Nuclei Scanner Low Code No Code

Nuclei Scanner

Nuclei Vulnerability Scanner ProjectDiscovery Template YAML Low Code No Code CVE Misconfiguration Security Scanning CI/CD

Installation & Usage

# === Nuclei Installation & Basic Usage ===

# Install (Go)
# go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# Install (Binary - Linux)
# curl -sL https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_amd64.zip -o nuclei.zip
# unzip nuclei.zip && mv nuclei /usr/local/bin/

# Install (Docker)
# docker pull projectdiscovery/nuclei:latest

# Update templates
# nuclei -update-templates

# Basic scan
# nuclei -u https://example.com

# Scan with specific tags
# nuclei -u https://example.com -tags cve, misconfig, exposure

# Scan with severity filter
# nuclei -u https://example.com -severity critical, high

# Scan multiple targets
# nuclei -l targets.txt -severity critical, high -o results.txt

# JSON output
# nuclei -u https://example.com -json -o results.json

# SARIF output (GitHub Security)
# nuclei -u https://example.com -sarif-export results.sarif

# Rate limiting (polite scan)
# nuclei -u https://example.com -rate-limit 50 -bulk-size 25 -concurrency 10

from dataclasses import dataclass

@dataclass
class NucleiCommand:
    command: str
    purpose: str
    use_case: str

commands = [
    NucleiCommand("nuclei -u URL",
        "สแกน Target เดียว ทุก Template",
        "Quick Scan ตรวจทุกช่องโหว่"),
    NucleiCommand("nuclei -l targets.txt -tags cve",
        "สแกนหลาย Target เฉพาะ CVE",
        "Patch Verification หลังอัพเดท"),
    NucleiCommand("nuclei -u URL -severity critical, high",
        "สแกนเฉพาะ Critical High",
        "CI/CD Pipeline Block on Critical"),
    NucleiCommand("nuclei -u URL -tags exposure -json",
        "สแกน Exposed Services Output JSON",
        "Asset Discovery + Exposure Check"),
    NucleiCommand("nuclei -u URL -t custom/ -severity low, info",
        "ใช้ Custom Template เฉพาะ",
        "App-specific Security Check"),
]

print("=== Nuclei Commands ===")
for c in commands:
    print(f"  $ {c.command}")
    print(f"    Purpose: {c.purpose}")
    print(f"    Use: {c.use_case}")

Custom Templates

# === Custom YAML Template ===

# custom-check.yaml
# id: custom-admin-panel
# info:
#   name: Admin Panel Detection
#   author: security-team
#   severity: medium
#   description: ตรวจหา Admin Panel ที่เปิดเผย
#   tags: exposure, panel
#
# http:
#   - method: GET
#     path:
#       - "{{BaseURL}}/admin"
#       - "{{BaseURL}}/admin/login"
#       - "{{BaseURL}}/wp-admin"
#       - "{{BaseURL}}/administrator"
#       - "{{BaseURL}}/dashboard"
#     matchers-condition: or
#     matchers:
#       - type: word
#         words:
#           - "admin"
#           - "login"
#           - "dashboard"
#         condition: or
#       - type: status
#         status:
#           - 200
#           - 302

# Workflow Template
# id: full-recon-workflow
# info:
#   name: Full Recon Workflow
#   author: security-team
# workflows:
#   - template: technologies/tech-detect.yaml
#     subtemplates:
#       - tags: wordpress
#         templates:
#           - cves/wordpress/
#       - tags: nginx
#         templates:
#           - misconfiguration/nginx/

@dataclass
class TemplateCategory:
    category: str
    count: str
    examples: str
    severity: str

categories = [
    TemplateCategory("CVEs",
        "3000+",
        "CVE-2021-44228 Log4Shell, CVE-2023-xxxxx Recent",
        "Critical-Low"),
    TemplateCategory("Misconfiguration",
        "500+",
        "Open Redirect, CORS, Directory Listing, Debug Mode",
        "Medium-High"),
    TemplateCategory("Exposure",
        "800+",
        "Admin Panel, API Docs, .env File, Backup Files",
        "Info-High"),
    TemplateCategory("Default Credentials",
        "200+",
        "Admin/Admin, Root/Root, Default Password",
        "High-Critical"),
    TemplateCategory("Technologies",
        "300+",
        "WordPress, Nginx, Apache, Framework Detection",
        "Info"),
    TemplateCategory("Takeover",
        "50+",
        "Subdomain Takeover, CNAME Dangling",
        "High-Critical"),
]

print("=== Template Categories ===")
for t in categories:
    print(f"  [{t.category}] Count: {t.count}")
    print(f"    Examples: {t.examples}")
    print(f"    Severity: {t.severity}")

CI/CD Integration

# === GitHub Actions Integration ===

# .github/workflows/security-scan.yml
# name: Security Scan
# on:
#   push:
#     branches: [main]
#   schedule:
#     - cron: '0 2 * * *'  # Daily at 02:00
#
# jobs:
#   nuclei-scan:
#     runs-on: ubuntu-latest
#     steps:
#       - uses: projectdiscovery/nuclei-action@main
#         with:
#           target: https://app.example.com
#           flags: "-severity critical, high -tags cve, misconfig"
#           output: nuclei-results.sarif
#           sarif-export: nuclei-results.sarif
#
#       - uses: github/codeql-action/upload-sarif@v2
#         with:
#           sarif_file: nuclei-results.sarif

@dataclass
class CICDConfig:
    platform: str
    trigger: str
    scan_type: str
    on_finding: str
    output: str

configs = [
    CICDConfig("GitHub Actions",
        "Push to main + Daily Schedule",
        "Critical + High CVE Misconfig",
        "Block merge + SARIF upload + Slack alert",
        "SARIF → GitHub Security Tab"),
    CICDConfig("GitLab CI",
        "Merge Request + Weekly",
        "All Severity + Custom Templates",
        "Fail pipeline on Critical + Issue creation",
        "JSON → GitLab Security Dashboard"),
    CICDConfig("Jenkins",
        "Post-deploy + Nightly",
        "Full Scan + Compliance Check",
        "Email report + Jira ticket",
        "HTML Report + JSON Archive"),
    CICDConfig("Scheduled (Cron)",
        "Daily 02:00",
        "Full Scan ทุก Asset",
        "New findings → Slack + DefectDojo",
        "JSON → DefectDojo → Dashboard"),
]

print("=== CI/CD Configs ===")
for c in configs:
    print(f"  [{c.platform}] Trigger: {c.trigger}")
    print(f"    Scan: {c.scan_type}")
    print(f"    On Finding: {c.on_finding}")
    print(f"    Output: {c.output}")

เคล็ดลับ

• Update: อัพเดท Template ทุกวัน nuclei -update-templates
• Filter: ใช้ -severity critical, high ใน CI/CD ไม่ต้องสแกนทุก Severity
• Rate: ตั้ง Rate Limit เมื่อสแกน Production ไม่ให้กระทบ Service
• Custom: เขียน Custom Template สำหรับ App เฉพาะ ครอบคลุมกว่า
• Pipeline: ใช้ subfinder + httpx + nuclei เป็น Full Recon Pipeline

Nuclei Scanner คืออะไร

Open Source Vulnerability Scanner ProjectDiscovery YAML Template 7000+ CVE Misconfiguration Exposure Default Credentials เร็ว Parallel Bug Bounty

สรุป

Nuclei Scanner Low Code No Code YAML Template Vulnerability CVE Misconfiguration CI/CD GitHub Actions SARIF DefectDojo Security Production