# nuclei

> YAML template-based vulnerability scanner for web apps, APIs, networks, DNS and cloud, with TCP, HTTP, DNS, SSL, WHOIS and JavaScript protocols.

Stars: 32.4k · Language: Go · License: MIT · Categories: Network

- Repository: https://github.com/projectdiscovery/nuclei
- Website: https://docs.projectdiscovery.io/tools/nuclei
- Page: https://www.trmn.sh/tools/nuclei

## Install

- Go: `go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest`

## Overview

Nuclei is a command-line vulnerability scanner that runs detection logic defined in YAML templates. Each template describes the requests to send and the conditions that confirm a vulnerability, so scans can mimic real-world verification steps rather than rely on simple banner matching. Templates are contributed by a community of security professionals and cover trending vulnerabilities across applications, APIs, networks, DNS and cloud configurations.

Targets are passed with -u or a list file with -l, and templates are selected with -t, -w (workflows), or -turl (remote URLs). Input can be a plain list or other formats such as Burp, JSONL, YAML, OpenAPI and Swagger (-im). Other documented flags include -nt to run only templates from the latest nuclei-templates release, -as for automatic scans that map Wappalyzer technology detection to template tags, -validate to check templates, -sign to sign them, and -resume to continue a saved scan. Protocols supported include TCP, DNS, HTTP, SSL, WHOIS, JavaScript and Code. There are also an -ai flag that generates and runs a template from a prompt, and -llm options for semantic matching with providers such as OpenAI or Ollama.

It supports parallel scan processing and request clustering, and can be integrated into CI/CD pipelines for vulnerability detection and regression testing. Findings can be sent to Jira, Splunk, GitHub, Elastic and GitLab. The README notes it is built primarily as a standalone CLI, that running it as a service may carry security risks, and that releases can contain breaking changes. Typical users are pentesters, security engineers and bug bounty researchers. A cloud tier and Pro/Enterprise editions exist for storing results and scanning at scale.

### Installation

```bash
# via Go
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
```

## Alternatives

- [wttr.in](https://www.trmn.sh/tools/wttr-in.md): Console-oriented weather service queried with curl, httpie, or wget. Returns ANSI, plain text, HTML, PNG, JSON, or Prometheus output. (Go, 30.7k stars)
- [vegeta](https://www.trmn.sh/tools/vegeta.md): HTTP load testing CLI tool that generates constant request rates with comprehensive reporting and UNIX composability (Go, 25.2k stars)
- [hey](https://www.trmn.sh/tools/hey.md): HTTP load testing tool that sends concurrent requests to web applications and reports performance metrics (Go, 20.7k stars)
- [katana](https://www.trmn.sh/tools/katana.md): Go-based web crawler from ProjectDiscovery with standard and headless Chrome modes, JavaScript endpoint parsing, scope control, and JSON output for pipelines. (Go, 17.8k stars)
- [subfinder](https://www.trmn.sh/tools/subfinder.md): Passive subdomain enumeration tool written in Go that queries online sources, with JSON output, wildcard elimination, and STDIN/STDOUT support. (Go, 14.7k stars)

---

Canonical: https://www.trmn.sh/tools/nuclei