Nuclei tutorial (templates, severity and automation)

Quick answer: Nuclei is a template-based (YAML templates) vulnerability scanner created by ProjectDiscovery. Instead of closed rules, it runs thousands of declarative checks that the community maintains. You launch nuclei -u https://target.com, filter by -severity and chain it with your recon to scan hundreds of hosts at once.

What is Nuclei?

Nuclei is a fast scanning engine that runs templates: YAML files that describe how to check something (a request, a condition the response must meet, and a severity). The beauty is that the detection logic lives in data, not code: there are thousands of public templates and you can write your own in minutes.

It fits at the end of a recon flow: first you discover domains and live hosts, then you pass Nuclei over them to detect known CVEs, exposures, misconfigurations and technologies. It doesn't replace manual analysis —it finds the known, not the novel— but it covers in minutes a terrain that would take you days by hand.

Installation and first scan

Nuclei installs with Go or from the ProjectDiscovery binaries. The first scan is straightforward:

nuclei -u https://target.com

Against a list of hosts (the usual in bug bounty):

nuclei -l hosts.txt

By default it uses the official template repository. Keep it updated —new CVEs come out every week— with:

nuclei -update-templates

Filtering by severity and type

Firing every template against everything generates noise. You filter by severity and by tags:

• -severity: -severity critical,high to go for what matters. Values: info, low, medium, high, critical.
• -tags: -tags cve,exposure,misconfig to narrow by category.
• -t: points to a specific directory or template, e.g. -t http/cves/ or -t http/exposures/.
• -exclude-tags: discards known noise.

A scan focused on high-impact findings:

nuclei -l hosts.txt -severity high,critical -tags cve,exposure -o results.txt

With -rl (rate limit) and -c (concurrency) you control the aggressiveness. On sensitive targets, lower the rate so you don't saturate.

How to write your own template?

Here's the real power of Nuclei. A template is readable YAML. This one checks whether a .git/config file is exposed:

id: git-config-exposed

info:
  name: Exposed .git/config file
  author: yourname
  severity: medium
  description: Detects a publicly accessible Git repository
  tags: exposure,git

http:
  - method: GET
    path:
      - "{{BaseURL}}/.git/config"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "[core]"
          - "repositoryformatversion"
        condition: and
      - type: status
        status:
          - 200

The key pieces: http.path defines the request ({{BaseURL}} is a Nuclei variable), and matchers defines when it counts as a hit. Here it requires the response to contain both strings and return 200. With extractors you can also pull data from the response (versions, tokens, paths).

Always validate your template before using it seriously:

nuclei -t my-template.yaml -u https://target.com -validate

Writing your own templates is what turns a pattern you discover by hand into a check you can fire against your entire scope. If you find a recurring misconfiguration in a program, templatize it.

Matchers and extractors from the inside

The heart of a template are the matchers (when there's a hit) and the extractors (what data to pull). Knowing the types gives you a lot of control:

• word: looks for literal strings in the response. The most common.
• regex: matches regular expressions. For patterns (versions, token formats).
• status: checks the HTTP code.
• dsl: Nuclei logical expressions, the most powerful. You can combine conditions (status_code == 200 && contains(body, "admin")), operate with lengths, times and headers.

With matchers-condition: and you require all to be met; with or, any. The extractors (of type regex or kval) pull values from the response —a version, a path, an identifier— and show them alongside the finding, which makes your reports much more concrete.

For blind vulnerabilities (with no direct response), Nuclei integrates interactsh, its out-of-band interaction server. A template can make the target issue a DNS or HTTP request to a unique domain that Nuclei controls; if that interaction arrives, you confirm a blind SSRF or a blind RCE without seeing anything in the HTTP response. It's the same idea as Burp's Collaborator.

Workflows: chaining templates

Beyond firing isolated templates, Nuclei supports workflows: running one template only if another was positive. Example: you first detect the technology (a specific CMS) and only then launch that CMS's CVE templates. This reduces noise and time enormously compared to firing everything against everything.

Combined with notify (another ProjectDiscovery tool), you can receive findings in real time on Slack, Discord or Telegram while the scan runs on a server. That's how you build a continuous monitoring pipeline for your scope.

