The highest tagged major version is
README
¶
Nuclei is a fast tool for configurable targeted scanning based on templates offering massive extensibility and ease of use.
Nuclei is used to send requests across targets based on a template leading to zero false positives and providing effective scanning for known paths. Main use cases for nuclei are during initial reconnaissance phase to quickly check for low hanging fruits or CVEs across targets that are known and easily detectable. It uses retryablehttp-go library designed to handle various errors and retries in case of blocking by WAFs, this is also one of our core modules from custom-queries.
We have also open-sourced a dedicated repository to maintain various type of templates, we hope that you will contribute there too. Templates are provided in hopes that these will be useful and will allow everyone to build their own templates for the scanner. Checkout the guide at GUIDE.md for a primer on nuclei templates.
Resources
Features
- Simple and modular code base making it easy to contribute.
- Fast And fully configurable using a template based engine.
- Handles edge cases doing retries, backoffs etc for handling WAFs.
- Smart matching functionality for zero false positive scanning.
Usage
nuclei -h
This will display help for the tool. Here are all the switches it supports.
| Flag | Description | Example |
|---|---|---|
| -c | Number of concurrent requests (default 10) | nuclei -c 100 |
| -l | List of urls to run templates | nuclei -l urls.txt |
| -t | Templates input file/files to check across hosts | nuclei -t git-core.yaml |
| -t | Templates input file/files to check across hosts | nuclei -t nuclei-templates/cves/ |
| -nC | Don't Use colors in output | nuclei -nC |
| -o | File to save output result (optional) | nuclei -o output.txt |
| -silent | Show only found results in output | nuclei -silent |
| -retries | Number of times to retry a failed request (default 1) | nuclei -retries 1 |
| -timeout | Seconds to wait before timeout (default 5) | nuclei -timeout 5 |
| -debug | Allow debugging of request/responses. | nuclei -debug |
| -v | Shows verbose output of all sent requests | nuclei -v |
| -version | Show version of nuclei | nuclei -version |
| -proxy-url | Proxy URL | nuclei -proxy-url http://user:pass@this.is.a.proxy:8080 |
| -proxy-socks-url | Proxy Socks URL | nuclei -proxy-socks-url socks5://user:pass@this.is.a.proxy.socks:9050 |
| -H | Custom Header | nuclei -H "x-bug-bounty: hacker" |
Installation Instructions
From Binary
The installation is easy. You can download the pre-built binaries for your platform from the Releases page. Extract them using tar, move it to your $PATHand you're ready to go.
> tar -xzvf nuclei-linux-amd64.tar.gz
> mv nuclei-linux-amd64 /usr/bin/nuclei
> nuclei -h
From Source
nuclei requires go1.13+ to install successfully. Run the following command to get the repo -
> GO111MODULE=on go get -u -v github.com/projectdiscovery/nuclei/cmd/nuclei
In order to update the tool, you can use -u flag with go get command.
Running in a Docker Container
- Clone the repo using
git clone https://github.com/projectdiscovery/nuclei.git - Build your docker container
> docker build -t projectdiscovery/nuclei .
- After building the container using either way, run the following:
> docker run -it projectdiscovery/nuclei
For example, this will run the tool against all the hosts in urls.txt and output the results to your host file system:
> cat urls.txt | docker run -v /path-to-nuclei-templates:/go/src/app/ -i projectdiscovery/nuclei -t ./files/git-config.yaml > results.txt
Remember to change /path-to-nuclei-templates to the real path on your host file system.
Running nuclei
1. Running nuclei with a single template.
This will run the tool against all the hosts in urls.txt and returns the matched results.
> nuclei -l urls.txt -t git-core.yaml -o results.txt
You can also pass the list of hosts at standard input (STDIN). This allows for easy integration in automation pipelines.
This will run the tool against all the hosts in urls.txt and returns the matched results.
> cat urls.txt | nuclei -t git-core.yaml -o results.txt
2. Running nuclei with multiple templates.
This will run the tool against all the hosts in urls.txt with all the templates in the path-to-templates directory and returns the matched results.
> nuclei -l urls.txt -t nuclei-templates/cves/ -o results.txt
3. Automating nuclei with subfinder and any other similar tool.
> subfinder -d hackerone.com -silent | httpx -silent | nuclei -t nuclei-templates/cves/ -o results.txt
Nuclei supports glob expression ending in .yaml meaning multiple templates can be easily passed to be executed one after the other. Please refer to this guide to build your own custom templates.
Thanks
nuclei is made with 🖤 by the projectdiscovery team. Community contributions have made the project what it is. See the Thanks.md file for more details. Do also check out these similar awesome projects that may fit in your workflow:
https://portswigger.net/burp
https://github.com/ffuf/ffuf
https://github.com/jaeles-project/jaeles
https://github.com/ameenmaali/qsfuzz
https://github.com/proabiral/inception
https://github.com/hannob/snallygaster
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
internal
|
|
|
runner
Package runner executes the enumeration process.
|
Package runner executes the enumeration process. |
|
pkg
|
|
|
extractors
Package extractors implements extractors for http response data retrieval.
|
Package extractors implements extractors for http response data retrieval. |
|
matchers
Package matchers implements matchers for http response matching with templates.
|
Package matchers implements matchers for http response matching with templates. |
|
requests
Package requests implements requests for templates that will be sent to hosts.
|
Package requests implements requests for templates that will be sent to hosts. |
|
templates
Package templates contains the parser for a template for the engine.
|
Package templates contains the parser for a template for the engine. |