Post cover image
Photo by Maxim Ilyahov on Unsplash

June 24, 2026

Nuclei in Kali Linux: The Complete Guide from Basic to Advanced

The Day I Stopped Writing Manual Checks

By Yamini Yadav_369

10 min read

I was doing a bug bounty recon on a target with around 200 subdomains. My task was to check each one for common misconfigurations, outdated software headers, exposed admin panels, and CVE-level vulnerabilities. Manually? That would take days. Even with Burp Suite running, I would have needed to set up dozens of custom scan checks.

Then I ran one Nuclei command. In under 15 minutes, it had flagged 11 real findings across those 200 subdomains, including an exposed .git directory, two login panels with default credentials, and a Spring Boot Actuator endpoint leaking environment variables.

That was the moment I understood what Nuclei actually is and why every security engineer needs it in their toolkit.

This guide covers everything from installation to advanced usage, real examples, command explanations, and how to fit Nuclei into your actual workflow.

Section 1: What is Nuclei and How Does It Work

What is Nuclei

Nuclei is an open-source, template-based vulnerability scanner built by ProjectDiscovery. It is written in Go, which means it is fast, lightweight, and runs well even on low-resource machines.

The key idea behind Nuclei is simple: instead of a black-box scanner that guesses what to check, Nuclei uses YAML templates. Each template is a small file that says "send this request, look for this response, and if you find it, flag it as a vulnerability."

You can think of it like this: Burp Scanner is a closed engine where someone else decides what to test. Nuclei is an open engine where the community, and you, decide what to test.

How Nuclei Work Step by Step

  1. You give Nuclei a target, which can be a single URL, a list of URLs, a domain, or an IP.
  2. Nuclei loads templates from its local template library.
  3. For each template, it crafts an HTTP request (or DNS query, TCP connection, etc.) and sends it to the target.
  4. It reads the response and matches it against conditions defined in the template, such as status codes, body text, headers, or regex patterns.
  5. If the conditions match, it reports a finding with severity level, template name, and the matched response.

Everything runs in parallel across templates and targets, which is why it is so fast.

Where Nuclei are Used

Nuclei are used in several real-world scenarios:

  • Bug bounty hunting to check large scope targets quickly
  • Penetration testing for automated vulnerability detection before manual deep dives
  • Red team engagements for initial recon and quick wins
  • DevSecOps pipelines for scanning web apps before deployment
  • Attack surface monitoring for checking live assets continuously
  • CTF challenges to find low-hanging fruit fast

Section 2: Installing Nuclei in Kali Linux

Kali Linux comes with Go pre-installed. This method installs the latest version of Nuclei directly.

go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

After installation, add Go binaries to your PATH if not already added:

export PATH=$PATH:$(go env GOPATH)/bin

To make this permanent, add the line to your .bashrc or .zshrc:

echo 'export PATH=$PATH:$(go env GOPATH)/bin' >> ~/.zshrc
source ~/.zshrc

Method 2: Install via APT (Kali Package Manager)

sudo apt update
sudo apt install nuclei -y

This installs the version in Kali's repository, which may not always be the latest.

Method 3: Download Binary Directly

wget https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_amd64.zip
unzip nuclei_linux_amd64.zip
sudo mv nuclei /usr/local/bin/

Verify Installation

nuclei -version

You should see output like:

Nuclei Engine Version: v3.x.x

Download and Update Templates

Templates are the heart of Nuclei. After installation, download the full community template library:

nuclei -update-templates

This will create a folder at ~/nuclei-templates/ containing thousands of YAML templates organized by category.

To check the templates directory path:

nuclei -tl

This lists all available templates.

Section 3: Understanding the Nuclei Template Structure

Before running scans, understanding how templates work makes you a much better Nuclei user. It also lets you write your own.

