Nuclei

nuclei

Nuclei is a modern, high-performance vulnerability scanner that uses simple YAML-based templates. It helps design custom vulnerability detection scenarios that mimic real-world conditions, reducing false positives by verifying vulnerabilities with realistic steps.

Use this reference when constructing or reviewing nuclei commands. The flags below are expanded from nuclei -h.

Capabilities

• Simple YAML format for creating and customizing vulnerability templates.
• Community-contributed templates for trending vulnerabilities.
• Real-world verification flows to reduce false positives.
• Ultra-fast parallel scan processing and request clustering.
• CI/CD integration for vulnerability detection and regression testing.
• Multiple protocol support, including TCP, DNS, HTTP, SSL, WHOIS, JavaScript, Code, and more.
• Integrations with Jira, Splunk, GitHub, Elastic, GitLab, ProjectDiscovery Cloud, APIs, and webhooks.

Table of Contents

• Get Started
• Installation
• Command Line Flags
• Common Command Combinations
• Single Target Scan
• Scanning Multiple Targets
• Network Scan
• Scanning With a Custom Template
• Connect Nuclei to ProjectDiscovery
• Nuclei Templates and Community
• Template Use Cases

Get Started

Install Nuclei locally for CLI scanning, or use the ProjectDiscovery cloud tier to store and visualize findings, manage templates, access the latest nuclei templates, and discover/store targets.

Important notes:

• Nuclei is in active development. Review release changelogs before updating because breaking changes can occur.
• Nuclei is primarily built as a standalone CLI tool. Running it as a service can introduce security risks and should be done with additional controls.
• Pro and Enterprise editions are available for teams that need large-scale scans, cloud integrations, Jira/Slack/Linear/API/webhook workflows, executive and compliance reporting, SAML SSO, SOC 2 compliance, regional hosting, and shared workspaces.

Installation

Nuclei requires Go >= 1.24.2 for source installation:

go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

Installation docs:

Usage

nuclei [flags]
./nuclei [flags]

Common Command Combinations

Quick, findings-only scan:

nuclei -u https://example.com -silent

High-signal scan for serious findings:

nuclei -u https://example.com -severity high,critical -silent

Scan a target list and write JSONL output:

nuclei -l urls.txt -jsonl -o nuclei_findings.jsonl

Scan only selected tags:

nuclei -u https://example.com -tags cve,exposure,misconfig

Exclude noisy severities or tags:

nuclei -l urls.txt -es info,low -etags intrusive,dos

Run specific template paths:

nuclei -u https://example.com -t http/cves/ -t ssl/

Run a specific template ID or wildcard:

nuclei -u https://example.com -id cves/2021/CVE-2021-44228
nuclei -u https://example.com -id '*jenkins*'

Use authenticated headers:

nuclei -u https://example.com -H 'Authorization: Bearer ' -H 'Cookie: session='

Use variables consumed by templates:

nuclei -u https://example.com -V username=admin -V password=''

Throttle scans for fragile or shared environments:

nuclei -l urls.txt -rl 20 -c 10 -bs 10 -timeout 15 -retries 2

Route traffic through a proxy:

nuclei -u https://example.com -proxy http://127.0.0.1:8080

Store evidence and redact sensitive keys:

nuclei -u https://example.com -jsonl -o findings.jsonl -sresp -srd nuclei_evidence -rd token,authorization,cookie

Export reports:

nuclei -l urls.txt -me nuclei_report/
nuclei -l urls.txt -se nuclei.sarif
nuclei -l urls.txt -je nuclei.json

Upload findings to ProjectDiscovery Cloud dashboard:

nuclei -l urls.txt -dashboard

Update engine and templates:

nuclei -update
nuclei -update-templates

Validate custom templates before running:

nuclei -validate -t /path/to/templates/

Use DAST fuzzing templates with a scoped target:

nuclei -u https://example.com -dast -fuzz-scope '^https://example\.com/' -fa low

Target

| Flag | Description | | --- | --- | | -u, -target string[] | Target URLs/hosts to scan. | | -l, -list string | Path to file containing target URLs/hosts to scan, one per line. | | -eh, -exclude-hosts string[] | Hosts to exclude from the input list: IP, CIDR, hostname. | | -resume string | Resume scan from and save to the specified file. Clustering is disabled. | | -sa, -scan-all-ips | Scan all IPs associated with a DNS record. | | -iv, -ip-version string[] | IP version to scan for hostname: 4, 6. Default: 4. |

Target Format

| Flag | Description | | --- | --- | | -im, -input-mode string | Input file mode: list, burp, jsonl, yaml, openapi, swagger. Default: list. | | -ro, -required-only | Use only required fields in input format when generating requests. | | -sfv, -skip-format-validation | Skip format validation, such as missing vars, when parsing input file. |

