Kinder
Divine
Divine
4
YEARS
4 YEARS OF SERVICE
Hidden Content
What if you could scan an entire web application for known security weaknesses without manually checking every endpoint?
There's a powerful, open-source vulnerability scanner called Nuclei, developed by ProjectDiscovery.
Instead of using a traditional graphical scanner, Nuclei uses reusable detection templates to identify known vulnerabilities, exposed services, technology fingerprints and security misconfigurations.
It supports thousands of community-maintained templates and lets you write your own custom checks.
It's free, fast, scriptable and used in penetration testing, bug bounty research and application security auditing.
WHAT CAN NUCLEI DETECT?Depending on the templates you select, Nuclei can identify:
- Known CVEs
- Vulnerable application versions
- Exposed configuration files
- Security misconfigurations
- Missing security headers
- Technology fingerprints
- Exposed administration interfaces
- Accidentally published debug endpoints
- Misconfigured cloud resources
- Potentially vulnerable services
A detection is not automatically proof that a vulnerability is exploitable. Findings must be validated.
OFFICIAL LINKSGitHub Repository:
https://github.com/projectdiscovery/nuclei
Official Releases:
https://github.com/projectdiscovery/nuclei/releases
Documentation:
https://docs.projectdiscovery.io/opensou...i/overview
Installation Guide:
https://docs.projectdiscovery.io/opensou...ei/install
Template Repository:
https://github.com/projectdiscovery/nuclei-templates
Command Reference:
https://docs.projectdiscovery.io/opensou...ei/running
STEP 1 — DOWNLOAD NUCLEIOpen:
https://github.com/projectdiscovery/nuclei/releases
Download the appropriate release archive for your operating system.
As of October 2026, the latest listed release is v3.11.1.
Nuclei supports Windows, Linux and macOS.
For Windows, download the 64-bit executable archive.
Extract it into a folder and open PowerShell inside that directory.
Check the version:
Code:
You should see the installed Nuclei version.
STEP 2 — UPDATE THE DETECTION TEMPLATESNuclei's detection capabilities depend heavily on its template collection.
Run:
Code:
This downloads or updates the official template collection.
Templates contain the requests, conditions and matching rules used to identify particular security issues.
Regular updates matter because new vulnerabilities and detection methods appear over time.
STEP 3 — UNDERSTAND THE BASIC COMMANDA typical Nuclei command looks like:
Code:
The
Code:
option specifies a target URL.However, running Nuclei without selecting templates can trigger a broad range of checks.
For this demonstration, we'll use a dedicated local test application and narrowly selected templates.
STEP 4 — CREATE YOUR OWN LOCAL TEST SERVERWe'll build a small HTTP server that deliberately returns an identifying header.
This lets us demonstrate Nuclei's detection engine without targeting somebody else's website.
Create a file named:
Code:
Paste:
Code:
Run:
Code:
Your test server is now listening at:
http://127.0.0.1:8000
The server only listens on the local loopback interface.
STEP 5 — CREATE A CUSTOM DETECTION TEMPLATENuclei templates are written in YAML.
Create a file called:
Code:
Paste:
Code:
This template tells Nuclei to:
- Send an HTTP GET request.
- Inspect the response headers.
- Search for our custom marker.
- Report the result if the marker is present.
No exploit code is involved.
STEP 6 — SCAN YOUR LOCAL SERVEROpen another PowerShell window.
From the directory containing Nuclei and the YAML file, run:
Code:
Nuclei should load your custom template and test your local server.
If everything is configured correctly, you'll see output resembling:
Code:
This is illustrative expected output, not a result from independently executing the scan.
You've just built your own automated web detection rule.
STEP 7 — UNDERSTAND SEVERITY LEVELSNuclei templates can classify findings by severity.
Typical categories include:
Code:
For example:
Info
A technology or configuration characteristic was identified.
Medium
A potentially meaningful security weakness requiring investigation.
Critical
A potentially severe issue that could present substantial risk.
Severity is assigned by the template and doesn't replace a proper assessment of the affected system.
STEP 8 — FILTER SCANS BY CATEGORYYou don't always need to use every available template.
Nuclei supports filters.
For example, on your own application:
Code:
This selects installed templates with the
Code:
tag.To select informational templates:
Code:
Be aware that these commands can invoke numerous templates.
For a controlled first exercise, using the single custom template is more predictable.
STEP 9 — SAVE RESULTS TO A FILENuclei supports structured output.
Run:
Code:
This exports results as JSON Lines.
You can process the output using scripts or import the results into other authorised security workflows.
For a simple text report:
Code:
STEP 10 — SCAN MULTIPLE AUTHORISED TARGETSNuclei accepts target lists.
Create:
Code:
Example:
Code:
These should point only to test applications that you control.
