Ultimate Nuclei Cheat Sheet

A reference guide for the fast vulnerability scanner. Template-based scanning for everything.

Jump To Section

• Basic Syntax
• Template Management
• Target Specification
• Filtering & Tags
• Advanced Features
• Output & Automation

1. Basic Syntax

The fundamental structure of a Nuclei command.

nuclei -u [URL] -t [TEMPLATE] [options]

Essential Flags

• -u, --target [URL] : Single target
• -l, --list [FILE] : List of targets
• -t, --template [PATH] : Template path
• -o, --output [FILE] : Save results

Basic Scan

• nuclei -u https://example.com : Default scan
• nuclei -u https://example.com -t cves/ : CVE templates
• nuclei -l targets.txt : Scan from file
• nuclei -u https://example.com -t tech-detect.yaml : Single template

Pro Tip: Update Templates
Always update templates before scanning with nuclei -update-templates. New vulnerability templates are added daily by the community.

2. Template Management

Update Templates

Download latest templates from official repository.

nuclei -update-templates

List Templates

Show all available templates.

nuclei -tl

Template Categories

Run specific template category.

nuclei -u https://example.com -t cves/

Multiple Templates

Run multiple template directories.

nuclei -u https://example.com -t cves/,exposures/,vulnerabilities/

Custom Template Directory

Use custom template location.

nuclei -u https://example.com -t /path/to/custom/templates/

Validate Templates

Check templates for syntax errors.

nuclei -validate -t cves/

Template Flag	Description
-t, --template	Template path
-tl, --template-list	List all templates
-update-templates	Update template database
-validate	Validate templates
-nt, --new-templates	Run only new templates
-w, --workflows	Run workflow templates

3. Target Specification

Single URL

Scan a single target URL.

nuclei -u https://example.com -t cves/

Multiple URLs

Scan multiple URLs from file.

nuclei -l targets.txt -t cves/

CIDR Range

Scan entire IP range.

nuclei -u 192.168.1.0/24 -t network/

From Pipeline

Pipe targets from other tools.

subfinder -d example.com -silent | nuclei -t cves/

From HTTPx

Pipe live hosts from HTTPx.

httpx -l domains.txt -silent | nuclei -t cves/

Bulk Scanning

Full recon to scan pipeline.

subfinder -d example.com -silent | httpx -silent | nuclei -t cves/ -o results.txt

Pro Tip: Input Validation
Use -no-httpx flag if your targets are already validated and you want to skip the HTTP probing step for faster scanning.

4. Filtering & Tags

Filter by Severity

Run only critical severity templates.

nuclei -u https://example.com -t cves/ -severity critical

Multiple Severities

Run high and critical templates.

nuclei -u https://example.com -t cves/ -severity high,critical

Filter by Tags

Run templates with specific tags.

nuclei -u https://example.com -tags sqli,xss

Exclude Tags

Skip templates with specific tags.

nuclei -u https://example.com -exclude-tags dos,fuzz

Filter by Author

Run templates by specific author.

nuclei -u https://example.com -author pdteam

Filter by Protocol

Run only HTTP templates.

nuclei -u https://example.com -pt http

Filter Flag	Description
-severity [LEVEL]	Filter by severity
-tags [TAGS]	Filter by tags
-exclude-tags [TAGS]	Exclude tags
-author [NAME]	Filter by author
-pt [PROTOCOL]	Filter by protocol
-ptype [TYPE]	Filter by template type

Severity Levels:

info, low, medium, high, critical, unknown. Combine multiple with commas for focused scanning.

5. Advanced Features

Rate Limiting

Limit requests per second.

nuclei -u https://example.com -t cves/ -rl 100

Concurrency Control

Set number of parallel templates.

nuclei -u https://example.com -t cves/ -c 50

Timeout Configuration

Set request timeout in seconds.

nuclei -u https://example.com -t cves/ -timeout 10

Retry Failed Requests

Retry failed requests automatically.

nuclei -u https://example.com -t cves/ -retries 3

Proxy Support

Route traffic through proxy.

nuclei -u https://example.com -t cves/ -proxy http://127.0.0.1:8080

Custom Headers

Add custom headers to requests.

nuclei -u https://example.com -t cves/ -H "Authorization: Bearer TOKEN123"

Debug Mode

Show detailed debugging information.

nuclei -u https://example.com -t cves/ -debug

Advanced Flag	Description
-rl, --rate-limit [N]	Max requests per second
-c, --concurrency [N]	Parallel templates
-timeout [SEC]	Request timeout
-retries [N]	Retry failed requests
-proxy [URL]	Proxy URL
-H [HEADER]	Custom header
-debug	Debug output
-trace-log [FILE]	Trace log file

6. Output & Automation

Save Results

Export results to a file.

nuclei -u https://example.com -t cves/ -o results.txt

JSON Output

Export results in JSON format.

nuclei -u https://example.com -t cves/ -json -o results.json

JSON Lines

Export results in JSONL format.

nuclei -u https://example.com -t cves/ -jsonl -o results.jsonl

Markdown Report

Generate Markdown report.

nuclei -u https://example.com -t cves/ -me reports/

Silent Mode

Output only findings.

nuclei -u https://example.com -t cves/ -silent

No Color

Disable colored output for files.

nuclei -u https://example.com -t cves/ -no-color -o results.txt

Full Automation Pipeline

Complete scan workflow.

subfinder -d example.com -silent | httpx -silent | nuclei -t cves/ -severity high,critical -json -o results.json

Output Flag	Description
-o, --output [FILE]	Save to file
-json	JSON output format
-jsonl	JSON Lines format
-me, --markdown-export	Markdown export
-silent	Silent mode
-no-color	Disable colors
-stats	Show scan statistics
-metrics	Export metrics

Pro Tip: Stats Dashboard
Use -stats flag to display real-time statistics during scanning. Shows progress, requests per second, and findings count. Perfect for monitoring long scans.

⇧