> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/bug-bounty-methodology/nuclei.md). # NUCLEI โ€“ COMPLETE CHEATSHEET ## ๐Ÿ”ฐ 1. BASIC USAGE ### Scan a single target ```bash nuclei -u https://example.com ``` ### Scan multiple targets ```bash nuclei -l targets.txt ``` ### Resume interrupted scan ```bash nuclei -resume resume.cfg ``` *** ## ๐ŸŽฏ 2. TARGET HANDLING ### Scan all IPs of a domain ```bash nuclei -u example.com -sa ``` ### Force IPv6 / IPv4 ```bash nuclei -u example.com -iv 6 ``` ### Exclude hosts ```bash nuclei -l hosts.txt -eh 127.0.0.1,internal.local ``` *** ## ๐Ÿ“‚ 3. INPUT FORMATS (ADVANCED) ### Burp / OpenAPI / Swagger ```bash nuclei -l burp.xml -im burp nuclei -l openapi.yaml -im openapi ``` ### Skip format validation ```bash nuclei -l input.yaml -sfv ``` *** ## ๐Ÿงฌ 4. TEMPLATE CONTROL ### Run specific templates ```bash nuclei -u example.com -t cves/ ``` ### Multiple template paths ```bash nuclei -u example.com -t http/ -t ssl/ ``` ### Remote templates ```bash nuclei -turl https://example.com/template.yaml ``` ### Only NEW templates ```bash nuclei -u example.com -nt ``` ### Templates from specific version ```bash nuclei -ntv v9.7.2 ``` *** ## ๐Ÿง  5. AUTOMATIC & AI MODE ### Auto scan (tech โ†’ vuln mapping) ```bash nuclei -u example.com -as ``` ### AI-generated template (๐Ÿ”ฅ) ```bash nuclei -u example.com -ai "detect exposed admin panels" ``` *** ## ๐Ÿท๏ธ 6. FILTERING (MOST IMPORTANT) ### By severity ```bash nuclei -u example.com -s high,critical ``` ### Exclude low/info ```bash nuclei -u example.com -es info,low ``` ### By tags ```bash nuclei -u example.com -tags xss,sqli ``` ### Exclude noisy tags ```bash nuclei -u example.com -etags dos,fuzz ``` ### By template ID ```bash nuclei -id CVE-2023-* ``` *** ## ๐Ÿ“ค 7. OUTPUT & REPORTING ### JSON / JSONL ```bash nuclei -u example.com -json-export out.json nuclei -u example.com -jle out.jsonl ``` ### Markdown report ```bash nuclei -u example.com -me reports/ ``` ### SARIF (for GitHub Security) ```bash nuclei -u example.com -se report.sarif ``` ### Silent mode (clean output) ```bash nuclei -u example.com -silent ``` *** ## ๐Ÿงพ 8. STORE REQUESTS / RESPONSES ```bash nuclei -u example.com -sresp ``` Custom directory: ```bash nuclei -u example.com -srd nuclei-traffic/ ``` *** ## โš™๏ธ 9. CONFIG & HEADERS ### Custom headers (Auth, Cookies) ```bash nuclei -u example.com -H "Authorization: Bearer TOKEN" ``` ### Variables ```bash nuclei -u example.com -V user=admin -V pass=admin ``` ### Follow redirects ```bash nuclei -fr ``` *** ## ๐ŸŒ 10. INTERACTSH (OAST) ### Disable OAST ```bash nuclei -ni ``` ### Self-hosted Interactsh ```bash nuclei -iserver https://oast.example.com -itoken TOKEN ``` *** ## ๐Ÿงช 11. FUZZING / DAST MODE ### Enable DAST fuzzing ```bash nuclei -u example.com -dast ``` ### Aggressive fuzzing ```bash nuclei -dast -fa high ``` ### Show fuzz points ```bash nuclei -dfp ``` *** ## ๐Ÿ” 12. UNCOVER (ASSET DISCOVERY) ### Shodan โ†’ feed into nuclei ```bash nuclei -uc -uq "ssl:\"example.com\"" -ue shodan ``` ### Limit results ```bash nuclei -ul 50 ``` *** ## ๐Ÿšฆ 13. RATE LIMIT & SPEED CONTROL ### Requests per second ```bash nuclei -rl 50 ``` ### Concurrency control ```bash nuclei -c 10 -bs 10 ``` ### Headless tuning ```bash nuclei -headc 5 -hbs 5 ``` *** ## ๐Ÿš€ 14. OPTIMIZATION FLAGS (PRO MODE) ### Stop after first match ```bash nuclei -spm ``` ### Project mode (dedup requests) ```bash nuclei -project -project-path ./nuclei-project ``` ### Stream input (huge lists) ```bash nuclei -stream ``` *** ## ๐Ÿง  15. HEADLESS SCANNING ```bash nuclei -u example.com -headless ``` Show browser: ```bash nuclei -sb ``` List actions: ```bash nuclei -lha ``` *** ## ๐Ÿž 16. DEBUGGING & DEV ### Full request/response ```bash nuclei -debug ``` ### Only requests ```bash nuclei -dreq ``` ### List DSL functions ```bash nuclei -ldf ``` ### Show loaded templates ```bash nuclei -vv ``` *** ## ๐Ÿ”„ 17. UPDATE & MAINTENANCE ```bash nuclei -up nuclei -ut ``` Reset everything: ```bash nuclei -reset ``` *** ## โ˜๏ธ 18. CLOUD (PDCP) ```bash nuclei -pd nuclei -dashboard-upload results.jsonl ``` *** ## ๐Ÿงช 19. AUTHENTICATED SCANS ```bash nuclei -sf secrets.yaml nuclei -ps ``` *** ## ๐Ÿง  20. REAL-WORLD BUG BOUNTY COMMANDS ### High-signal scan ```bash nuclei -l alive.txt -s high,critical -silent ``` ### CVE-only scan ```bash nuclei -l hosts.txt -tags cve ``` ### XSS focused ```bash nuclei -l urls.txt -tags xss -dast ``` ### Recon โ†’ exploit chain ```bash httpx -l subs.txt | nuclei -as ``` *** --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/bug-bounty-methodology/nuclei.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.