# projectdiscovery/nuclei

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/projectdiscovery-nuclei).**

27,112 stars · 3,166 forks · Go · mit

## Links

- GitHub: https://github.com/projectdiscovery/nuclei
- Homepage: https://docs.projectdiscovery.io/tools/nuclei
- awesome-repositories: https://awesome-repositories.com/repository/projectdiscovery-nuclei.md

## Topics

`attack-surface` `cve-scanner` `dast` `hacktoberfest` `nuclei-engine` `security` `security-scanner` `subdomain-takeover` `vulnerability-assessment` `vulnerability-detection` `vulnerability-scanner`

## Description

Nuclei is a modular security scanning framework designed for automated vulnerability detection and infrastructure reconnaissance. It functions as a template-driven engine that executes security checks across diverse network protocols, allowing users to define custom detection logic to identify vulnerabilities, misconfigurations, and exposed assets.

The platform distinguishes itself through its highly extensible architecture, which supports distributed scanning, headless browser automation for dynamic web content, and out-of-band interaction monitoring to detect blind vulnerabilities. It integrates advanced reconnaissance capabilities, including cloud infrastructure assessment, subdomain discovery, and technology fingerprinting, into a unified workflow that can be orchestrated via a command-line interface or programmatic API.

Beyond core scanning, the project provides a comprehensive suite of tools for external attack surface management, including asset inventorying, visual evidence capture, and automated ticketing integration. It supports collaborative security operations through team workspaces, centralized template management, and real-time alerting, ensuring that vulnerability findings can be tracked, verified, and remediated within a single environment.

The platform is distributed as a command-line utility and supports containerized execution, enabling integration into existing CI/CD pipelines and automated security workflows.

## Tags

### Development Tools & Productivity

- [Configuration-Driven Scanning Engines](https://awesome-repositories.com/f/development-tools-productivity/configuration-driven-scanning-engines.md) — Executes modular security checks by interpreting YAML-based definitions to perform automated vulnerability detection.
- [External Tool Integrations](https://awesome-repositories.com/f/development-tools-productivity/platforms-runtimes-language-services/developer-ecosystems/external-tool-integrations.md) — Wraps third-party security tools to extend protocol coverage and interaction monitoring. ([source](https://docs.projectdiscovery.io/opensource/interactsh/server.md))
- [Template Management Systems](https://awesome-repositories.com/f/development-tools-productivity/template-management-systems.md) — Manages the lifecycle of security templates, including removal from storage. ([source](https://docs.projectdiscovery.io/api-reference/templates/delete-template.md))

