Thread by @ReconOne_bk

Nuclei (by @pdiscoveryio) is a vulnerability detection tool used by thousands of people every day.

But only a few master it at 100%

Here is how you can improve the use of the tool 🧵 👇

#nuclei #bugbounty #bugbountytips #hackwithautomation

1/6 Default mode

By default nuclei use almost all templates, so if your objective is a complete scan, you can try:

$ nuclei -u http://site. com

$ nuclei -l url_list.txt

$ cat urls.txt | nuclei

(WARNING: this could overload servers)

2/6 Templates Scan

You can specify templates, folders, tags or severity:

$ nuclei -u http://site. com -t my-template.yaml

$ nuclei -u http://site. com -t nuclei-templates/cves/

$ nuclei -u http://site. com -tags log4j

$ nuclei -u http://site. com -severity low

3/6 Moderate Scan

nuclei is a very powerful tool, but it can also be destructive against small web apps.
In order to lower scan speed, you can use:

$ nuclei -u http://site. com -rate-limit 20 -concurrency 5 -timeout 10

4/6 Output

There are several output options. Here are the main ones

$ nuclei -u http://site. com -o results.txt

$ nuclei -u http://site. com -o output/results.txt -store-resp output

$ nuclei -u http://site. com -o results.txt -json -include-rr

5/6 Miscellaneous

Execute scan with new templates only:

$ nuclei -u http://site. com -nt

Updates

$ nuclei -update
$ nuclei -update-templates

Proxy all requests through Burp

$ nuclei -u http://site. com -p http://127.0.01:8080

6/6 Grab Screenshot

$ nuclei -u http://site. com -headless -t ~/nuclei-templates/headless/screenshot.yaml

I hope you will find it helpful. If yes please RT so others can find it

Follow me @ReconOne_bk for more content on Recon, Attack Surface Management and Bug Bounty

https://twitter.com/ReconOne_bk/status/1566728090847436801?t=X6mUfKuB48baoXMNQQJHbA&s=19