/CD, mastering Nuclei is an absolute must.

Start small by running the default templates, explore the nuclei-templates repository to see how they are written, and soon enough, you'll be writing custom templates to secure your specific infrastructure.

Happy hunting!