Templates

| Flag | Description | | --- | --- | | -nt, -new-templates | Run only new templates added in the latest nuclei-templates release. | | -ntv, -new-templates-version string[] | Run new templates added in a specific version. | | -as, -automatic-scan | Automatic web scan using Wappalyzer technology detection to tags mapping. | | -t, -templates string[] | Template file or directory to run. Supports comma-separated values and file input. | | -turl, -template-url string[] | Template URL or list containing template URLs to run. Supports comma-separated values and file input. | | -ai, -prompt string | Generate and run a template using an AI prompt. | | -w, -workflows string[] | Workflow file or directory to run. Supports comma-separated values and file input. | | -wurl, -workflow-url string[] | Workflow URL or list containing workflow URLs to run. Supports comma-separated values and file input. | | -validate | Validate the passed templates. | | -nss, -no-strict-syntax | Disable strict syntax check on templates. | | -td, -template-display | Display template content. | | -tl | List all templates matching current filters. | | -tgl | List all available tags. | | -sign | Sign templates with private key from NUCLEI_SIGNATURE_PRIVATE_KEY. | | -code | Enable loading code protocol-based templates. | | -dut, -disable-unsigned-templates | Disable running unsigned templates or templates with mismatched signature. | | -esc, -enable-self-contained | Enable loading self-contained templates. | | -egm, -enable-global-matchers | Enable loading global matchers templates. | | -file | Enable loading file templates. |

Filtering

| Flag | Description | | --- | --- | | -a, -author string[] | Run templates by author. Supports comma-separated values and file input. | | -tags string[] | Run templates by tags. Supports comma-separated values and file input. | | -etags, -exclude-tags string[] | Exclude templates by tags. Supports comma-separated values and file input. | | -itags, -include-tags string[] | Execute tags even if they are excluded by default or configuration. | | -id, -template-id string[] | Run templates by template IDs. Supports comma-separated values, file input, and wildcards. | | -eid, -exclude-id string[] | Exclude templates by template IDs. Supports comma-separated values and file input. | | -it, -include-templates string[] | Template file or directory to execute even if excluded by default or configuration. | | -et, -exclude-templates string[] | Template file or directory to exclude. Supports comma-separated values and file input. | | -em, -exclude-matchers string[] | Template matchers to exclude in results. | | -s, -severity value[] | Run templates by severity: info, low, medium, high, critical, unknown. | | -es, -exclude-severity value[] | Exclude templates by severity: info, low, medium, high, critical, unknown. | | -pt, -type value[] | Run templates by protocol type: dns, file, http, headless, tcp, workflow, ssl, websocket, whois, code, javascript. | | -ept, -exclude-type value[] | Exclude templates by protocol type: dns, file, http, headless, tcp, workflow, ssl, websocket, whois, code, javascript. | | -tc, -template-condition string[] | Run templates by expression condition. |

Output

| Flag | Description | | --- | --- | | -o, -output string | Output file to write found issues/vulnerabilities. | | -sresp, -store-resp | Store all requests/responses passed through nuclei to output directory. | | -srd, -store-resp-dir string | Store all requests/responses to a custom directory. Default: output. | | -silent | Display findings only. | | -nc, -no-color | Disable ANSI color output. | | -j, -jsonl | Write output in JSON Lines format. | | -irr, -include-rr -omit-raw | Include request/response pairs in JSON, JSONL, and Markdown outputs for findings only. Deprecated; use -omit-raw. Default: true. | | -or, -omit-raw | Omit request/response pairs in JSON, JSONL, and Markdown outputs for findings only. | | -ot, -omit-template | Omit encoded template in JSON and JSONL output. | | -nm, -no-meta | Disable printing result metadata in CLI output. | | -ts, -timestamp | Enable printing timestamp in CLI output. | | -rdb, -report-db string | Nuclei reporting database. Always use this to persist report data. | | -ms, -matcher-status | Display match failure status. | | -me, -markdown-export string | Directory to export results in Markdown format. | | -se, -sarif-export string | File to export results in SARIF format. | | -je, -json-export string | File to export results in JSON format. | | -jle, -jsonl-export string | File to export results in JSON Lines format. | | -rd, -redact string[] | Redact keys from query parameters, request headers, and body. |

