Nuclei Vulnerability Scanning in Practice: Automated Template-Driven Detection Guide

Nuclei is a YAML-template automated vulnerability scanner. It ships thousands of community templates and high-concurrency probing. This guide covers install, template updates, bulk CVE/misconfig detection, copy-paste commands, and CI integration.

Scope

Nuclei applies to: pre-prod security checks on newly launched systems; periodic vuln sweeps of bulk assets by ops; pentesters finding exploitable issues during recon; building an internal vuln-scan pipeline and wiring it into CI/CD for continuous security verification. Nuclei's core value is template-driven detection. The community maintains thousands of templates covering CVE, default configs, misconfigs, and exposed panels. You cover a large set of common risks without hand-written PoCs.

Prerequisites

• A Linux server (2c4g+ recommended), or a local Go 1.20+ environment
• Target systems are authorized; scanning must meet compliance requirements
• Outbound network for binary download and template updates

How it works

Nuclei uses template matching: each YAML template describes a request sequence (HTTP, DNS, etc.) and matchers (status code, body regex, DSL). At runtime Nuclei sends those requests to the target; a matcher hit means the vuln is present. Concurrency (-c), rate limit (-rate-limit), and timeout (-timeout) keep scans fast without crushing the target. Templates default to ~/.local/share/nuclei-templates, grouped by protocol and category. Sync community rules anytime with update-templates.

Procedure

1. Install Nuclei

Prefer the official binary. Skip the Go toolchain dependency:

# Download latest Linux amd64 build (version per official release)
wget https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_3.3.4_linux_amd64.zip
unzip nuclei_3.3.4_linux_amd64.zip
sudo mv nuclei /usr/local/bin/
nuclei -version

2. Update and inspect the template library

# First run pulls the full template library; update to latest first
nuclei -update-templates
# Template count and categories
nuclei -tl | wc -l
nuclei -tl -tags cve | head -20

3. Single-target baseline scan

# CVE-class detection against one target; write hits to file
nuclei -u https://example.com -t cves/ -o result_cve.txt

# Restrict to high/critical to cut FP noise
nuclei -u https://example.com -severity high,critical -o result_high.txt

4. Bulk asset scan

# Scan urls.txt (one URL per line); concurrency 50, rate 200/s
nuclei -l urls.txt -c 50 -rate-limit 200 -o result_batch.txt

# JSONL output for ELK / SIEM ingest
nuclei -u https://example.com -jsonl -o result.jsonl

5. Misconfig and exposed-panel checks

# Default misconfig and unauthorized panels
nuclei -u https://example.com -tags misconfig,exposure -severity medium,high,critical

# Custom template dir (team-owned rules)
nuclei -u https://example.com -t /opt/team-templates/ -o result_team.txt

Config verification

# Validate template syntax
nuclei -validate -t /opt/team-templates/

# Post-scan stats
nuclei -u https://example.com -stats -si 10 -t cves/

Verification checklist: -o output file contains hits; -stats shows req/s and progress; spot-check hit URLs with curl -I to confirm the vuln is real and avoid template FPs.

FAQ

Q1: Scan results include false positives. Fix?

Run nuclei -validate on custom templates first, then retest hits manually (curl or browser). In production, pin severity to high,critical and drop known-FP templates with -exclude-templates.

Q2: How do I limit impact on production?

Cap pressure with -rate-limit (req/s), -c (concurrent templates), and -timeout (per-request timeout). Run prod scans off-peak, or validate template compatibility in staging first.

Summary

Nuclei's three traits—templates, concurrency, integrability—make it a mainstream automated vuln-detection tool. Keep the template library current, bound scope and rate, emit JSON into the security platform, and you get a durable vuln-sweep capability. Stay inside authorization boundaries. Confirm target ownership before scanning. Avoid compliance risk.