Nuclei: A Beginner’s Guide to Web Application
Security
"Nuclei by Project Discovery is a cutting-edge automation tool that simplifies vulnerability
scanning, reconnaissance, and penetration testing, offering a vast repository of templates
contributed by over 100 esteemed security researchers and engineers."
"Nuclei is a powerful vulnerability scanner tool written in Golang. It uses nuclei templates to
send requests to multiple targets, resulting in fast and accurate scanning without false
positives. The tool can be updated automatically with newer versions of templates for better
performance. Nuclei can scan different protocols like DNS, HTTP, and TCP, making it versatile
for various security checks.
Nuclei offers several key benefits in the field of cybersecurity:
Automated Vulnerability Scanning: Nuclei automates the process of vulnerability
scanning, saving time and effort for security teams. It can quickly scan for various protocols
and perform security checks across multiple targets, identifying potential vulnerabilities.
Customizable Templates: Nuclei provides a wide range of pre-built templates
contributed by security experts and allows users to create their own templates.
Fast and Accurate Results: Nuclei is designed for speed and accuracy, providing fast
scanning with zero false positives. It eliminates irrelevant results, allowing security teams to
efficiently prioritize and address critical vulnerabilities.
Integration and Extensibility: Nuclei can be integrated into existing security workflows
and toolchains, enhancing overall security operations.
Overall, Nuclei simplifies and streamlines vulnerability scanning, enabling organizations to
proactively identify and mitigate potential security risks.
Note: “Just make sure you have Golang/Go installed on your system to use Nuclei.”
You can Refer this link to install Go/Golang:
-https://gist.github.com/subfuzion/383dbfed1ee02933d9d384e4fc6977f7
Or simply write: - sudo apt install golang
Let Go to install Nuclei…….
Installation of Nuclei
Step 1: If you have downloaded Go/Golang in your system, verify your Golang installation by
running go version in the terminal use this command:
go version
Step 2: To download Nuclei for your operating system, visit the official website of Project
Discovery. There, you will find various installation methods available to choose from based
on your system's requirements.
Site: https://github.com/projectdiscovery/nuclei/releases
Site: https://github.com/projectdiscovery/nuclei
Step 3: To get Nuclei from GitHub, use this command:
sudo go get github.com/projectdiscovery/nuclei/v2/cmd/nuclei
note: Nuclei requires go1.20 to install successfully. Run the following command to install the
latest version.
Step 4: Get the Nuclei repository or clone the Nuclei tool from GitHub, use the following
command.
sudo GO111MODULE=on go get -v
github.com/projectdiscovery/nuclei/v2/cmd/nuclei
Step 5: To make Nuclei easier to use without manually running it through Golang, you can
copy the Nuclei tool to the bin directory using this command:
sudo cp /root/go/bin/nuclei /usr/local/go/bin/
Step 6: Update the Nuclei Templates, Project discovery has a dedicated repository that
houses various types of vulnerability templates contributed by over a hundred security
researchers and engineers.
In order to get the latest templates, build by the community, you can simply supply this
command, nuclei -update-templates using this command:
sudo nuclei -update-templates
By executing this command, the Nuclei tool will be copied to the bin directory, allowing you
to access it conveniently without specifying the Golang path every time.
Step 7: To access the help menu page and gain a better understanding of the Nuclei tool, use
the following command:
nuclei -h
Nuclei gives you the ability to write your own custom templates in order to match your
workflow. Here in this URL nuclei.projectdiscovery.io/templating-guide/ you will find all the
information on how you can build one for yourself.
Site: https://github.com/projectdiscovery/nuclei-templates
Usages:
Example 1: Like you can make your own template, and running nuclei at single template and
Nuclei provides the option to create your own templates, allowing you to define customized
security checks. You can also run Nuclei on a single template by specifying the template file
and the target you want to scan. This flexibility lets you focus on specific security tests and
simplify the scanning process. Whether you use existing templates or create your own,
Nuclei offers a user-friendly approach to vulnerability scanning and testing.
nuclei -u http://testphp.vulnweb.com/ -t yourowntemplate.yaml
Example 2: You can Run Multiple templates with speed and Nuclei makes it incredibly easy
to run multiple templates simultaneously, enabling fast and efficient vulnerability scanning.
Instead of scanning one template at a time, Nuclei empowers you to launch multiple security
checks all at once. This saves you time and ensures comprehensive coverage across your
targets. By leveraging parallel execution, Nuclei optimizes the scanning process, allowing you
to quickly identify and address potential security vulnerabilities. With Nuclei, you can
effortlessly enhance your security testing and strengthen the protection of your systems.
nuclei -u http://testphp.vulnweb.com/ -t cves/ -t exposures/
Example 3: You can do mass scanning; Nuclei simplifies mass scanning by allowing you to
scan multiple targets at once. With a single command, you can scan numerous hosts,
domains, or IP addresses simultaneously. This feature saves time and effort, making it easier
to assess the security of many targets efficiently. Whether you're conducting small or large-
scale assessments, Nuclei streamlines the process of mass scanning and helps you identify
vulnerabilities effectively.
nuclei -l target_urls.txt -t cves/
Example 4: Excluding single template With Nuclei, you can exclude specific templates from
the scanning process, customizing your vulnerability assessments. This allows you to focus
on relevant checks and exclude unnecessary ones. By tailoring your scans, you optimize
efficiency and obtain targeted results based on your specific needs.
nuclei -u https://evil.com -t cves/ - exclude-templates cves/2020/
-Written By Rashideo Narendra Benvansh
```
<div style="display: inline-block; background-color: #f2f2f2; color:
#333; padding: 10px; border: 2px solid #ddd; border-radius: 5px;
margin: 3px;">
<p>This is some text inside the box.</p>
<p>You can add more text by adding more <p> tags.</p>
</div>
```
