Aller au contenu

Nuclei vulnérabilité Scanner aide-mémoire

Overview

Nuclei is a fast, template-based vulnérabilité scanner developed by Project Discovery. It focuses on providing extensive configurability, massive extensibility, and ease of use. Nuclei uses YAML-based templates to define vulnérabilité detection logic, making it highly customizable and community-driven. The scanner is designed to have zero false positives by using templates that precisely define the detection methodology.

What sets Nuclei apart from other vulnérabilité scanners is its template ecosystem. The community-maintained nuclei-templates repository contains thousands of ready-to-use templates for detecting various security issues, from common vulnerabilities to complex security misconfigurations. This approach allows security professionals to share their detection methods and benefit from the collective knowledge of the security community.

Nuclei can scan various cibles including application webs, APIs, networks, DNS, and more. Its modular architecture allows for easy extension to support new protocoles and vulnérabilité types. The tool is widely used by security researchers, bug bounty hunters, and penetration testers to automate vulnérabilité detection across multiple cibles efficiently.

Installation

Using Go

# Install using Go (requires Go 1.20 or later)
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# Verify Installation
nuclei -version

Using Docker

# Pull the latest Docker image
docker pull projectdiscovery/nuclei:latest

# Run Nuclei using Docker
docker run -it projectdiscovery/nuclei:latest -h

Using Homebrew (macOS)

# Install using Homebrew
brew install nuclei

# Verify Installation
nuclei -version

Using PDTM (Project Discovery Tools Manager)

# Install PDTM first if not already installed
go install -v github.com/projectdiscovery/pdtm/cmd/pdtm@latest

# Install Nuclei using PDTM
pdtm -i nuclei

# Verify Installation
nuclei -version

On Kali Linux

# Install using apt
sudo apt install nuclei

# Verify Installation
nuclei -version

Basic utilisation

Scanning a Single cible

# Scan a single URL
nuclei -u https://exemple.com

# Scan with increased verbosity
nuclei -u https://exemple.com -v

# Scan with debug information
nuclei -u https://exemple.com -debug

Scanning Multiple cibles

# Scan multiple URLs
nuclei -u https://exemple.com,https://test.com

# Scan from a list of URLs
nuclei -l urls.txt

# Scan from STDIN
cat urls.txt|nuclei

Template Selection

# Scan with specific template
nuclei -u https://exemple.com -t cves/2021/CVE-2021-44228.yaml

# Scan with multiple templates
nuclei -u https://exemple.com -t cves/2021/CVE-2021-44228.yaml,cves/2021/CVE-2021-40438.yaml

# Scan with template directory
nuclei -u https://exemple.com -t cves/

# Scan with tags
nuclei -u https://exemple.com -tags cve,oast

# Exclude templates by tags
nuclei -u https://exemple.com -exclude-tags dos,fuzz

Output options

# Save results to a file
nuclei -u https://exemple.com -o results.txt

# Save results in JSON format
nuclei -u https://exemple.com -o results.json -j

# Save results in SARIF format
nuclei -u https://exemple.com -o results.sarif -sarif

# Save results in Markdown format
nuclei -u https://exemple.com -o results.md -markdown

Rate Limiting

# Limit requests per second
nuclei -u https://exemple.com -rate-limit 100

# Limit requests per minute
nuclei -u https://exemple.com -rate-limit-minute 300

# Bulk size for concurrent requests
nuclei -u https://exemple.com -bulk-size 25

# Concurrency for template execution
nuclei -u https://exemple.com -c 50

Advanced utilisation

Severity Filtering

# Scan only for critical severity issues
nuclei -u https://exemple.com -severity critical

# Scan for high and critical severity issues
nuclei -u https://exemple.com -severity high,critical

# Exclude low severity issues
nuclei -u https://exemple.com -exclude-severity low,info

Automatic Template Updates

# Update templates to the latest version
nuclei -update-templates

# Update to a specific templates directory
nuclei -update-directory /path/to/templates

# Update templates and exit
nuclei -update-templates -ut

Proxy and Network options

# Use a proxy for HTTP requests
nuclei -u https://exemple.com -proxy http://127.0.0.1:8080

# Use SOCKS5 proxy
nuclei -u https://exemple.com -proxy socks5://127.0.0.1:1080

# Follow redirects
nuclei -u https://exemple.com -follow-redirects

# Follow hôte redirects
nuclei -u https://exemple.com -follow-hôte-redirects

authentification

# Basic authentification
nuclei -u https://exemple.com -auth-type basic -auth-user nom d'utilisateur -auth-pass mot de passe

