Nuclei
FeaturedMIT⚡ Vulnerability Scanning · Go
Nuclei is a fast, customizable vulnerability scanner based on YAML templates. It allows scanning for vulnerabilities, misconfigurations, exposed panels, and more across multiple protocols including HTTP, DNS, TCP, SSL, and JavaScript. The community maintains thousands of detection templates covering CVEs, default credentials, exposed APIs, and technology fingerprints. Nuclei's template system makes it easy to write custom checks and share them with the community.
Installation
go install
$ go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latestbrew (macOS)
$ brew install nucleidocker
$ docker pull projectdiscovery/nucleiUse Cases
- Automated vulnerability scanning with YAML templates
- CVE detection across web applications
- Misconfiguration and exposure detection
- Custom security checks for CI/CD pipelines
- Bug bounty hunting at scale
Tags
Details
- Category
- ⚡ Vulnerability Scanning
- Language
- Go
- Repository
- projectdiscovery/nuclei
- License
- MIT
- Platforms
- 🐧linux🍎macos🪟windows
Links
GitHub Repository
github.com/projectdiscovery/nuclei
Official Website
docs.projectdiscovery.io/tools/nuclei
Documentation
docs.projectdiscovery.io/tools/nuclei/overview
Download
github.com/projectdiscovery/nuclei/releases
Releases
github.com/projectdiscovery/nuclei/releases
Issues
github.com/projectdiscovery/nuclei/issues
Alternatives & Comparisons
More in Vulnerability Scanning
sqlmap
PythonAutomatic SQL injection and database takeover tool. Detects and exploits SQL injection flaws.
WPScan
RubyWordPress security scanner. Enumerates plugins, themes, users, and checks for known vulnerabilities.
OpenVAS
CFull-featured vulnerability scanner. 50,000+ NVTs, credentialed scanning, compliance checks.
XSStrike
PythonAdvanced XSS detection suite. Fuzzing engine, context analysis, and WAF detection/bypass capabilities.
Commix
PythonAutomated OS command injection exploitation tool. Tests web apps for command injection vulnerabilities.
testssl.sh
ShellCommand-line tool for checking TLS/SSL ciphers, protocols, and cryptographic flaws on any port.