Basic Template Anatomy

Here is a simple Nuclei template that detects an exposed .git directory:

id: git-config-exposure
info:
  name: Git Config Exposure
  author: pdteam
  severity: medium
  description: Detects exposed .git/config files that may leak repository info.
  tags: exposure,git,misconfig
requests:
  - method: GET
    path:
      - "{{BaseURL}}/.git/config"
    matchers:
      - type: word
        words:
          - "[core]"
        part: body

Template Fields Explained

id - A unique identifier for the template. Used for filtering and referencing.

info.name - A human-readable name shown in output.

info.severity - The severity level. Can be info, low, medium, high, or critical.

info.tags - Keywords used to filter templates when running scans.

requests.method - The HTTP method to use, such as GET, POST, PUT.

requests.path - The path to test. {{BaseURL}} is a placeholder that gets replaced with your target URL.

matchers - The conditions that must be true for the template to fire. You can match on body text, status codes, headers, response time, or regex patterns.

Matcher Types

word - Checks if specific words or strings appear in the response.

status - Checks if the HTTP status code matches a value like 200 or 403.

regex - Checks if a regex pattern matches in the response.

binary - Matches binary content in the response.

dsl - Uses a powerful domain-specific language for complex conditions.

Section 4: Basic Commands and Usage

Scan a Single URL

nuclei -u https://example.com

Explanation: -u stands for URL. This runs all default templates against a single target.

Scan a List of URLs from a File

nuclei -l targets.txt

Explanation: -l stands for list. The file should contain one URL per line. This is the most common usage in bug bounty where you have many subdomains.

Run with a Specific Template

nuclei -u https://example.com -t exposures/configs/git-config.yaml

Explanation: -t specifies a single template file to run instead of all templates.

Run with a Template Directory

nuclei -u https://example.com -t exposures/

Explanation: You can pass a folder to -t and Nuclei will run all templates inside it.

Run by Template Tags

nuclei -u https://example.com -tags cve,sqli,xss

Explanation: -tags filters templates by their tag value. This lets you run only CVE templates or only injection-related templates.

Run by Severity Level

nuclei -u https://example.com -severity high,critical

Explanation: -severity filters which templates run based on their severity. Useful when you want only high-impact findings.

Save Output to a File

nuclei -u https://example.com -o results.txt

Explanation: -o writes findings to a file. The output includes the template ID, severity, target URL, and matched response.

JSON Output Format

nuclei -u https://example.com -json -o results.json

Explanation: -json outputs each finding as a JSON object, which is easier to parse and feed into other tools or dashboards.

Increase Verbosity

nuclei -u https://example.com -v

Explanation: -v enables verbose mode, showing all requests being sent and responses being matched. Useful for debugging.

Section 5: Intermediate Commands and Options

Rate Limiting to Avoid Detection or Bans

nuclei -u https://example.com -rate-limit 50

Explanation: -rate-limit controls how many requests per second Nuclei sends. Default is 150. Lowering this is important on production targets or when you want to stay stealthy.

Controlling Concurrency

nuclei -u https://example.com -c 25

Explanation: -c sets the number of concurrent goroutines, which determines how many templates run in parallel. Default is 25. Increase for faster scans on robust targets, decrease on slow targets.

Controlling Parallel Hosts

nuclei -l targets.txt -bulk-size 10

Explanation: -bulk-size defines how many targets are scanned in parallel. Default is 25.

Timeout Settings

nuclei -u https://example.com -timeout 10

Explanation: -timeout sets the number of seconds to wait for a response before moving on. Increase this for slow targets.

Retries

nuclei -u https://example.com -retries 3

Explanation: -retries tells Nuclei how many times to retry a failed request before giving up.

Exclude Specific Templates

nuclei -u https://example.com -exclude-templates dos/

Explanation: -exclude-templates skips specific template files or folders. Useful when you want to skip DoS or aggressive templates.

Exclude by Tags

nuclei -u https://example.com -exclude-tags dos,fuzzing

Explanation: -exclude-tags skips all templates with those specific tags. This is the safest way to exclude noisy or dangerous templates.

