Skip to main content

Important Linux tools

Nuclei is a fast, customizable, and open-source vulnerability scanner designed to automate the process of detecting security issues across a wide range of systems. It is developed by ProjectDiscovery and is widely used in security testing and penetration testing activities.

Key Features of Nuclei​

  1. Speed: Nuclei is designed to perform scans rapidly, making it suitable for large-scale environments where quick vulnerability assessment is crucial.

  2. Customizability: The core of Nuclei's power lies in its templates, which are written in YAML. Users can easily create, modify, and share these templates, enabling Nuclei to be tailored to specific needs.

  3. Scalability: Nuclei can handle large lists of targets efficiently, making it ideal for scanning extensive networks and infrastructures.

  4. Automation: Nuclei can be integrated into CI/CD pipelines and other automation workflows, allowing for continuous security testing.

  5. Community-Driven: A large and active community contributes to a repository of templates, ensuring that Nuclei is constantly updated with new vulnerability checks.

  6. Wide Protocol Support: Nuclei supports various protocols including HTTP, DNS, TCP, and more, enabling it to detect vulnerabilities across different layers of the technology stack.

How Nuclei Works​

Nuclei works by executing templates that define how to detect specific vulnerabilities. These templates can be as simple as checking for a certain HTTP status code or as complex as performing multi-step authentication processes before testing for a vulnerability.

When running Nuclei, the user specifies a list of targets and the templates to be used. Nuclei then performs the scans according to the logic defined in the templates and reports back any findings.

Example Use Cases​

  1. Web Application Security Testing: Nuclei can be used to scan web applications for known vulnerabilities such as SQL injection, XSS, and other common issues.

  2. Network Security Audits: Nuclei can scan networks for misconfigurations, exposed services, and other security weaknesses.

  3. Continuous Integration/Continuous Deployment (CI/CD): Integrating Nuclei into CI/CD pipelines allows for automated security checks during the development and deployment processes.

  4. Compliance Testing: Nuclei can be used to ensure that systems comply with security standards by scanning for known vulnerabilities and misconfigurations.

Running Nuclei​

To run Nuclei, you typically use the command line, specifying the templates and targets. For example:

nuclei -t cves/ -u https://example.com

This command runs all templates in the "cves" directory against https://example.com.

Installing Nuclei​

Nuclei can be installed on Linux, macOS, and Windows. Here's a quick installation guide using go:

go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest

After installation, you can update Nuclei and its templates with:

nuclei -update
nuclei -update-templates

Nuclei Templates​

Nuclei uses YAML-based templates that define how to detect vulnerabilities. These templates are stored in the Nuclei-Templates repository, which is frequently updated with new checks.

You can browse and download the templates from the Nuclei-Templates GitHub repository.

Community and Contributions​

Nuclei has a strong community that contributes templates, documentation, and support. Users can create their own templates and share them with the community, making Nuclei a constantly evolving tool.

Conclusion​

Nuclei is a versatile and powerful tool for vulnerability scanning, providing security professionals with a fast and flexible way to identify potential issues in their systems. Whether you're performing regular security audits, integrating security into your CI/CD pipelines, or just looking for a reliable scanner, Nuclei is an excellent choice.

Nuclei-Templates Repository

Nuclei templates are YAML files that define specific vulnerability checks for the Nuclei scanner. These templates allow Nuclei to scan for a wide range of vulnerabilities, misconfigurations, and security issues by specifying the requests to be made, the expected responses, and how to determine whether a target is vulnerable.

Nuclei-Templates Repository​

The Nuclei-Templates repository is a collection of these YAML templates maintained by the Nuclei community and the developers at ProjectDiscovery. This repository contains thousands of templates that cover various vulnerabilities, including CVEs, misconfigurations, exposed services, and more.

The templates are organized into different categories, making it easy for users to select and run specific types of scans.

Categories of Nuclei Templates​

  1. CVE (Common Vulnerabilities and Exposures):

    • Templates that target known CVEs.
    • Example: cves/2021/CVE-2021-12345.yaml.

  2. Misconfigurations:

    • Templates designed to detect common security misconfigurations.
    • Example: misconfiguration/http-misconfiguration.yaml.

  3. Exposed Panels:

    • Templates that check for exposed administrative or management panels.
    • Example: panels/exposed-dashboard.yaml.

  4. Technologies:

    • Templates that identify specific technologies, frameworks, or software versions in use.
    • Example: technologies/php-detection.yaml.

  5. Default Credentials:

    • Templates that test for default credentials on various services.
    • Example: credentials/ftp-default-credentials.yaml.

  6. Security Misconfigurations:

    • Templates that focus on detecting security-related misconfigurations.
    • Example: security-misconfiguration/s3-bucket-public-access.yaml.

  7. Takeovers:

    • Templates that help in identifying subdomain or service takeover vulnerabilities.
    • Example: takeovers/subdomain-takeover.yaml.

  8. Fuzzing:

    • Templates that perform fuzzing on various inputs to discover unknown vulnerabilities.
    • Example: fuzzing/basic-fuzz.yaml.

Using Nuclei Templates​

To use the templates, you need to download or update the Nuclei templates repository. This can be done using the following command:

nuclei -update-templates

This command will download the latest templates from the official Nuclei-Templates GitHub repository and place them in your local templates directory.

You can then run Nuclei with specific templates or entire categories:

nuclei -t cves/ -u https://example.com

Or target a specific template:

nuclei -t templates/cves/2021/CVE-2021-12345.yaml -u https://example.com

Creating and Contributing Templates​

You can create your own templates by following the structure provided in the Nuclei Template Documentation. The templates are highly customizable, and once you've created one, you can contribute it back to the community by submitting a pull request to the Nuclei-Templates repository on GitHub.

Nuclei-Templates GitHub Repository​

The Nuclei-Templates repository is available on GitHub at github.com/projectdiscovery/nuclei-templates. This repository is frequently updated with new templates contributed by the community and ProjectDiscovery, ensuring that users have access to the latest and most effective vulnerability checks.

Example of a Simple Nuclei Template​

Here is an example of a simple Nuclei template that checks for a specific HTTP status code and response body content:

id: example-vuln-check

info:
  name: Example Vulnerability Check
  author: your-name
  severity: medium
  tags: example, demo

requests:
  - method: GET
    path:
      - "{{BaseURL}}/vulnerable-path"

    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "Vulnerable Response"

This template checks if the /vulnerable-path on a target URL returns a 200 HTTP status code and contains the text "Vulnerable Response".

Conclusion​

Nuclei templates are a powerful and flexible way to perform automated vulnerability scanning. By leveraging the extensive library of community-contributed templates in the Nuclei-Templates repository, you can quickly scan for a wide range of vulnerabilities, or create your own templates to suit specific needs.