Nuclei

ProjectDiscovery

Template-driven vulnerability scanner — thousands of community YAML checks, fast enough for CI.

Vulnerability Management Free & Open Source CLI Learning Cross-platform

Cyber Kill Chain & Defender Lifecycle

Attacker — Kill Chain
1 Reconnaissance
2 Weaponization
3 Delivery
4 Exploitation
5 Installation
6 Command & Control
7 Actions on Objectives
Defender — IR Lifecycle
8 Preparation
9 Detection & Analysis
10 Containment, Eradication & Recovery
11 Post-Incident Activity

Description

Nuclei runs YAML templates describing a request and the response that proves a vulnerability. Its value is the community template library and its speed: a full pass over an application takes seconds, which is what makes it viable as a CI gate rather than a one-off audit.

Its limitation is the same as its strength — it finds what a template describes. Anything framework-specific, like a Django mark_safe() on user input, needs a template written for it or a different tool entirely.

Use cases

  • Fast known-vulnerability sweep in a CI pipeline
  • Checking an application against a specific CVE template
  • Second opinion alongside a full DAST scan

Example

nuclei -u http://localhost:8000 -tags ssti,sqli,xss -severity medium,high,critical

Related blog posts