How to use nuclei: install, run scans and write templates

What nuclei is and who it is for

Nuclei looks for security weaknesses by running small YAML templates that the community shares and maintains. Because the checks are templates rather than compiled code, new known vulnerabilities can be checked quickly once a template exists.

It is primarily built as a standalone CLI tool. It suits security engineers running community checks against their own systems, teams adding scanning to CI/CD pipelines for regression testing, penetration testers who want a scriptable scanner, and developers who want to write their own checks for internal issues.

• Not a point-and-click application: it is driven from the command line.
• Not meant to run as an always-on service, because the README warns that doing so may pose security risks.
• Reading findings and writing templates assumes familiarity with vulnerabilities.

Install nuclei with Go

Nuclei requires Go 1.27.3 or newer to install. Run the install command from the project README to fetch and build the tool. The README points to the official installation guide for other install options.

After installation, confirm the tool runs by displaying its help output.

Understand the main command line flags

Running nuclei -h lists every flag, grouped by category. The target group controls what gets scanned: -u sets target URLs or hosts, and -l reads a file with one target per line. The exclude option -eh removes hosts from the input list.

Target-format flags such as -im set the input mode, which can be list, burp, jsonl, yaml, openapi, swagger or http. Check the full flag list for template selection and output options before building a scan.

• -u: target URLs or hosts to scan
• -l: path to a file containing targets, one per line
• -eh: hosts to exclude from the input list (IP, CIDR or hostname)
• -im: mode of the input file (default list)
• -sa: scan all IPs associated with a DNS record

Run your first scan on a single target

Start with one system you own or are authorized to test. Pass its address with -u. Nuclei then runs the templates it has against that target and reports what it finds.

For several systems, put one target per line in a file and pass it with -l. Only scan targets you have permission to test.

• Use -u for one target and -l for a list.
• Keep the target list to systems you are authorized to assess.

Scan with your own custom template

Templates are YAML files, so you can write checks for internal issues and run them the same way as community templates. The nuclei documentation and the project's foundational YouTube series cover how to write a first template.

Custom templates are useful when a check is specific to your own applications. Test any new template against a system you control before relying on it.

• Templates describe the request, the matching conditions and the result in YAML.
• The README lists support for protocols including TCP, DNS, HTTP, SSL, WHOIS, JavaScript and Code.

Use nuclei in CI/CD pipelines

Teams add nuclei to CI/CD pipelines to catch known issues on each build and to run regression tests. Running it in a pipeline means the same checks run automatically instead of relying on someone remembering to scan.

Because nuclei is a command-line tool, it can be called from any pipeline step that runs a shell command. Keep the pipeline running against test or staging systems you control.