Run:
Code:
The
Code:
option reads targets from a file.This feature is useful for checking multiple applications belonging to the same organisation.
BONUS — OFFICIAL VULNERABILITY TEMPLATESProjectDiscovery maintains a public template repository:
https://github.com/projectdiscovery/nuclei-templates
It contains templates for many security checks, including CVE detections, security misconfigurations and exposed services.
You can browse individual templates to understand what requests they send and what evidence they expect.
Important: Some templates perform intrusive checks, send unusual payloads or can modify application state.
Review a template before running it, especially against production infrastructure.
BONUS #2 — CONTROL SCAN SPEEDNuclei provides rate-limiting options.
For example:
Code:
The
Code:
setting limits requests per second.Rate limits can help avoid overwhelming a test application.
For production security assessments, choose limits appropriate for the system and your authorisation.
BONUS #3 — BUILD YOUR OWN DETECTION LIBRARYThe real power of Nuclei is its template engine.
You can create detection rules for your own software.
Examples:
- Detecting an accidentally enabled debug mode
- Confirming a security header is present
- Identifying an outdated internal application version
- Checking whether a sensitive endpoint is exposed
- Confirming that a previously reported misconfiguration has been fixed
For development teams, these templates can become repeatable regression checks.
Instead of manually reviewing the same setting after every deployment, you can run the relevant template again.
BONUS #4 — USE IT WITH YOUR CI/CD PIPELINEBecause Nuclei is a command-line tool, it can be integrated into automated security checks.
A simple workflow:
Code:
For reliable CI, restrict scans to reviewed templates and explicitly defined test environments.
Avoid enabling every community template automatically in production.
IMPORTANT — SECURITY OF TEMPLATESNuclei templates are not all equally safe.
Some protocol handlers can execute powerful operations, and malicious templates may present a risk to the computer running the scanner.
ProjectDiscovery strengthened its template security controls in 2026.
Starting with Nuclei v3.11.0, custom templates using the JavaScript protocol must be digitally signed.
Unsigned JavaScript templates are skipped.
The project also introduced other security restrictions in v3.10.0.
Always use current releases and review third-party templates before executing them.
Our HTTP-only example doesn't require JavaScript execution or code-template privileges.
IMPORTANT — WHAT NUCLEI CANNOT DONuclei isn't a magical vulnerability detector.
It cannot guarantee that an application is secure.
Its results depend on:
- Template accuracy
- Target accessibility
- Authentication
- Application configuration
- Response behaviour
- Detection coverage
False positives and false negatives are possible.
A detected vulnerability still needs appropriate validation.
AUTHORISED TESTINGOnly scan systems you own or have explicit permission to assess.
Even routine automated scanning can disrupt fragile applications or violate acceptable-use rules.
The local demonstration in this guide is designed to avoid interacting with third-party infrastructure.
IS NUCLEI STILL MAINTAINED IN 2026?Yes.
As of October 2026, ProjectDiscovery's official releases page lists Nuclei v3.11.1.
The project continues to receive improvements, bug fixes and security hardening.
Its public detection-template repository also remains available.
SOURCEShttps://github.com/projectdiscovery/nuclei
https://github.com/projectdiscovery/nuclei/releases
https://github.com/projectdiscovery/nuclei-templates
https://docs.projectdiscovery.io/opensou...i/overview
https://docs.projectdiscovery.io/opensou...ei/running
Nuclei is one of the most flexible free tools for automating repeatable web-security checks.
Its biggest advantage isn't just the built-in template collection — it's the ability to build your own custom detection rules and apply them consistently across authorised applications.
WANT MORE HIGH QUALITY SHIT FOR FREE?
CLICK HERE > (MY PROFILE)
Haven't made a account yet? register here (REF LINK)
What if you could scan an entire web application for known security weaknesses without manually checking every endpoint?
There's a powerful, open-source vulnerability scanner called Nuclei, developed by ProjectDiscovery.
Instead of using a traditional graphical scanner, Nuclei uses reusable detection templates to identify known vulnerabilities, exposed services, technology fingerprints and security misconfigurations.
It supports thousands of community-maintained templates and lets you write your own custom checks.
It's free, fast, scriptable and used in penetration testing, bug bounty research and application security auditing.
WHAT CAN NUCLEI DETECT?Depending on the templates you select, Nuclei can identify:
- Known CVEs
- Vulnerable application versions
- Exposed configuration files
- Security misconfigurations
- Missing security headers
- Technology fingerprints
- Exposed administration interfaces
- Accidentally published debug endpoints
- Misconfigured cloud resources
- Potentially vulnerable services
A detection is not automatically proof that a vulnerability is exploitable. Findings must be validated.
