Nuclei: Complete Guide to Fast Vulnerability Scanning and Automated Security Testing Using Kali Linux

Abdul Wahab Junaid

4 weeks ago

Nuclei: Complete Guide to Fast Vulnerability Scanning and Automated Security Testing Using Kali Linux

Nuclei is a fast, template-based vulnerability scanner developed by ProjectDiscovery, written in Go. Instead of hard-coded checks, Nuclei uses YAML-based templates that describe a request, matcher, and extractor logic — allowing the security community to write and share detection logic for CVEs, misconfigurations, exposed panels, default credentials, takeovers, and more. ProjectDiscovery maintains a public templates repository with thousands of community-contributed templates, updated continuously as new CVEs are disclosed. Nuclei is highly extensible, extremely fast due to Go’s concurrency model, and integrates cleanly with other ProjectDiscovery tools like httpx and katana in a single recon-to-scan pipeline.

How to Install

# Kali Linux
sudo apt update
sudo apt install nuclei -y
nuclei -version

# Or install via Go (latest version)
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# Download and update the templates repository
nuclei -update-templates

Syntax

nuclei -u <target> [options]
nuclei -l <targets_file> [options]

All Command-Line Options (Key Flags)

Option	Description
`-u, -target <url>`	Single target URL
`-l, -list <file>`	File containing list of targets
`-t, -templates <path>`	Specify template(s) or directory to run
`-tags <tags>`	Run templates matching specific tags (e.g., `cve,rce`)
`-severity <level>`	Filter by severity: info, low, medium, high, critical
`-etags <tags>`	Exclude templates matching specific tags
`-id <template-id>`	Run a specific template by ID
`-exclude-id <id>`	Exclude a specific template ID
`-rl, -rate-limit <n>`	Max requests per second (default 150)
`-c, -concurrency <n>`	Number of concurrent templates executed (default 25)
`-timeout <secs>`	Request timeout
`-retries <n>`	Number of retries on failure
`-H, -header <header>`	Custom HTTP header
`-proxy <url>`	Route requests through a proxy
`-o, -output <file>`	Write results to a file
`-je, -json-export <file>`	Export results as JSON
`-me, -markdown-export <dir>`	Export results as Markdown
`-silent`	Suppress banner/progress, show only results
`-v, -verbose`	Verbose output
`-debug`	Debug mode with full request/response
`-nc, -no-color`	Disable colored output
`-stats`	Display real-time scan statistics
`-bulk-size <n>`	Max hosts analyzed in parallel
`-headless`	Enable headless browser-based templates
`-uc, -update-templates`	Update template repository
`-tl`	List all available templates
`-validate`	Validate template syntax without running
`-nt, -new-templates`	Run only newly added templates
`-as, -automatic-scan`	Automatic scan based on detected technologies (wappalyzer-style)
`-fh, -follow-host-redirects`	Follow redirects on the same host
`-passive`	Enable passive scanning mode (no live requests)
`-irr, -include-rr`	Include request/response in JSON output

Basic Usage (Expected Output in Bash)

$ nuclei -u https://testphp.vulnweb.com

Output:

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/  v3.3.5

		projectdiscovery.io

[INF] Current nuclei version: v3.3.5
[INF] Templates loaded: 6234
[INF] Targets loaded: 1
[http-missing-security-headers] [http] [info] https://testphp.vulnweb.com
[tech-detect:php] [http] [info] https://testphp.vulnweb.com
[apache-detect] [http] [info] https://testphp.vulnweb.com

Practical Examples with Output

Example 1 — Scan with only critical/high severity templates

$ nuclei -u https://example.com -severity critical,high

Output:

[INF] Targets loaded: 1
[CVE-2023-XXXX] [http] [critical] https://example.com/wp-content/plugins/vuln-plugin

Example 2 — Scan a list of hosts with tag filtering

$ nuclei -l targets.txt -tags cve,exposure -o results.txt

Output:

[INF] Targets loaded: 50
[exposed-panel] [http] [medium] https://target2.com/admin
[CVE-2021-44228] [http] [critical] https://target5.com/
[INF] Results written to results.txt

Example 3 — Run only a specific template by ID

$ nuclei -u https://example.com -id CVE-2021-44228

Output:

[CVE-2021-44228] [http] [critical] https://example.com [Log4Shell RCE not detected]
[INF] No results found

Example 4 — Export results as JSON

$ nuclei -u https://example.com -je results.json
$ jq '.[] | {template: .template_id, severity: .info.severity}' results.json