### Security & Cryptography

- [Vulnerability Scanners](https://awesome-repositories.com/f/security-cryptography/security/utilities/security-tools/vulnerability-assessment-tools/vulnerability-scanners.md) — Provides an automated engine that executes security checks across diverse network protocols to identify vulnerabilities and misconfigurations. ([source](https://docs.projectdiscovery.io/cloud/editor/faq.md))
- [Automated Security Scanners](https://awesome-repositories.com/f/security-cryptography/vulnerability-assessment-testing/security-testing-auditing/security-testing-tools/reconnaissance-assessment-platforms/automated-security-scanners.md) — Provides a high-performance engine for identifying security weaknesses and misconfigurations across large-scale network environments.
- [Vulnerability Assessment Frameworks](https://awesome-repositories.com/f/security-cryptography/vulnerability-assessment-testing/security-testing-auditing/security-testing-tools/reconnaissance-assessment-platforms/vulnerability-assessment-frameworks.md) — Provides a modular framework for automating vulnerability detection and infrastructure reconnaissance using customizable templates.
- [Vulnerability Scanning](https://awesome-repositories.com/f/security-cryptography/vulnerability-scanning.md) — Executes automated security checks against web applications and network infrastructure to identify vulnerabilities.
- [Attack Surface Management](https://awesome-repositories.com/f/security-cryptography/attack-surface-management.md) — Maps and monitors internet-facing assets, subdomains, and cloud infrastructure to maintain a comprehensive view of organizational exposure.
- [Digital Footprint Mappers](https://awesome-repositories.com/f/security-cryptography/digital-footprint-mappers.md) — Identifies internet-facing infrastructure by analyzing DNS records, security certificates, and third-party data sources to visualize an organization's complete online presence. ([source](https://docs.projectdiscovery.io/cloud/assets/overview.md))
- [Subdomain Enumeration Tools](https://awesome-repositories.com/f/security-cryptography/subdomain-enumeration-tools.md) — Identifies subdomains by testing combinations of domain names and wordlists against target infrastructure. ([source](https://docs.projectdiscovery.io/opensource/dnsx/running.md))
- [Asset Discovery Tools](https://awesome-repositories.com/f/security-cryptography/asset-discovery-tools.md) — Orchestrates multi-step discovery workflows including DNS resolution, port scanning, and endpoint crawling to map attack surfaces. ([source](https://docs.projectdiscovery.io/api-reference/enumerations/create-enumeration.md))
- [Security Automation Templates](https://awesome-repositories.com/f/security-cryptography/security-automation-templates.md) — Fetches security scanning templates from remote repositories to automate vulnerability detection. ([source](https://docs.projectdiscovery.io/api-reference/templates/get-public-template-list.md))
- [AI Template Generators](https://awesome-repositories.com/f/security-cryptography/security-automation-templates/ai-template-generators.md) — Uses artificial intelligence to convert vulnerability proof-of-concept data into structured scanning templates for automated security testing. ([source](https://docs.projectdiscovery.io/cloud/editor/ai.md))
- [Security Orchestration](https://awesome-repositories.com/f/security-cryptography/security-orchestration.md) — Centralizes the management of automated vulnerability assessments, team collaboration, and integration with external ticketing workflows.
- [Out-of-Band Interaction Monitoring](https://awesome-repositories.com/f/security-cryptography/security/utilities/security-tools/vulnerability-assessment-tools/vulnerability-scanners/out-of-band-interaction-monitoring.md) — Captures asynchronous network callbacks to identify blind vulnerabilities that do not produce immediate responses. ([source](https://docs.projectdiscovery.io/opensource/index.md))
- [Template Synchronization](https://awesome-repositories.com/f/security-cryptography/threat-intelligence-platforms/template-synchronization.md) — Integrates community-contributed detection templates to provide real-time coverage against emerging vulnerabilities and trending exploits. ([source](https://docs.projectdiscovery.io/cloud/introduction.md))
- [Out-of-Band Testing](https://awesome-repositories.com/f/security-cryptography/vulnerability-assessment-testing/security-testing-auditing/security-testing-tools/out-of-band-testing.md) — Detects blind vulnerabilities by capturing asynchronous network interactions triggered by security probes.
- [Interaction Monitoring](https://awesome-repositories.com/f/security-cryptography/vulnerability-monitoring-systems/interaction-monitoring.md) — Captures asynchronous network callbacks from targets to identify blind vulnerabilities that do not produce immediate HTTP responses.
- [Private Template Managers](https://awesome-repositories.com/f/security-cryptography/private-network-security/private-template-managers.md) — Uploads custom security scanning definitions to a remote platform to organize and store vulnerability detection logic for private use. ([source](https://docs.projectdiscovery.io/api-reference/templates/create-template.md))
