Nuclei

Nuclei sends requests following the steps in YAML files called templates, then reads the responses to find vulnerabilities and misconfigurations. The templates live in an official template library, and if you don’t specify any, Nuclei runs most of them at once.

This review is for people who want to check their own websites and servers for known weaknesses. After reading it, you can do the following:

• Run Nuclei against the practice app OWASP Juice Shop
• Narrow down templates by severity or tag
• Limit how many requests you send and stop traffic to outside servers

##What Nuclei does

• Checks for known vulnerabilities: There are templates for individual vulnerabilities with CVE IDs.
• Checks for misconfigurations and exposures: Some templates look for information that should not be public (in the official examples, the exposures/ folder).
• Custom templates: Write the steps in YAML to build checks for your own service.
• Several protocols: Besides HTTP, there are templates for DNS, TCP, SSL, and more.

##What it sends to the target

Many templates send the same kind of request an exploit would and judge the result from the response. According to the official docs, the defaults are:

Templates that put load on the target are excluded by default. Even so, the default rate is heavy for a small server, and the target receives a large number of attack-like requests. Pointed at the wrong target, Nuclei can take a service down or be treated as an attack. That is why this review rates its impact as “high.”

OAST templates make the target connect to an outside interactsh server to confirm a result. To keep traffic from going to outside servers, add -ni.

##Try it safely against Juice Shop

1. Start Juice Shop on your own computer by following the Juice Shop review.

2. Download the zip for your operating system from the releases page and unpack it. If you have Go installed, you can also use this command:

   go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

3. Download the templates. Nuclei checks for new templates on every run and downloads them automatically when there are any. To update them manually, run:

   nuclei -update-templates

4. Scan Juice Shop with a low request rate and without outside servers:

   nuclei -u http://localhost:3000 -rl 10 -ni

5. Each finding appears on one line with the template ID, protocol, severity, and URL.

##Common options

Nuclei also runs in Docker. The container can’t see your local files, so mount a volume when you use template files or target lists.

##Cautions

##Read next

• cd ../zapZAPa web app scanner you operate through a GUI
• cd ../juice-shopOWASP Juice Shopan intentionally vulnerable web app to practice on
• cd ../nmapNmapfinds open ports on a target
• cat ~/guides/lab-setup.mdHow to set up a safe test lab