Custom Headers

nuclei -u https://example.com -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

Explanation: -H allows you to add custom HTTP headers. Use this when testing authenticated endpoints in bug bounty programs.

Using a Proxy

nuclei -u https://example.com -proxy http://127.0.0.1:8080

Explanation: -proxy routes all Nuclei traffic through a proxy like Burp Suite. This lets you see every request and response in Burp's proxy history, which is excellent for analysis and manual follow-up.

Show Only Matching Results

nuclei -u https://example.com -silent

Explanation: -silent suppresses all output except actual findings. Useful in scripts and pipelines.

Section 6: Advanced Commands and Techniques

Scanning with Custom Templates You Write

nuclei -u https://example.com -t /home/kali/my-templates/

Explanation: You can maintain your own template library for custom application logic, private CVEs, or program-specific tests. Point -t at your directory.

Nuclei with Interactsh for Out-of-Band Testing

Interactsh is a tool by ProjectDiscovery for out-of-band interaction testing, similar to Burp Collaborator. Some Nuclei templates use Interactsh to detect blind SSRF, blind XSS, and blind command injection.

nuclei -u https://example.com -interactsh-url oast.pro

Explanation: This tells Nuclei to use the specified OOB interaction server for templates that require it.

To use the public server automatically:

nuclei -u https://example.com -oob

Workflow Files for Chained Template Execution

Nuclei supports workflow YAML files that run templates in a sequence, where one template's finding triggers another.

Example workflow file check-admin-panel.yaml:

workflows:
  - template: exposures/panels/admin-panel.yaml
    subtemplates:
      - tags: default-login

Run a workflow:

nuclei -u https://example.com -w workflows/check-admin-panel.yaml

Explanation: Workflows let you build logic such as "if an admin panel exists, then check for default credentials." This makes automated testing much smarter.

Headless Mode for JavaScript-Heavy Applications

Some targets require JavaScript execution. Nuclei supports headless mode using a real browser engine.

nuclei -u https://example.com -headless

Explanation: -headless runs templates that use headless browser protocol. These templates can interact with JavaScript-rendered pages, fill forms, and click buttons.

Template Condition Filtering with DSL

DSL matchers let you write complex logic inside templates. Here is an example condition:

matchers:
  - type: dsl
    dsl:
      - "status_code == 200 && contains(body, 'admin') && !contains(body, 'login')"

Explanation: DSL conditions use operators like &&, ||, !, and built-in functions like contains(), len(), regex(). This gives you very precise control over when a template fires.

Nuclei in Pipeline with Other Tools

A common real-world workflow chains subfinder, httpx, and nuclei together:

subfinder -d example.com -silent | httpx -silent | nuclei -t exposures/ -o results.txt

Explanation:

  • subfinder discovers all subdomains of example.com
  • httpx filters only the ones that are alive and returns their full URLs
  • nuclei runs exposure templates against all live subdomains
  • Results are saved to results.txt

This single pipeline does recon and vulnerability scanning in one shot.

Nuclei with PDCP (Cloud Dashboard)

ProjectDiscovery provides a cloud dashboard called PDCP where you can view Nuclei scan results, manage templates, and track vulnerabilities over time.

nuclei -u https://example.com -cloud-upload

Explanation: -cloud-upload sends your findings to your PDCP account for centralized tracking.

Resume a Stopped Scan

nuclei -u https://example.com -resume /path/to/resume-file.cfg

Explanation: When Nuclei is interrupted, it saves state. You can pass that resume file to continue from where it stopped.

Section 7: Writing Your Own Custom Template

Writing templates is where Nuclei becomes a real power tool. Here is a step-by-step example of a template that checks if a target is running a vulnerable version of a login panel.

