E-NUC
Nuclei
Template-based scanner for known findings across HTTP and other protocols.
OVERVIEW
Nuclei runs community (or custom) YAML templates against a target list: each template encodes a request and a match condition for a specific CVE, exposure, or misconfig. The result is a reproducible scan with the same criteria every run.
ProjectDiscovery's template library is updated constantly, which makes it useful both for a broad initial sweep and for quickly re-validating a specific finding after a patch.
USE CASES
Practical use cases
- 01
Fast sweep of known CVEs across a large inventory of URLs or IPs.
- 02
Detecting exposed panels, default configs, and sensitive files.
- 03
Re-validating a specific finding after the client patches it, using the same template.
- 04
Generating structured, repeatable evidence to attach to the report.
QUICK START
After you have a URL or service inventory, to cover CVEs and misconfigs in a repeatable, evidence-friendly way.
- Update the template library before each review.
- Prepare the target list from the inventory you've already enumerated.
- Run the relevant templates (e.g. cves/) with a sensible rate limit.
- Manually verify every positive before including it as a finding.
root@itspentest:~# nuclei -l targets.txt -t cves/ -rl 50 -o nuclei_findings.txtBEFORE YOU RUN IT
What to check before running it
Not every template is detection-only: some perform real exploitation, so review which ones are enabled before running against production.
Community template quality varies; false positives must be ruled out before reporting.
A high rate limit against fragile infrastructure can degrade the client's service.