Chaining recon: the flow that scales

The classic ProjectDiscovery combination turns a domain into findings with a single pipeline:

subfinder -d target.com -silent | httpx -silent | nuclei -severity high,critical

What each piece does:

1. subfinder enumerates subdomains of target.com.
2. httpx filters those that are alive and respond over HTTP/HTTPS.
3. nuclei scans those live hosts looking for high-severity problems.

It's the backbone of many automated recon flows. You can save each stage to files to reuse it and add waybackurls or gau to add historical URLs. I develop the logic of why this pipeline works in advanced recon techniques.

A template with DSL logic

When a simple word isn't enough, the dsl matcher gives you compound conditions. This template detects a possible information leak by combining code, content and length:

id: possible-debug-exposed

info:
  name: Debug mode or trace exposed
  author: yourname
  severity: high
  tags: exposure,debug

http:
  - method: GET
    path:
      - "{{BaseURL}}/?debug=true"
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, 'Traceback') || contains(body, 'stack trace')"
          - "len(body) > 500"
        condition: and

The power is in dsl: you combine status, content and size in a single readable condition. With extractors you could also pull the framework version that appears in the trace and show it in the finding, which makes your report immediately actionable.

Performance: scanning thousands of hosts

Nuclei is built for scale, but you have to calibrate it. The key flags:

• -c (concurrency): how many templates run in parallel.
• -rl (rate limit): global requests per second. The most important lever to not saturate targets.
• -bulk-size: how many hosts are processed at once per template.
• -timeout and -retries: for unstable networks.

Against a large scope, start conservative and ramp up slowly, watching that you don't degrade the service. A well-calibrated scan gives you the same findings without burning the target or standing out as an attack. Always save the output (-o or -je for JSON) to process it later and prioritize by severity.

Avoiding false positives and noise

Nuclei is powerful, but misused it generates junk reports that burn your reputation with programs:

• Don't report info findings just because. A technology banner isn't a vulnerability.
• Always verify by hand. A template can produce a match that has no impact in context. Confirm before reporting.
• Respect the rate limit. Scanning thousands of hosts at max speed can degrade services and break the program's rules.
• Update the templates, but review what you launch: not everything in the repo applies to your target.

A Nuclei match is the start of an investigation, not the final report. You add the value by confirming the impact and writing the proof of concept.

Nuclei and the template community

A large part of Nuclei's value isn't in the binary, but in its community template repository. Thousands of checks maintained by researchers worldwide, updated almost daily as new CVEs and techniques appear. When a serious flaw is published in a popular product, there's usually a template to detect it within hours, and with nuclei -update-templates you already have it. That community speed is what turns Nuclei into a continuous monitoring tool: you don't just scan once, you review your scope every time something new appears. And if you write a useful template, contributing it back to the repository helps everyone and builds your reputation in the ecosystem.

Frequently asked questions (FAQ)

Does Nuclei replace a pentester?
No. It detects the known (CVEs, exposures, misconfigurations) at scale, but it doesn't find novel vulnerabilities or business logic. It's an accelerator of the detection phase, not a substitute for human analysis.

Can I launch Nuclei against any website?
No. Only against authorized targets: your systems or in-scope bug bounty programs. Scanning third parties without permission is illegal, and a badly aimed pipeline can touch out-of-scope hosts.

How often do I update the templates?
Before every serious campaign. New CVEs come out constantly and the repository moves fast. A nuclei -update-templates before scanning is routine.

Why do I get so many info findings?
Because many templates are informational (banners, technologies). They're not vulnerabilities. Filter with -severity high,critical to focus on what matters and avoid reporting noise.

Best practices and ethics

Nuclei scales a lot, and with scale comes responsibility. Only scan what's in scope, control the traffic volume and never fire intrusive checks against infrastructure you don't have permission for. A badly aimed subfinder | httpx | nuclei pipeline can touch out-of-scope hosts without you noticing: filter your host list before scanning.

Where it fits in your arsenal

Nuclei shines in the mass detection phase of the known: CVEs, exposures, misconfigurations. The manual stuff —business logic, IDOR, complex chains— is still yours. Master it as one more piece within a complete methodology, not as the whole thing.

To train the part no tool automates —understanding the vulnerability and exploiting it— practice with real-case labs and study the theory in the Academy. Nuclei tells you where to look; knowing what to do when you get there is what pays.