- [Vulnerability Databases](https://awesome-repositories.com/f/security-cryptography/security/offensive-operations/vulnerability-research-analysis/research-reference-knowledge/vulnerability-databases.md) — Provides comprehensive vulnerability details including severity and remediation steps. ([source](https://docs.projectdiscovery.io/api-reference/get-vulnerability-by-id.md))
- [Exploitability Validation](https://awesome-repositories.com/f/security-cryptography/vulnerability-assessment-testing/security-testing-auditing/security-vulnerabilities/exploitability-validation.md) — Simulates real-world attacks at runtime to confirm that identified vulnerabilities are actually exploitable, reducing false positives. ([source](https://docs.projectdiscovery.io/cloud/introduction.md))
- [Credential Rotators](https://awesome-repositories.com/f/security-cryptography/automated-secret-rotation/credential-rotators.md) — Generates a new authentication key for the user account and invalidates the previous one to maintain secure access. ([source](https://docs.projectdiscovery.io/api-reference/users/rotate-api-key.md))
- [API Key Authentication](https://awesome-repositories.com/f/security-cryptography/identity-access-management/authentication-strategies/machine-and-protocol-identity/api-machine-authentication/api-key-authentication.md) — Creates unique API keys for user accounts to enable programmatic access to platform services. ([source](https://docs.projectdiscovery.io/api-reference/users/create-api-key.md))
- [AI Generation](https://awesome-repositories.com/f/security-cryptography/security-automation-templates/ai-generation.md) — Creates custom vulnerability detection templates by processing natural language descriptions through an integrated artificial intelligence engine. ([source](https://docs.projectdiscovery.io/api-reference/templates/generate-ai-template.md))
- [Integrated Editors](https://awesome-repositories.com/f/security-cryptography/security-automation-templates/integrated-editors.md) — Provides an integrated development environment for writing, modifying, and validating security detection logic with syntax highlighting and linting tools. ([source](https://docs.projectdiscovery.io/cloud/editor/overview.md))
- [Brute Force Tools](https://awesome-repositories.com/f/security-cryptography/vulnerability-assessment-testing/security-testing-auditing/security-testing-tools/brute-force-tools.md) — Systematically tests potential hostnames against target domains to discover subdomains. ([source](https://docs.projectdiscovery.io/opensource/dnsx/overview.md))
- [Web Asset Probing](https://awesome-repositories.com/f/security-cryptography/web-asset-probing.md) — Identifies and inspects web services across specified ports and protocols by performing automated HTTP and HTTPS connectivity checks. ([source](https://docs.projectdiscovery.io/opensource/httpx/usage.md))
- [Web Path Bruteforcing](https://awesome-repositories.com/f/security-cryptography/web-path-bruteforcing.md) — Probes specific URL paths across multiple targets to discover hidden endpoints, unsecured files, or administrative interfaces. ([source](https://docs.projectdiscovery.io/opensource/httpx/running.md))
- [Authentication Security Policies](https://awesome-repositories.com/f/security-cryptography/authentication-security-policies.md) — Enforces password-based authentication and multi-factor verification requirements to protect user account access. ([source](https://docs.projectdiscovery.io/cloud/admin.md))
- [Credential Monitoring Services](https://awesome-repositories.com/f/security-cryptography/credential-monitoring-services.md) — Tracks and alerts on exposed sensitive information and compromised credentials to identify potential security breaches.
- [Credential Retrieval Tools](https://awesome-repositories.com/f/security-cryptography/credential-retrieval-tools.md) — Fetches unique security keys for authenticated users to authorize requests and manage remote scanning operations. ([source](https://docs.projectdiscovery.io/api-reference/users/get-api-key.md))
- [Credential Revocation](https://awesome-repositories.com/f/security-cryptography/identity-access-management/credential-lifecycle-management/credential-revocation.md) — Invalidates existing authentication keys to prevent further access to platform services. ([source](https://docs.projectdiscovery.io/api-reference/users/delete-api-key.md))
- [Origin Exposure Detection](https://awesome-repositories.com/f/security-cryptography/origin-exposure-detection.md) — Identifies when proxied DNS or CDN records inadvertently reveal the underlying origin IP address of a protected service. ([source](https://docs.projectdiscovery.io/cloud/integrations.md))
- [Security Monitoring](https://awesome-repositories.com/f/security-cryptography/security-monitoring.md) — Detects and tracks exposed sensitive information to identify potential security breaches. ([source](https://docs.projectdiscovery.io/api-reference/introduction.md))
- [Web Technology Detection](https://awesome-repositories.com/f/security-cryptography/web-technology-detection.md) — Extracts page titles, status codes, and technology signatures from web responses to profile the software and frameworks running on target endpoints. ([source](https://docs.projectdiscovery.io/opensource/httpx/running.md))

