Nuclei is an open-source vulnerability scanner that can help you identify vulnerabilities in web applications and services. It has a simple and flexible YAML-based syntax that allows you to define and customize your own vulnerability detection rules. In this blog, we will provide a step-by-step guide on how to use Nuclei to find vulnerabilities in web applications and services.

Step 1: Install Nuclei

The first step in using Nuclei is to install it on your system. Nuclei is written in Go, so you need to have Go installed on your system. You can download and install Go from the official Go website (https://golang.org/dl/). Once you have installed Go, open your terminal and run the following command to install Nuclei:

go get -u github.com/projectdiscovery/nuclei/v2/cmd/nuclei

Step 2: Download Templates

Nuclei uses templates to define vulnerability detection rules. Templates are YAML files that contain a set of rules that Nuclei can use to scan for vulnerabilities. You can find pre-built templates in the Nuclei templates repository (https://github.com/projectdiscovery/nuclei-templates). You can also create your own templates. To download pre-built templates, run the following command:

git clone https://github.com/projectdiscovery/nuclei-templates.git

This command will download the Nuclei templates repository to your system.

Step 3: Launch Nuclei

To launch Nuclei, open your terminal and run the following command:

nuclei -u http://www.example.com -t nuclei-templates/

Replace “http://www.example.com” with the URL of the web application or service you want to test. The “-t” flag specifies the directory where your templates are located. Nuclei will start scanning the web application or service for vulnerabilities.

Step 4: Customize Templates

You can customize templates to fit your needs. To create your own template, create a YAML file with the following format:

id: unique-template-id
info:
  name: Template name
  severity: Severity level
  description: Template description
author: Author name
tags: Tag1, Tag2, Tag3
requests:
- method: HTTP method (GET/POST/PUT/DELETE)
  path: Request path
  headers:
    Header1: Value1
    Header2: Value2
  body: Request body
  matchers:
  - type: Status code/Keyword/Regex
    part: Header/Body
    words:
    - Word1
    - Word2
  - type: ...
    part: ...
    words:
    - ...
  conditions:
  - condition: Condition1
  - condition: Condition2
  - condition: ...
  actions:
  - action: Action1
  - action: Action2
  - action: ...

Replace the placeholders with the appropriate values for your template. You can add multiple requests, matchers, conditions, and actions to your template.

Step 5: Analyze the Output

After Nuclei has finished scanning the web application or service, it will display the output in your terminal. The output will show the vulnerabilities found, their severity levels, and the template that detected them. It’s important to analyze the output carefully and prioritize the vulnerabilities based on their severity levels.

Step 6: Report the Findings

Finally, it’s essential to report the findings to the web application owner or administrator. Provide a detailed report of the vulnerabilities found, including the steps taken to exploit them. It’s important to give the web application or service owner or administrator enough information to fix the vulnerabilities. You can also provide recommendations on how to prevent similar vulnerabilities in the future.