Configurations

| Flag | Description | | --- | --- | | -config string | Path to nuclei configuration file. | | -tp, -profile string | Template profile config file to run. | | -tpl, -profile-list | List community template profiles. | | -fr, -follow-redirects | Enable following redirects for HTTP templates. | | -fhr, -follow-host-redirects | Follow redirects on the same host. | | -mr, -max-redirects int | Maximum redirects to follow for HTTP templates. Default: 10. | | -dr, -disable-redirects | Disable redirects for HTTP templates. | | -rc, -report-config string | Nuclei reporting module configuration file. | | -H, -header string[] | Custom header/cookie for all HTTP requests in header:value format. Supports CLI and file input. | | -V, -var value | Custom vars in key=value format. | | -r, -resolvers string | File containing resolver list for nuclei. | | -sr, -system-resolvers | Use system DNS resolving as error fallback. | | -dc, -disable-clustering | Disable request clustering. | | -passive | Enable passive HTTP response processing mode. | | -fh2, -force-http2 | Force HTTP/2 connection on requests. | | -ev, -env-vars | Enable environment variables in templates. | | -cc, -client-cert string | PEM client certificate file for authenticating against scanned hosts. | | -ck, -client-key string | PEM client key file for authenticating against scanned hosts. | | -ca, -client-ca string | PEM client certificate authority file for authenticating against scanned hosts. | | -sml, -show-match-line | Show match lines for file templates. Works with extractors only. | | -ztls | Use ztls library with autofallback to standard one for TLS 1.3. Deprecated; autofallback to ztls is enabled by default. | | -sni string | TLS SNI hostname to use. Default: input domain name. | | -dka, -dialer-keep-alive value | Keep-alive duration for network requests. | | -lfa, -allow-local-file-access | Allow file payload access anywhere on the system. | | -lna, -restrict-local-network-access | Block connections to local/private networks. | | -i, -interface string | Network interface to use for network scan. | | -at, -attack-type string | Payload combination type: batteringram, pitchfork, clusterbomb. | | -sip, -source-ip string | Source IP address to use for network scan. | | -rsr, -response-size-read int | Maximum response size to read, in bytes. | | -rss, -response-size-save int | Maximum response size to save, in bytes. Default: 1048576. | | -reset | Remove all nuclei configuration and data files, including nuclei-templates. | | -tlsi, -tls-impersonate | Enable experimental ClientHello/JA3 TLS randomization. | | -hae, -http-api-endpoint string | Experimental HTTP API endpoint. |

Interactsh

| Flag | Description | | --- | --- | | -iserver, -interactsh-server string | Interactsh server URL for self-hosted instance. Default: oast.pro,oast.live,oast.site,oast.online,oast.fun,oast.me. | | -itoken, -interactsh-token string | Authentication token for self-hosted Interactsh server. | | -interactions-cache-size int | Number of requests to keep in the interactions cache. Default: 5000. | | -interactions-eviction int | Seconds to wait before evicting requests from cache. Default: 60. | | -interactions-poll-duration int | Seconds to wait before each interaction poll request. Default: 5. | | -interactions-cooldown-period int | Extra time for interaction polling before exiting. Default: 5. | | -ni, -no-interactsh | Disable Interactsh server for OAST testing and exclude OAST-based templates. |

Fuzzing

| Flag | Description | | --- | --- | | -ft, -fuzzing-type string | Override fuzzing type set in template: replace, prefix, postfix, infix. | | -fm, -fuzzing-mode string | Override fuzzing mode set in template: multiple, single. | | -fuzz | Enable loading fuzzing templates. Deprecated; use -dast. | | -dast | Enable/run DAST fuzz templates. | | -dts, -dast-server | Enable DAST server mode for live fuzzing. | | -dtr, -dast-report | Write DAST scan report to file. | | -dtst, -dast-server-token string | DAST server token. Optional. | | -dtsa, -dast-server-address string | DAST server address. Default: localhost:9055. | | -dfp, -display-fuzz-points | Display fuzz points in output for debugging. | | -fuzz-param-frequency int | Frequency of uninteresting parameters before skipping. Default: 10. | | -fa, -fuzz-aggression string | Fuzzing aggression level controlling payload count: low, medium, high. Default: low. | | -cs, -fuzz-scope string[] | In-scope URL regex followed by the fuzzer. | | -cos, -fuzz-out-scope string[] | Out-of-scope URL regex excluded by the fuzzer. |

Uncover

| Flag | Description | | --- | --- | | -uc, -uncover | Enable uncover engine. | | -uq, -uncover-query string[] | Uncover search query. | | -ue, -uncover-engine string[] | Uncover search engine: shodan, censys, fofa, shodan-idb, quake, hunter, zoomeye, netlas, criminalip, publicwww, hunterhow, google. Default: shodan. | | -uf, -uncover-field string | Fields to return: ip, port, host. Default: ip:port. | | -ul, -uncover-limit int | Number of uncover results to return. Default: 100. | | -ur, -uncover-ratelimit int | Override rate limit of engines with unknown rate limit. Default: 60 req/min. |

Rate Limit

| Flag | Description | | --- | --- | | -rl, -rate-limit int | Maximum requests per second. Default: 150. | | -rld, -rate-limit-duration value | Rate-limit duration window. Default: 1s. | | -rlm, -rate-limit-minute int | Maximum requests per minute. Deprecated. | | -bs, -bulk-size int | Maximum hosts analyzed in parall

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: MingyiSecLab
• Source: MingyiSecLab/Mingyi-Atlas
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.