Nuclei — Fast and Customizable Vulnerability Scanner

What it is

Nuclei is a fast, template-based vulnerability scanner by ProjectDiscovery. Its community-driven template library covers CVEs, misconfigurations, exposed admin panels, default credentials, and security checks. You point Nuclei at a target, and it runs thousands of checks in parallel using YAML templates.

Nuclei targets security researchers, penetration testers, and DevSecOps teams who need automated vulnerability scanning across web applications, APIs, and infrastructure.

How it saves time or tokens

Nuclei replaces manual security checks with automated template scanning. The community maintains thousands of templates updated for new CVEs within days of disclosure. Running Nuclei against a target in CI/CD catches vulnerabilities before deployment.

Templates are YAML files you can read, modify, and write. Custom checks for your application take minutes to create.

How to use

1. Install Nuclei: go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
2. Update templates: nuclei -update-templates
3. Scan a target: nuclei -u https://example.com
4. Filter by severity: nuclei -u https://example.com -severity critical,high

Example

# Custom Nuclei template: check for exposed .env file
id: exposed-env-file

info:
  name: Exposed .env File
  author: security-team
  severity: high
  description: Checks for publicly accessible .env files containing secrets

http:
  - method: GET
    path:
      - '{{BaseURL}}/.env'
    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'DB_PASSWORD'
          - 'API_KEY'
          - 'SECRET'
        condition: or
      - type: status
        status:
          - 200

Run: nuclei -t exposed-env.yaml -u https://target.com

Related on TokRepo

• Security tools -- Security scanning and auditing
• DevOps tools -- CI/CD security integration

Common pitfalls

• Running all templates against a production target generates heavy traffic; use rate limiting (-rl 100) and severity filters
• Some templates trigger active exploitation attempts; use -tags safe for passive-only scanning in production
• False positives occur with broad templates; validate critical findings manually before reporting