You found an admin panel at /admin/login. You want to check if it has a default credential set of admin:admin123.

id: admin-default-credentials
info:
  name: Admin Panel Default Credentials
  author: yamini369
  severity: critical
  description: Tests for default admin credentials on the login panel.
  tags: default-login,auth,panel
requests:
  - method: POST
    path:
      - "{{BaseURL}}/admin/login"
    body: "username=admin&password=admin123"
    headers:
      Content-Type: application/x-www-form-urlencoded
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Welcome"
          - "Dashboard"
        condition: or
        part: body

Save this as admin-default-creds.yaml and run it:

nuclei -u https://target.com -t admin-default-creds.yaml -v

What Each Part Does

method: POST - Sends a POST request.

body - The POST body containing the credentials to test.

headers - Sets the Content-Type so the server processes the body correctly.

matchers-condition: and - Both matchers must be true for the template to fire.

First matcher checks for HTTP 200 status, meaning the login did not return an error code.

Second matcher checks for "Welcome" or "Dashboard" in the response body, meaning a successful login occurred.

Section 8: Key Template Categories in the Community Library

The Nuclei template community library is organized in folders. Here is what each contains:

cves/ - Templates for known CVEs. Organized by year such as cves/2023/ and cves/2024/.

exposures/ - Files and directories that should not be publicly accessible, such as .env files, .git folders, backup files, and configuration files.

misconfiguration/ - Weak security configurations in web servers, cloud services, and applications.

default-logins/ - Templates that test default credentials on popular software like Jenkins, Grafana, phpMyAdmin, and routers.

vulnerabilities/ - Specific vulnerability classes like SSRF, open redirect, path traversal, and XSS.

technologies/ - Templates that fingerprint what technologies are running, such as WordPress, Drupal, or Apache.

panels/ - Detects admin panels, login portals, and management interfaces.

network/ - Templates for non-HTTP protocols, including SSH banners, FTP login, and exposed Redis instances.

dns/ - DNS-related checks like zone transfer and subdomain takeover.

Section 10: Impact and Real-World Findings

Nuclei can surface findings across all severity levels. Here is what each type means in a real engagement:

Critical findings such as default credentials, RCE via CVE, and authentication bypass are immediate escalation points in a pentest report and valid submissions in bug bounty programs.

High findings such as exposed admin panels, SQL injection indicators, and sensitive file disclosure carry real business risk and typically earn medium to high bounties.

Medium findings such as misconfigured CORS, outdated software versions, and missing security headers are often used to build attack chains or demonstrate compliance gaps.

Low and Info findings such as technology fingerprinting and cookie flag issues are useful for reconnaissance and report completeness but rarely high-value in isolation.

Section 11: Mitigation Guidance

If Nuclei finds vulnerabilities on your own infrastructure during an internal pentest or security audit, here is what to fix:

For exposed files and directories, configure your web server to deny access to paths like .git, .env, and backup folders. Use .htaccess rules on Apache or location blocks in Nginx.

For default credentials, enforce credential rotation on first login and remove default accounts from production deployments.

For CVE-based findings, patch or upgrade the affected software version. Apply vendor patches immediately for critical CVEs.

For misconfigured security headers, add headers like X-Frame-Options, Content-Security-Policy, and Strict-Transport-Security at the web server or application level.

For exposed admin panels, restrict access using IP allowlisting or VPN-only access rules.

Nuclei is not just a scanner. It is a framework for template-driven security testing that scales from a single URL to thousands of assets in one command. It is fast because of Go's concurrency model. It is smart because templates define exactly what to test and what to match. It is extensible because anyone can write and share templates.

If you are doing bug bounty, start by chaining subfinder, httpx, and nuclei together on every new scope you pick up. If you are doing pentesting, add Nuclei to your initial recon phase before deep manual testing. If you are in a DevSecOps role, integrate nuclei into your CI/CD pipeline as an automated gate.

The more you use it, the more you will start writing your own templates for application-specific logic, and that is when the real power kicks in.

nuclei kali-linux vulnerability-scanner penetration-testing bug-bounty web-security open-source-security owasp security-tools ethical-hacking