___________ __________ _____ ________ ________ .____ ___________ \_ _____/ \______ \ / _ \ / _____/ / _____/ | | \_ _____/ | __) | _/ / /_\ \ / \ ___ / \ ___ | | | __)_ | \ | | \ / | \ \ \_\ \ \ \_\ \ | |___ | \ \___ / |____|_ / \____|__ / \______ / \______ / |_______ \ /_______ / \/ \/ \/ \/ \/ \/ \/

nuclei Cheatsheet

← Back to cheatsheets

← Home

Nuclei is a fast, template-based vulnerability scanner by ProjectDiscovery. It uses YAML templates to define scanning logic, making it highly customizable and community-driven.

Basic Usage

  • nuclei -u <url> - Scan single URL
  • nuclei -l urls.txt - Scan from file
  • nuclei -u <url> -t <template> - Use specific template

Target Options

  • -u, -target - Target URL
  • -l, -list - File with list of targets
  • -resume - Resume scan using resume.cfg

Template Options

  • -t, -templates - Template files/directories
  • -tl - List available templates
  • -nt, -new-templates - Run newly added templates
  • -ntv, -new-templates-version - Run templates from specific version
  • -as, -automatic-scan - Automatic web scan with wappalyzer

Filtering Templates

  • -tags <tags> - Filter by tags (comma separated)
  • -etags <tags> - Exclude tags
  • -itags <tags> - Include only specific tags
  • -s, -severity <level> - Filter by severity
  • -es, -exclude-severity - Exclude severity levels
  • -author <author> - Filter by author
  • -type <type> - Filter by protocol type

Severity Levels

  • info - Informational
  • low - Low severity
  • medium - Medium severity
  • high - High severity
  • critical - Critical severity

Output Options

  • -o, -output - Output file
  • -j, -json - JSON output
  • -irr - Include request/response in output
  • -nc, -no-color - Disable colors
  • -silent - Silent mode (only results)
  • -v, -verbose - Verbose output
  • -debug - Debug output

Rate Limiting

  • -rl, -rate-limit - Requests per second (default 150)
  • -rlm, -rate-limit-minute - Requests per minute
  • -bs, -bulk-size - Parallel hosts (default 25)
  • -c, -concurrency - Parallel templates (default 25)

Configuration

  • -config - Config file path
  • -H, -header - Custom headers
  • -V, -var - Custom variables key=value
  • -sr, -store-resp - Store responses
  • -srd, -store-resp-dir - Response storage directory

Proxy Options

  • -proxy - HTTP proxy
  • -proxy-socks-url - SOCKS proxy
  • -proxy-auth - Proxy authentication

Update Options

  • -update - Update nuclei
  • -ut, -update-templates - Update templates
  • -ud, -update-directory - Update template directory

Common Examples

Basic Scan

nuclei -u https://example.com

Run all templates against target.

Specific Template

nuclei -u https://example.com -t cves/2021/

Run 2021 CVE templates.

By Severity

nuclei -u https://example.com -s critical,high

Only critical and high severity.

By Tags

nuclei -u https://example.com -tags cve,rce

Filter by CVE and RCE tags.

Multiple Targets

nuclei -l urls.txt -o results.txt

Scan list, save results.

JSON Output

nuclei -u https://example.com -j -o results.json

Output in JSON format.

With Custom Headers

nuclei -u https://example.com -H "Authorization: Bearer token"

Scan with auth header.

Rate Limited

nuclei -u https://example.com -rl 50

Limit to 50 requests per second.

Automatic Scan

nuclei -u https://example.com -as

Auto-detect technologies and scan.

New Templates Only

nuclei -u https://example.com -nt

Run only recently added templates.

Common Tags

  • cve - CVE vulnerabilities
  • rce - Remote code execution
  • lfi - Local file inclusion
  • sqli - SQL injection
  • xss - Cross-site scripting
  • ssrf - Server-side request forgery
  • exposure - Sensitive data exposure
  • tech - Technology detection
  • misconfig - Misconfigurations
  • takeover - Subdomain takeover

Template Locations

  • ~/nuclei-templates/ - Default templates directory
  • Custom templates can be specified with -t flag

Tips

  • Run -update-templates regularly for new checks
  • Use -as for smart automatic scanning
  • Filter by severity to focus on critical issues
  • Combine with subfinder and httpx for full recon
  • Write custom templates for specific checks
  • Use -silent for clean output in pipelines
  • Store responses with -sr for later analysis
  • Part of ProjectDiscovery toolkit
  • Always get authorization before scanning

← Back to cheatsheets

← Home