# nuclei Cheatsheet - Cheatsheets - Launch Pad

__ _______________________ _________._________________________ \_ _____/ \______ \ / _ \ / _____/ / _____/ | | \_ _____/ | __) | _/ / /_\ \ / \ ___ / \ ___ | | | __)_ | \ | | \ / | \ \ \_\ \ \ \_\ \ | |___ | \ \___ / |____|_ / \____|__ / \______ / \______ / |_______ \ /_______ / \/ \/ \/ \/ \/ \/ \/

# nuclei Cheatsheet

← Back to cheatsheets

← Home

Nuclei is a fast, template-based vulnerability scanner by ProjectDiscovery. It uses YAML templates to define scanning logic, making it highly customizable and community-driven.

## Basic Usage

- nuclei -u <url> - Scan single URL

- nuclei -l urls.txt - Scan from file

- nuclei -u <url> -t <template> - Use specific template

## Target Options

- -u, -target - Target URL

- -l, -list - File with list of targets

- -resume - Resume scan using resume.cfg

## Template Options

- -t, -templates - Template files/directories

- -tl - List available templates

- -nt, -new-templates - Run newly added templates

- -ntv, -new-templates-version - Run templates from specific version

- -as, -automatic-scan - Automatic web scan with wappalyzer

## Filtering Templates

- -tags <tags> - Filter by tags (comma separated)

- -etags <tags> - Exclude tags

- -itags <tags> - Include only specific tags

- -s, -severity <level> - Filter by severity

- -es, -exclude-severity - Exclude severity levels

- -author <author> - Filter by author

- -type <type> - Filter by protocol type

### Severity Levels

- info - Informational
- low - Low severity
- medium - Medium severity
- high - High severity
- critical - Critical severity

## Output Options

- -o, -output - Output file

- -j, -json - JSON output

- -irr - Include request/response in output

- -nc, -no-color - Disable colors

- -silent - Silent mode (only results)

- -v, -verbose - Verbose output

- -debug - Debug output

## Rate Limiting

- -rl, -rate-limit - Requests per second (default 150)

- -rlm, -rate-limit-minute - Requests per minute

- -bs, -bulk-size - Parallel hosts (default 25)

- -c, -concurrency - Parallel templates (default 25)

## Configuration

- -config - Config file path

- -H, -header - Custom headers

- -V, -var - Custom variables key=value

- -sr, -store-resp - Store responses

- -srd, -store-resp-dir - Response storage directory

## Proxy Options

- -proxy - HTTP proxy

- -proxy-socks-url - SOCKS proxy

- -proxy-auth - Proxy authentication

## Update Options

- -update - Update nuclei

- -ut, -update-templates - Update templates

- -ud, -update-directory - Update template directory

## Common Examples

### Basic Scan

    nuclei -u https://example.com

Run all templates against target.

### Specific Template

    nuclei -u https://example.com -t cves/2021/

Run 2021 CVE templates.

### By Severity

    nuclei -u https://example.com -s critical,high

Only critical and high severity.

### By Tags

    nuclei -u https://example.com -tags cve,rce

Filter by CVE and RCE tags.

### Multiple Targets

    nuclei -l urls.txt -o results.txt

Scan list, save results.

### JSON Output

    nuclei -u https://example.com -j -o results.json

Output in JSON format.

### With Custom Headers

    nuclei -u https://example.com -H "Authorization: Bearer token"

Scan with auth header.

### Rate Limited

    nuclei -u https://example.com -rl 50

Limit to 50 requests per second.

### Automatic Scan

    nuclei -u https://example.com -as

Auto-detect technologies and scan.

### New Templates Only

    nuclei -u https://example.com -nt

Run only recently added templates.

## Common Tags

- cve - CVE vulnerabilities
- rce - Remote code execution
- lfi - Local file inclusion
- sqli - SQL injection
- xss - Cross-site scripting
- ssrf - Server-side request forgery
- exposure - Sensitive data exposure
- tech - Technology detection
- misconfig - Misconfigurations
- takeover - Subdomain takeover

## Template Locations

- ~/nuclei-templates/ - Default templates directory
- Custom templates can be specified with -t flag

## Tips

- Run -update-templates regularly for new checks

- Use -as for smart automatic scanning

- Filter by severity to focus on critical issues

- Combine with subfinder and httpx for full recon

- Write custom templates for specific checks

- Use -silent for clean output in pipelines

- Store responses with -sr for later analysis

- Part of ProjectDiscovery toolkit

- Always get authorization before scanning

← Back to cheatsheets

← Home