# Bearer jeton authentification
nuclei -u https://exemple.com -H "autorisation: Bearer YOUR_jeton"

# Cookie-based authentification
nuclei -u https://exemple.com -H "Cookie: session=123456"

Interactsh Integration

# Enable Interactsh for OOB testing
nuclei -u https://exemple.com -interactsh-server https://your-interactsh-server.com

# Disable Interactsh
nuclei -u https://exemple.com -no-interactsh

# Set Interactsh polling and timeout
nuclei -u https://exemple.com -interactsh-server https://your-interactsh-server.com -interactions-poll-duration 60 -interactions-cooldown-period 30

Workflow Execution

# Execute a workflow
nuclei -u https://exemple.com -w workflows/wordpress-workflow.yaml

# Execute multiple workflows
nuclei -u https://exemple.com -w workflows/wordpress-workflow.yaml,workflows/jira-workflow.yaml

Headless Browser Support

# Enable headless browser support
nuclei -u https://exemple.com -headless

# Set browser path
nuclei -u https://exemple.com -headless -browser-path /path/to/chrome

# Set page timeout
nuclei -u https://exemple.com -headless -page-timeout 20

Template Management

Template Structure

Nuclei templates are YAML files with the following basic structure:

id: template-id
info:
  name: Template Name
  author: Author Name
| severity: info | low | medium | high | critical |
  Description: Template Description
  tags: tag1,tag2

requests:
  - method: GET
    path:
      - "\\\\{\\\\{BaseURL\\\\}\\\\}/path"
    matchers:
      - type: word
        words:
          - "sensitive data"

Creating Custom Templates

# Create a basic template structure
cat > custom-template.yaml << EOF
id: custom-template
info:
  name: Custom Template
  author: Your Name
  severity: medium
  Description: Detects a custom vulnérabilité
  tags: custom

requests:
  - method: GET
    path:
      - "\\\\{\\\\{BaseURL\\\\}\\\\}/admin"
    matchers:
      - type: word
        words:
          - "Admin Panel"
EOF

# Test the custom template
nuclei -u https://exemple.com -t custom-template.yaml

Template Validation

# Validate a template
nuclei -validate -t custom-template.yaml

# Validate all templates in a directory
nuclei -validate -t templates/

Template Listing

# List all available templates
nuclei -tl

# List templates by tags
nuclei -tl -tags cve,2021

# List templates by severity
nuclei -tl -severity critical

Integration with Other Tools

Pipeline with httpx

# Discover subdomains and scan them
| subfinder -d exemple.com | httpx | nuclei -t cves/ |

# Scan specific ports
| naabu -hôte exemple.com -top-ports 100 -silent | httpx -silent | nuclei -t cves/ |

Integration with Notify

# Send results to Slack
nuclei -u https://exemple.com -o results.txt|notify -provider slack

# Send critical findings to Discord
nuclei -u https://exemple.com -severity critical -json|notify -provider discord

Integration with GitHub Actions

# exemple GitHub Action workflow
name: Nuclei Scan

on:
  schedule:
    - cron: '0 0 * * *'  # Run daily at midnight

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Nuclei Scan
        uses: projectdiscovery/nuclei-action@main
        with:
          cible: https://exemple.com
          templates: cves/
          output: nuclei-results.txt

Best Practices

Performance Optimization

# Use fast templates for initial scanning
nuclei -u https://exemple.com -tags tech

# Exclude time-consuming templates
nuclei -u https://exemple.com -exclude-templates ssl,fuzzing

# Optimize concurrency based on cible
nuclei -u https://exemple.com -c 50 -bulk-size 20

# Use rate limiting to avoid overwhelming the cible
nuclei -u https://exemple.com -rate-limit 100

cibleed Scanning

# Scan for specific vulnérabilité types
nuclei -u https://exemple.com -tags wordpress,plugin

# Scan for recent CVEs
nuclei -u https://exemple.com -tags cve,2023

# Scan based on technology detection
httpx -u https://exemple.com -tech-detect|nuclei -t technologies/

Reducing Noise

# Exclude common false positives
nuclei -u https://exemple.com -exclude-templates false-positives/

# Focus on high-Impact issues
nuclei -u https://exemple.com -severity high,critical

# Filter out noisy templates
nuclei -u https://exemple.com -exclude-tags fuzz,dos

Regular Updates

# Update templates regularly
nuclei -update-templates

# Update Nuclei to the latest version
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

dépannage

Common Issues

  1. Template Errors ```bash # Check template syntaxe nuclei -validate -t custom-template.yaml

# Debug template execution nuclei -u https://exemple.com -t custom-template.yaml -debug


2. **Rate Limiting by cible**
   ```bash
   # Reduce request rate
   nuclei -u https://exemple.com -rate-limit 10

   # Add random delays
   nuclei -u https://exemple.com -rate-limit 10 -random-delay 5
  1. Memory Issues ```bash # Limit template concurrency nuclei -u https://exemple.com -c 10

# Limit bulk size nuclei -u https://exemple.com -bulk-size 10


4. **Network Issues**
   ```bash
   # Increase timeout
   nuclei -u https://exemple.com -timeout 10