### DevOps & Infrastructure

- [Distributed Scanning Agents](https://awesome-repositories.com/f/devops-infrastructure/distributed-scanning-agents.md) — Orchestrates parallel security assessments across multiple nodes for large-scale discovery.
- [Scan Orchestration](https://awesome-repositories.com/f/devops-infrastructure/scan-orchestration.md) — Executes, schedules, and configures automated vulnerability assessments while managing import and export workflows for scan data. ([source](https://docs.projectdiscovery.io/api-reference/introduction.md))
- [Cloud Infrastructure Management](https://awesome-repositories.com/f/devops-infrastructure/infrastructure/private-enterprise-management/cloud-infrastructure-management.md) — Connects to cloud providers to continuously track assets, identify exposed services, and detect risky configurations. ([source](https://docs.projectdiscovery.io/cloud/assets/overview.md))
- [Cloud Infrastructure](https://awesome-repositories.com/f/devops-infrastructure/cloud-infrastructure.md) — Evaluates cloud environments for misconfigured resources, overly permissive access settings, and exposed assets across major cloud providers. ([source](https://docs.projectdiscovery.io/cloud/scanning/overview.md))
- [Cloud Synchronizers](https://awesome-repositories.com/f/devops-infrastructure/cloud-infrastructure-automation/cloud-synchronizers.md) — Imports and maintains an up-to-date inventory of assets by connecting directly to cloud provider accounts for automated discovery. ([source](https://docs.projectdiscovery.io/cloud/assets/adding-assets.md))
- [Automation Triggers](https://awesome-repositories.com/f/devops-infrastructure/automation-orchestration/task-execution-frameworks/automation-frameworks/triggers-events/automation-triggers.md) — Triggers security assessments via REST API for integration into CI/CD pipelines and automated workflows. ([source](https://docs.projectdiscovery.io/cloud/scanning/external-scan.md))
- [Containerized Execution](https://awesome-repositories.com/f/devops-infrastructure/containerized-execution.md) — Supports running security scans within isolated container environments to ensure consistent execution. ([source](https://docs.projectdiscovery.io/opensource/httpx/running.md))
- [Domain Correlation](https://awesome-repositories.com/f/devops-infrastructure/infrastructure/networking/domain-management/domain-registration-platforms/domain-correlation.md) — Identifies related organizational assets by correlating certificate transparency logs and registration records. ([source](https://docs.projectdiscovery.io/api-reference/enumerations/get-associated-domains.md))
- [Scan Result Exporters](https://awesome-repositories.com/f/devops-infrastructure/scan-result-interpreters/scan-result-exporters.md) — Provides a centralized interface to filter, export, and manage vulnerability findings, including retesting capabilities to verify fixes. ([source](https://docs.projectdiscovery.io/cloud/scanning/external-scan.md))
- [Template Management](https://awesome-repositories.com/f/devops-infrastructure/template-management.md) — Stores and synchronizes security detection logic in a centralized cloud repository for consistent access and team collaboration. ([source](https://docs.projectdiscovery.io/cloud/editor/overview.md))

### Business & Productivity Software

- [Vulnerability Ticketing Integrators](https://awesome-repositories.com/f/business-productivity-software/ticketing-systems/vulnerability-ticketing-integrators.md) — Creates and updates tickets in external management platforms based on detected vulnerabilities to streamline the remediation process. ([source](https://docs.projectdiscovery.io/cloud/integrations.md))
- [Team Collaboration Management](https://awesome-repositories.com/f/business-productivity-software/team-collaboration-management.md) — Organizes users into teams with defined roles to control access to security resources. ([source](https://docs.projectdiscovery.io/cloud/admin.md))

