Nuclei: 20 Commands for Template-Driven Vulnerability Scanning

Nuclei is a fast, template-based vulnerability scanner developed by ProjectDiscovery. It simplifies automated scanning by using YAML templates to define vulnerability signatures. Thousands of detection rules cover CVEs, misconfigurations, exposed panels, and default credentials. With over 11,000 templates in the official repository, Nuclei connects broad discovery with targeted exploitation. This article outlines 20 practical Nuclei commands for security assessments.

1. Perform a basic target scan by specifying a single URL with the -u flag. Nuclei automatically downloads the latest templates from the nuclei-templates repository on first run.

2. Read a list of targets from a file using the -l flag. This allows scanning multiple hosts or URLs without running separate commands.

3. Enable silent mode with the -silent flag to produce clean output, showing only findings. This mode is useful for scripting and piping into other tools.

4. Filter results by severity level using the -s flag. Values include info, low, medium, high, critical, and unknown. Focus on high and critical severity findings to prioritize exploitable vulnerabilities.

5. Exclude specific severity levels with the -es flag. Inverse of severity filtering, this is useful when only interested in exploitable vulnerabilities.

6. Run specific template categories using the -t flag. Specify template paths or directories, such as CVE templates (http/cves/) and SSL templates (ssl/).

7. Target a specific CVE template by specifying the template path with the -t flag. This is the fastest way to check for a particular vulnerability.

8. Filter templates by tags with the -tags flag. Tags include cve, rce, xss, sqli, misconfig, exposure, and more. Combine tags to focus on relevant vulnerability classes.

9. Exclude templates by tags with the -etags flag. Prevent denial-of-service tests that could disrupt the target by excluding tags like dos.

10. Enable automatic scan mode with the -as flag. Nuclei first fingerprints the target's technology stack using Wappalyzer-style detection and then loads only relevant templates.

11. Limit request rate using the -rl flag. Set an explicit request rate per second to prevent overwhelming fragile targets and evade rate-based detection systems.

12. Control template concurrency with the -c flag (template concurrency) and the -bs flag (bulk size). Adjust these values to reduce resource consumption and make scan behavior more predictable.

13. Save results in JSON Lines format using the -jsonl flag and specify the output file with the -o flag. JSONL output integrates well with parsing tools, dashboards, and automated pipelines.

14. Save results as plain text using the -o flag. Note that Nuclei overwrites the output file by default, so use unique filenames or pipe through tee -a to preserve results across multiple runs.

15. Disable Interactsh for non-OAST scans using the -ni flag. This is useful when outbound interactsh traffic is not allowed, when scanning isolated networks, or when deterministic non-OAST results are desired.

16. Exclude specific hosts from scanning with the -exclude-hosts flag. Specify hosts, CIDR ranges, or hostnames to skip during scanning.

17. Resume an interrupted scan using the -resume flag. Save scan state with the -list flag and resume from that state using the -resume flag. This is valuable for long-running scans against large scopes that may be interrupted.

18. Update templates by running Nuclei with the -update-templates flag. This downloads the latest templates from the nuclei-templates repository, ensuring coverage of new CVEs and vulnerabilities.