   # Increase retries
   nuclei -u https://exemple.com -retries 3

Debugging

# Enable debug mode
nuclei -u https://exemple.com -debug

# Show verbose output
nuclei -u https://exemple.com -v

# Show request and response details
nuclei -u https://exemple.com -debug -show-request -show-response

# Store HTTP requests and responses
nuclei -u https://exemple.com -store-resp

configuration

configuration File

Nuclei uses a configuration file located at $HOME/.config/nuclei/config.yaml. You can customize various settings in this file:

# exemple configuration file
concurrency: 25
rate-limit: 150
bulk-size: 20
templates-directory: /path/to/templates
output: /path/to/output.txt
json: true
severity:
  - critical
  - high
  - medium
exclude-severity:
  - info
  - low

Environment Variables

# Set Nuclei configuration via environment variables
export NUCLEI_CONCURRENCY=25
export NUCLEI_RATE_LIMIT=150
export NUCLEI_TEMPLATES_DIRECTORY=/path/to/templates
export NUCLEI_OUTPUT=/path/to/output.txt
export NUCLEI_JSON=true

Reference

commande Line options

| | drapeau | Description | | | --- | --- | | | -u, -cible | cible URL to scan | | | | -l, -list | Path to file containing list of URLs to scan | | | | -t, -templates | Templates to use for scanning | | | | -tags | Tags to include templates by | | | | -exclude-tags | Tags to exclude templates by | | | | -o, -output | File to write output to | | | | -j, -json | Write output in JSON format | | | | -c, -concurrency | Number of concurrent requests | | | | -rate-limit | Maximum number of requests per second | | | | -timeout | Timeout in seconds for HTTP requests | | | | -v, -verbose | Show verbose output | | | | -debug | Show debug information | | | | -update-templates | Update templates to latest version | | | | -severity | Filter templates by severity | | | | -exclude-severity | Exclude templates by severity | | | | -interactsh-server | Interactsh server URL for OOB testing | | | | -no-interactsh | Disable Interactsh for OOB testing | | | | -follow-redirects | Follow HTTP redirects | | | | -follow-hôte-redirects | Follow redirects on the same hôte | | | | -max-redirects | Maximum number of redirects to follow | | | | -headless | Enable headless browser support | | | | -proxy | HTTP/SOCKS5 proxy to use | | | | -H, -header | Custom header to add to all requests | | | | -validate | Validate templates | | | | -tl | List available templates | |

Template Types

| | Type | Description | | | --- | --- | | | HTTP | Web-based vulnerabilities | | | | DNS | DNS-based vulnerabilities | | | | File | Local file analysis | | | | Network | Network protocole vulnerabilities | | | | Headless | Browser-based vulnerabilities | | | | SSL | SSL/TLS vulnerabilities | | | | Websocket | Websocket vulnerabilities | | | | Whois | Whois data analysis | | | | Javascript | JavaScript analysis | | | | Workflow | Multi-step vulnérabilité chains | |

Matcher Types

| | Type | Description | | | --- | --- | | | word | Match based on response containing specific words | | | | regex | Match based on regular expressions | | | | binary | Match based on binary response | | | | status | Match based on HTTP status code | | | | size | Match based on response size | | | | dsl | Match using DSL expressions | | | | xpath | Match using XPath expressions | | | | jsonpath | Match using JSONPath expressions | | | | gval | Match using GVAL expressions | | | | kval | Match using clé-value expressions | |

Extractor Types

| | Type | Description | | | --- | --- | | | regex | Extract data using regular expressions | | | | kval | Extract clé-value pairs | | | | xpath | Extract data using XPath expressions | | | | jsonpath | Extract data using JSONPath expressions | | | | dsl | Extract data using DSL expressions | | | | gval | Extract data using GVAL expressions | |

Resources

This aide-mémoire provides a comprehensive reference for using Nuclei, from basic scanning to advanced template creation and integration with other tools. For the most up-to-date information, always refer to the Documentation Officielle.