Output:

{"template": "ssl-issuer", "severity": "info"}
{"template": "missing-hsts", "severity": "low"}

Example 5 — Chain with httpx for a full recon-to-scan pipeline

$ cat subdomains.txt | httpx -silent | nuclei -tags tech,cve -silent

Output:

[tech-detect:nginx] [http] [info] https://api.example.com
[CVE-2022-1388] [http] [critical] https://legacy.example.com

Example 6 — Run with rate limiting for stealth

$ nuclei -u https://example.com -rl 10 -c 5

Output:

[INF] Rate limit set to 10 req/s, concurrency 5
[INF] Scan completed in 4m12s. No high/critical issues found.

Example 7 — Automatic technology-based scan

$ nuclei -u https://testphp.vulnweb.com -as

Output:

[INF] Detected technologies: Apache, PHP
[INF] Running matched templates: apache-*, php-*
[apache-detect] [http] [info] https://testphp.vulnweb.com

Example 8 — Scan through Burp proxy for manual correlation

$ nuclei -u https://testphp.vulnweb.com -proxy http://127.0.0.1:8080

Output:

[INF] Proxy configured: http://127.0.0.1:8080
[http-missing-security-headers] [http] [info] https://testphp.vulnweb.com

Example 9 — Update templates and validate a custom template

$ nuclei -update-templates
$ nuclei -t custom-template.yaml -validate

Output:

[INF] Successfully updated templates (9482 templates)
[INF] Template custom-template.yaml validated successfully

Example 10 — Real-time scan statistics

$ nuclei -l targets.txt -stats

Output:

[INF] Templates: 6234 | Hosts: 200 | RPS: 142 | Matched: 8 | Errors: 3 | Duration: 2m14s

Common Use Cases

Fast CVE and misconfiguration scanning across large asset lists in bug bounty programs.
Continuous security monitoring pipelines that re-scan assets on new template releases (-nt).
Detecting exposed panels, default credentials, and information disclosure at scale.
Chained recon workflows: subdomain enumeration → httpx liveness check → Nuclei vulnerability scan.
Custom internal template development for organization-specific checks (e.g., internal CMS fingerprints).

Automation with Bash

#!/bin/bash
# nuclei-pipeline.sh — full recon-to-scan pipeline using ProjectDiscovery tools

DOMAIN="$1"
OUTDIR="nuclei-scan-$(date +%Y%m%d)"
mkdir -p "$OUTDIR"

echo "[*] Enumerating subdomains..."
subfinder -d "$DOMAIN" -silent -o "$OUTDIR/subdomains.txt"

echo "[*] Checking live hosts..."
httpx -l "$OUTDIR/subdomains.txt" -silent -o "$OUTDIR/live-hosts.txt"

echo "[*] Running Nuclei scan..."
nuclei -l "$OUTDIR/live-hosts.txt" -severity medium,high,critical \
    -je "$OUTDIR/nuclei-results.json" -stats

echo "[*] Scan complete. Findings:"
jq -r '.[] | "\(.info.severity | ascii_upcase): \(.info.name) - \(.host)"' "$OUTDIR/nuclei-results.json"

Tips and Best Practices

Keep templates updated regularly (-update-templates) — new CVEs are added daily.
Filter by -severity and -tags to keep scans focused and reduce noise/runtime on large asset lists.
Use -rl and -c to throttle scans against production systems to avoid disruption.
Chain with httpx, subfinder, and katana for an efficient end-to-end ProjectDiscovery workflow.
Write custom templates for organization-specific checks and validate them with -validate before running at scale.
Use -irr in JSON output when you need full request/response evidence for a report.

Troubleshooting

Issue	Cause	Fix
`no templates provided` error	Templates not downloaded	Run `nuclei -update-templates`
Very slow scans	Too many templates run unfiltered	Use `-tags`/`-severity` to scope the template set
High false-positive rate	Generic matcher templates	Cross-verify manually or exclude noisy templates with `-etags`
Connection refused on many hosts	Target down or rate-limited	Lower `-rl`, increase `-retries`
Headless templates fail	Missing Chromium dependency	Install Chromium and pass `-headless`

References

Official GitHub repository: https://github.com/projectdiscovery/nuclei
Templates repository: https://github.com/projectdiscovery/nuclei-templates
Documentation: https://docs.projectdiscovery.io/tools/nuclei/overview
Kali tool page: https://www.kali.org/tools/nuclei/