root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat nuclei.md
// web

Nuclei

21 Jul 2026 · 5 min read
webcheatsheetsnuclei
Nuclei is a template-based vulnerability scanner written in Go that drives its checks from YAML templates. Instead of hardcoding each test, you describe the request and the matcher condition in a template, which lets it fire thousands of reproducible checks against one or many targets. It is the go-to tool for verifying CVEs, exposures and misconfigurations at scale.

Nuclei's power lives in the templates, not the binary: if your repository is stale you will miss the latest CVEs, which is why -update-templates is a mandatory first step. Filtering tightly with -tags, -severity or specific directories is what separates a useful sweep from hours of noise and false positives.

1. Beginner level — scanning and filtering

NUCLEI cheat sheet — Beginner
CommandWhat it does
nuclei -u https://<t>Scan with all templates
nuclei -l urls.txtScans a list of URLs
nuclei -u https://<t> -t cves/CVE templates only
nuclei -u https://<t> -tags cve,rceFilter templates by tags
nuclei -u https://<t> -severity critical,highFilter by severity
nuclei -u https://<t> -o out.txtSave the results
nuclei -update-templatesUpdate the template repository
nuclei -u https://<t> -json -o out.jsonJSON output
nuclei -u https://<t> -t technologies/Technology fingerprinting
nuclei -u https://<t> -rl 50Requests-per-second limit
nuclei -u https://<t> -c 25Concurrency (templates in parallel)
nuclei -u https://<t> -silentShow findings only
nuclei -versionShow the version
nuclei -u https://<t> -es infoExclude the 'info' severity

2. Advanced level — DAST, proxy and chaining

NUCLEI cheat sheet — Advanced
CommandWhat it does
nuclei -l urls.txt -t cves/ -severity critical -c 50Mass sweep for critical CVEs
nuclei -u https://<t> -t custom.yamlRun a custom template
nuclei -u https://<t> -proxy http://127.0.0.1:8080Route through Burp
nuclei -u https://<t> -H 'Authorization: Bearer x'Custom headers
nuclei -u https://<t> -itags fuzzInclude tagged templates (fuzzing)
nuclei -u https://<t> -dastDAST mode (parameter fuzzing)
nuclei -u https://<t> -mc 200Filter by status code
nuclei -u https://<t> -rate-limit 10 -timeout 10Fine-tune rate and timeout
cat hosts.txt | httpx -silent | nuclei -t cves/Chain httpx + nuclei
nuclei -u https://<t> -t exposures/ -t misconfiguration/Multiple template directories
nuclei -u https://<t> -eid template-idExclude a specific template
nuclei -u https://<t> -tdShow which templates would run
nuclei -u https://<t> -store-respSave the HTTP responses
nuclei -u https://<t> -interactsh-server <srv>OOB with your own Interactsh server

3. Details people miss

  • Update the templates with -update-templates before every campaign: without them current, recent CVEs go undetected.
  • Do not fire every template at production unfiltered; scope it down with -severity, -tags or directories like cves/ to cut load and false positives.
  • The -dast mode and fuzz templates generate intrusive traffic: use them only within authorized scope, never in a default passive scan.
  • For OOB detection (SSRF, blind RCE) you need a reachable Interactsh server; on an isolated network stand up your own with -interactsh-server or you will miss those findings.
  • Tune -rl/-rate-limit and -c to the target: too much concurrency knocks over fragile servers or trips WAFs and skews your results.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.