OFFICIAL LINKSGitHub Repository:
https://github.com/projectdiscovery/nuclei
Official Releases:
https://github.com/projectdiscovery/nuclei/releases
Documentation:
https://docs.projectdiscovery.io/opensou...i/overview
Installation Guide:
https://docs.projectdiscovery.io/opensou...ei/install
Template Repository:
https://github.com/projectdiscovery/nuclei-templates
Command Reference:
https://docs.projectdiscovery.io/opensou...ei/running
STEP 1 — DOWNLOAD NUCLEIOpen:
https://github.com/projectdiscovery/nuclei/releases
Download the appropriate release archive for your operating system.
As of October 2026, the latest listed release is v3.11.1.
Nuclei supports Windows, Linux and macOS.
For Windows, download the 64-bit executable archive.
Extract it into a folder and open PowerShell inside that directory.
Check the version:
Code:
Code:
.\nuclei.exe -versionYou should see the installed Nuclei version.
STEP 2 — UPDATE THE DETECTION TEMPLATESNuclei's detection capabilities depend heavily on its template collection.
Run:
Code:
Code:
.\nuclei.exe -update-templatesThis downloads or updates the official template collection.
Templates contain the requests, conditions and matching rules used to identify particular security issues.
Regular updates matter because new vulnerabilities and detection methods appear over time.
STEP 3 — UNDERSTAND THE BASIC COMMANDA typical Nuclei command looks like:
Code:
Code:
.\nuclei.exe -u http://127.0.0.1:8000The
Code:
Code:
-uoption specifies a target URL.However, running Nuclei without selecting templates can trigger a broad range of checks.
For this demonstration, we'll use a dedicated local test application and narrowly selected templates.
STEP 4 — CREATE YOUR OWN LOCAL TEST SERVERWe'll build a small HTTP server that deliberately returns an identifying header.
This lets us demonstrate Nuclei's detection engine without targeting somebody else's website.
Create a file named:
Code:
Code:
lab_server.pyPaste:
Code:
Code:
from http.server import BaseHTTPRequestHandler, HTTPServer class Handler(BaseHTTPRequestHandler): def do_GET(self): body = b"Nuclei local security lab" self.send_response(200) self.send_header("Content-Type", "text/plain") self.send_header("X-Lab-Marker", "nuclei-demo") self.send_header("Content-Length", str(len(body))) self.end_headers() self.wfile.write(body) HTTPServer(("127.0.0.1", 8000), Handler).serve_forever()Run:
Code:
Code:
python lab_server.pyYour test server is now listening at:
http://127.0.0.1:8000
The server only listens on the local loopback interface.
STEP 5 — CREATE A CUSTOM DETECTION TEMPLATENuclei templates are written in YAML.
Create a file called:
Code:
Code:
lab-detection.yamlPaste:
Code:
Code:
id: local-lab-header info: name: Local Lab Header Detection author: practice severity: info description: Detects the header on our local lab server tags: lab,tech http: - method: GET path: - "{{BaseURL}}/" matchers: - type: word part: header words: - "X-Lab-Marker: nuclei-demo"This template tells Nuclei to:
- Send an HTTP GET request.
- Inspect the response headers.
- Search for our custom marker.
- Report the result if the marker is present.
No exploit code is involved.
STEP 6 — SCAN YOUR LOCAL SERVEROpen another PowerShell window.
From the directory containing Nuclei and the YAML file, run:
Code:
Code:
.\nuclei.exe -u http://127.0.0.1:8000 -t lab-detection.yamlNuclei should load your custom template and test your local server.
If everything is configured correctly, you'll see output resembling:
Code:
Code:
[local-lab-header] [http] [info] http://127.0.0.1:8000This is illustrative expected output, not a result from independently executing the scan.
You've just built your own automated web detection rule.
STEP 7 — UNDERSTAND SEVERITY LEVELSNuclei templates can classify findings by severity.
Typical categories include:
Code:
Code:
INFO LOW MEDIUM HIGH CRITICALFor example:
Info
A technology or configuration characteristic was identified.
Medium
A potentially meaningful security weakness requiring investigation.
Critical
A potentially severe issue that could present substantial risk.
Severity is assigned by the template and doesn't replace a proper assessment of the affected system.
STEP 8 — FILTER SCANS BY CATEGORYYou don't always need to use every available template.
Nuclei supports filters.
For example, on your own application:
Code:
Code:
.\nuclei.exe -u http://127.0.0.1:8000 -tags techThis selects installed templates with the
Code:
Code:
techtag.To select informational templates:
Code:
Code:
.\nuclei.exe -u http://127.0.0.1:8000 -severity infoBe aware that these commands can invoke numerous templates.
For a controlled first exercise, using the single custom template is more predictable.
STEP 9 — SAVE RESULTS TO A FILENuclei supports structured output.
