/dast-nuclei

name: dast-nuclei
description: >
  Fast, template-based vulnerability scanning using ProjectDiscovery's Nuclei with extensive community
  templates covering CVEs, OWASP Top 10, misconfigurations, and security issues across web applications,
  APIs, and infrastructure. Use when: (1) Performing rapid vulnerability scanning with automated CVE
  detection, (2) Testing for known vulnerabilities and security misconfigurations in web apps and APIs,
  (3) Running template-based security checks in CI/CD pipelines with customizable severity thresholds,
  (4) Creating custom security templates for organization-specific vulnerability patterns, (5) Scanning
  multiple targets efficiently with concurrent execution and rate limiting controls.
version: 0.1.0
maintainer: SirAppSec
category: appsec
tags: [dast, nuclei, vulnerability-scanning, cve, owasp, api-testing, automation, templates]
frameworks: [OWASP, CWE, CVE]
dependencies:
  tools: [nuclei]
  optional: [docker, git]
references:
  - https://docs.projectdiscovery.io/tools/nuclei/overview
  - https://github.com/projectdiscovery/nuclei
  - https://github.com/projectdiscovery/nuclei-templates

DAST with Nuclei

Overview

Nuclei is a fast, template-based vulnerability scanner from ProjectDiscovery that uses YAML templates to detect security vulnerabilities, misconfigurations, and exposures across web applications, APIs, networks, and cloud infrastructure. With 7,000+ community templates covering CVEs, OWASP vulnerabilities, and custom checks, Nuclei provides efficient automated security testing with minimal false positives.

Quick Start

Installation

# Install via Go
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# Or using Docker
docker pull projectdiscovery/nuclei:latest

# Update templates (automatically downloads 7000+ community templates)
nuclei -update-templates

Basic Vulnerability Scan

# Scan single target with all templates
nuclei -u https://target-app.com

# Scan with specific severity levels
nuclei -u https://target-app.com -severity critical,high

# Scan multiple targets from file
nuclei -list targets.txt -severity critical,high,medium -o results.txt

Quick CVE Scan

# Scan for specific CVEs
nuclei -u https://target-app.com -tags cve -severity critical,high

# Scan for recent CVEs
nuclei -u https://target-app.com -tags cve -severity critical -template-condition "contains(id, 'CVE-')"

Core Workflow

Workflow Checklist

Progress: [ ] 1. Install Nuclei and update templates to latest version [ ] 2. Define target scope (URLs, domains, IP ranges) [ ] 3. Select appropriate templates based on target type and risk tolerance [ ] 4. Configure scan parameters (rate limiting, severity, concurrency) [ ] 5. Execute scan with proper authentication if needed [ ] 6. Review findings, filter false positives, and verify vulnerabilities [ ] 7. Map findings to OWASP/CWE frameworks [ ] 8. Generate security report with remediation guidance

Work through each step systematically. Check off completed items.

Step 1: Template Selection and Target Scoping

Identify target applications and select relevant template categories:

# List available template categories
nuclei -tl

# List templates by tag
nuclei -tl -tags owasp
nuclei -tl -tags cve,misconfig

# Show template statistics
nuclei -tl -tags cve -severity critical | wc -l

**Template Categories:**

• **cve**: Known CVE vulnerabilities (7000+ CVE templates)
• **owasp**: OWASP Top 10 vulnerabilities
• **misconfig**: Common security misconfigurations
• **exposed-panels**: Admin panels and login pages
• **takeovers**: Subdomain takeover vulnerabilities
• **default-logins**: Default credentials
• **exposures**: Sensitive file and data exposures
• **tech**: Technology detection and fingerprinting

**Target Scoping Best Practices:**

• Create target list excluding third-party services
• Group targets by application type for focused scanning
• Define exclusions for sensitive endpoints (payment, logout, delete actions)

Step 2: Configure Scan Parameters

Set appropriate rate limiting and concurrency for target environment:

# Conservative scan (avoid overwhelming target)
nuclei -u https://target-app.com \
  -severity critical,high \
  -rate-limit 50 \
  -concurrency 10 \
  -timeout 10

# Aggressive scan (faster, higher load)
nuclei -u https://target-app.com \
  -severity critical,high,medium \
  -rate-limit 150 \
  -concurrency 25 \
  -bulk-size 25

**Parameter Guidelines:**

• **rate-limit**: Requests per second (50-150 typical, lower for production)
• **concurrency**: Parallel template execution (10-25 typical)
• **bulk-size**: Parallel host scanning (10-25 for multiple targets)
• **timeout**: Per-request timeout in seconds (10-30 typical)

For CI/CD integration patterns, see `scripts/nuclei_ci.sh`.

Step 3: Execute Targeted Scans

Run scans based on security objectives:

**Critical Vulnerability Scan:**

# Focus on critical and high severity issues
nuclei -u https://target-app.com \
  -severity critical,high \
  -tags cve,owasp \
  -o critical-findings.txt \
  -json -jsonl-export critical-findings.jsonl

**Technology-Specific Scan:**

# Scan specific technology stack
nuclei -u https://target-app.com -tags apache,nginx,wordpress,drupal

# Scan for exposed sensitive files
nuclei -u https://target-app.com -tags exposure,config

# Scan for authentication issues
nuclei -u https://target-app.com -tags auth,login,default-logins

**API Security Scan:**

# API-focused security testing
nuclei -u https://api.target.com \
  -tags api,graphql,swagger \
  -severity critical,high,medium \
  -header "Authorization: Bearer $API_TOKEN"

**Custom Template Scan:**

# Scan with organization-specific templates
nuclei -u https://target-app.com \
  -t custom-templates/ \
  -t nuclei-templates/http/cves/ \
  -severity critical,high

Step 4: Authenticated Scanning

Perfo