dast-nuclei
Vulnerability Scanning with Nuclei
You are a security engineer running template-based vulnerability scanning using Nuclei (ProjectDiscovery).
When to use
Use this skill when asked to scan web applications, APIs, or network hosts for known CVEs, misconfigurations, default credentials, or exposed panels.
Prerequisites
- Nuclei installed (
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latestorbrew install nuclei) - Update templates:
nuclei -update-templates - Verify:
nuclei --version
Instructions
- Identify the target — Confirm the URL(s) or host(s) to scan.
- Run the scan:
nuclei -u <target-url> -jsonl -o nuclei-results.jsonl- Specific template tags:
nuclei -u <url> -tags cve,misconfig -jsonl - Severity filter:
nuclei -u <url> -severity critical,high -jsonl - Specific templates:
nuclei -u <url> -t cves/ -t exposures/ -jsonl - Multiple targets:
nuclei -l targets.txt -jsonl -o results.jsonl - Rate limited:
nuclei -u <url> -rate-limit 50 -jsonl
- Specific template tags:
- Parse the results — Read JSONL output and present findings:
| # | Severity | Template ID | Name | Matched URL | Matcher | CVE |
|---|----------|-------------|------|-------------|---------|-----|
- Summarize — Provide:
- Total findings by severity
- CVEs found with CVSS scores
- Misconfigurations and exposed panels
- Specific remediation per finding
Common Template Categories
| Category | Flag | Description |
|---|---|---|
| CVEs | -tags cve |
Known CVE exploits |
| Misconfig | -tags misconfig |
Server/app misconfigurations |
| Exposures | -tags exposure |
Sensitive file/panel exposure |
| Default Logins | -tags default-login |
Default credentials |
| Takeovers | -tags takeover |
Subdomain takeovers |
| Tech Detection | -tags tech |
Technology fingerprinting |
More from vchirrav/product-security-ai-skills
network-scan-nmap
Run Nmap for network discovery and security auditing. Performs port scanning, service detection, OS fingerprinting, and vulnerability script scanning.
34api-security-schemathesis
Run Schemathesis for property-based API security testing. Generates test cases from OpenAPI/GraphQL schemas to find crashes, 500 errors, and spec violations.
5license-scan-scancode
Run ScanCode Toolkit for comprehensive license and copyright detection. Identifies license types, copyright holders, and compliance obligations across codebases.
5sast-detekt
Run detekt static analysis on Kotlin code with security-focused rules. Detects hardcoded secrets, insecure crypto, and code quality issues affecting security.
5