Run:
Code:
Code:
.\nuclei.exe -u http://127.0.0.1:8000 -t lab-detection.yaml -jsonl-export findings.jsonlThis exports results as JSON Lines.
You can process the output using scripts or import the results into other authorised security workflows.
For a simple text report:
Code:
Code:
.\nuclei.exe -u http://127.0.0.1:8000 -t lab-detection.yaml -o findings.txtSTEP 10 — SCAN MULTIPLE AUTHORISED TARGETSNuclei accepts target lists.
Create:
Code:
Code:
targets.txtExample:
Code:
Code:
http://127.0.0.1:8000 http://127.0.0.1:9000These should point only to test applications that you control.
Run:
Code:
Code:
.\nuclei.exe -l targets.txt -t lab-detection.yamlThe
Code:
Code:
-loption reads targets from a file.This feature is useful for checking multiple applications belonging to the same organisation.
BONUS — OFFICIAL VULNERABILITY TEMPLATESProjectDiscovery maintains a public template repository:
https://github.com/projectdiscovery/nuclei-templates
It contains templates for many security checks, including CVE detections, security misconfigurations and exposed services.
You can browse individual templates to understand what requests they send and what evidence they expect.
Important: Some templates perform intrusive checks, send unusual payloads or can modify application state.
Review a template before running it, especially against production infrastructure.
BONUS #2 — CONTROL SCAN SPEEDNuclei provides rate-limiting options.
For example:
Code:
Code:
.\nuclei.exe -u http://127.0.0.1:8000 -t lab-detection.yaml -rl 2The
Code:
Code:
-rlsetting limits requests per second.Rate limits can help avoid overwhelming a test application.
For production security assessments, choose limits appropriate for the system and your authorisation.
BONUS #3 — BUILD YOUR OWN DETECTION LIBRARYThe real power of Nuclei is its template engine.
You can create detection rules for your own software.
Examples:
- Detecting an accidentally enabled debug mode
- Confirming a security header is present
- Identifying an outdated internal application version
- Checking whether a sensitive endpoint is exposed
- Confirming that a previously reported misconfiguration has been fixed
For development teams, these templates can become repeatable regression checks.
Instead of manually reviewing the same setting after every deployment, you can run the relevant template again.
BONUS #4 — USE IT WITH YOUR CI/CD PIPELINEBecause Nuclei is a command-line tool, it can be integrated into automated security checks.
A simple workflow:
Code:
Code:
APPLICATION DEPLOYED | v TEST ENVIRONMENT STARTS | v NUCLEI RUNS APPROVED TEMPLATES | v FINDINGS EXPORTED | v DEVELOPER REVIEWS RESULTSFor reliable CI, restrict scans to reviewed templates and explicitly defined test environments.
Avoid enabling every community template automatically in production.
IMPORTANT — SECURITY OF TEMPLATESNuclei templates are not all equally safe.
Some protocol handlers can execute powerful operations, and malicious templates may present a risk to the computer running the scanner.
ProjectDiscovery strengthened its template security controls in 2026.
Starting with Nuclei v3.11.0, custom templates using the JavaScript protocol must be digitally signed.
Unsigned JavaScript templates are skipped.
The project also introduced other security restrictions in v3.10.0.
Always use current releases and review third-party templates before executing them.
Our HTTP-only example doesn't require JavaScript execution or code-template privileges.
IMPORTANT — WHAT NUCLEI CANNOT DONuclei isn't a magical vulnerability detector.
It cannot guarantee that an application is secure.
Its results depend on:
- Template accuracy
- Target accessibility
- Authentication
- Application configuration
- Response behaviour
- Detection coverage
False positives and false negatives are possible.
A detected vulnerability still needs appropriate validation.
AUTHORISED TESTINGOnly scan systems you own or have explicit permission to assess.
Even routine automated scanning can disrupt fragile applications or violate acceptable-use rules.
The local demonstration in this guide is designed to avoid interacting with third-party infrastructure.
IS NUCLEI STILL MAINTAINED IN 2026?Yes.
As of October 2026, ProjectDiscovery's official releases page lists Nuclei v3.11.1.
The project continues to receive improvements, bug fixes and security hardening.
Its public detection-template repository also remains available.
SOURCEShttps://github.com/projectdiscovery/nuclei
https://github.com/projectdiscovery/nuclei/releases
https://github.com/projectdiscovery/nuclei-templates
https://docs.projectdiscovery.io/opensou...i/overview
https://docs.projectdiscovery.io/opensou...ei/running
Nuclei is one of the most flexible free tools for automating repeatable web-security checks.
Its biggest advantage isn't just the built-in template collection — it's the ability to build your own custom detection rules and apply them consistently across authorised applications.
WANT MORE HIGH QUALITY SHIT FOR FREE?
CLICK HERE > (MY PROFILE)
Haven't made a account yet? register here (REF LINK)
