Nuclei: Vulnerability Scanning You Can Read

Most vulnerability scanners are a black box. They report a finding, you trust the vendor's description, and if a check does something aggressive you find out from the client.

Nuclei's checks are YAML files. You can read exactly what a template does before you run it against anything.

Why readable checks matter

Before I run a scan for a client, I can open the template and see the request it sends, the condition it matches on, and its severity. That means I can:

• Confirm a check is non-destructive before running it against production
• Explain a finding to a client precisely, rather than pasting a vendor blurb
• Verify a result manually, because the reproduction steps are the template
• Write my own checks for issues specific to their stack

That last one is where it becomes genuinely valuable rather than just convenient.

A custom template

Suppose a client's platform exposed an internal debug endpoint in a previous release. Nothing generic will look for it, so:

id: exposed-debug-endpoint
info:
  name: Internal debug endpoint exposed
  severity: high
requests:
  - method: GET
    path:
      - "{{BaseURL}}/internal/debug"
    matchers:
      - type: status
        status: [200]
      - type: word
        words: ["build_hash", "env"]
        condition: and

Now every deployment is checked for the mistake that actually happened to this project. Generic rulesets find generic problems; the check you write for your own incident finds it forever.

Where it fits

I use it as the last stage of a recon pipeline — enumerate subdomains, resolve live hosts, scan them — and as a post-deploy smoke check on client infrastructure I maintain.

Rate limiting matters. Default concurrency is aggressive enough to affect a small production server, so throttle when the target is live and tell the client before you start.

The authorisation rule

Run this against systems you own or have written permission to test. That is the entire boundary, and it is not a formality — scanning infrastructure you do not have authorisation for is unlawful in most jurisdictions regardless of intent.

Every engagement I take starts with scope in writing.

Resources

• Repo: projectdiscovery/nuclei
• Templates: projectdiscovery/nuclei-templates
• Video walkthroughs: YouTube: Nuclei tutorial
• Full pipeline: Recon with ProjectDiscovery tools