### Web Development

- [Headless Browser Orchestrators](https://awesome-repositories.com/f/web-development/web-automation-scraping/browser-orchestration-systems/headless-browser-orchestrators.md) — Uses headless browser automation to render dynamic web content and discover endpoints.
- [Headless Browsers](https://awesome-repositories.com/f/web-development/headless-browsers.md) — Uses headless browser engines to render dynamic web content and extract data during reconnaissance. ([source](https://docs.projectdiscovery.io/opensource/katana/usage.md))
- [Web Crawling](https://awesome-repositories.com/f/web-development/web-automation-scraping/web-scraping-automation/web-crawling.md) — Navigates and discovers web application endpoints by following links and parsing content. ([source](https://docs.projectdiscovery.io/opensource/katana/running.md))

### Hardware & IoT

- [Relationship Visualizers](https://awesome-repositories.com/f/hardware-iot/connectivity-iot/internet-of-things/industrial-iot-platforms/asset-management/relationship-visualizers.md) — Maps connections between domains, IP ranges, and cloud services to identify complex attack paths. ([source](https://docs.projectdiscovery.io/cloud/assets/overview.md))
- [Programmatic Managers](https://awesome-repositories.com/f/hardware-iot/connectivity-iot/internet-of-things/industrial-iot-platforms/asset-management/programmatic-managers.md) — Automates the addition and organization of monitored targets by interacting with a REST API for integration into existing workflows. ([source](https://docs.projectdiscovery.io/cloud/assets/adding-assets.md))

### System Administration & Monitoring

- [Interaction Capturers](https://awesome-repositories.com/f/system-administration-monitoring/interaction-logs/interaction-capturers.md) — Intercepts and logs network interactions across subdomains for comprehensive security monitoring. ([source](https://docs.projectdiscovery.io/opensource/interactsh/server.md))

### Data & Databases

- [Profile Categorizers](https://awesome-repositories.com/f/data-databases/asset-managers/profile-categorizers.md) — Analyzes raw infrastructure data using technology fingerprinting and visual snapshots to create detailed records for discovered network assets. ([source](https://docs.projectdiscovery.io/cloud/assets/overview.md))
- [Scan Data Importers](https://awesome-repositories.com/f/data-databases/external-data-connectors/scan-data-importers.md) — Consolidates vulnerability findings by importing scan data from external sources. ([source](https://docs.projectdiscovery.io/api-reference/scans/import-oss-scan.md))
- [Asset Inventory Management](https://awesome-repositories.com/f/data-databases/asset-inventory-management.md) — Categorizes infrastructure using automated tagging or custom labels to streamline management and risk prioritization. ([source](https://docs.projectdiscovery.io/cloud/assets/overview.md))

### Networking & Communication

- [DNS Reconnaissance](https://awesome-repositories.com/f/networking-communication/dns-query-routers/dns-reconnaissance.md) — Retrieves comprehensive internet-wide DNS datasets to assist in asset discovery and reconnaissance. ([source](https://docs.projectdiscovery.io/opensource/chaos/overview.md))
- [Domain Filtering Engines](https://awesome-repositories.com/f/networking-communication/domain-filtering-engines.md) — Filters false-positive subdomains by detecting wildcard patterns and tracking resolution frequency. ([source](https://docs.projectdiscovery.io/opensource/dnsx/running.md))
- [Inbound Connection Managers](https://awesome-repositories.com/f/networking-communication/inbound-connection-managers.md) — Hosts network protocols to capture and log inbound connection attempts for security analysis. ([source](https://docs.projectdiscovery.io/opensource/interactsh/server.md))
- [Port Scanners](https://awesome-repositories.com/f/networking-communication/port-scanners.md) — Identifies active ports on target hosts or networks using SYN, CONNECT, or UDP probes to determine service availability. ([source](https://docs.projectdiscovery.io/opensource/naabu/overview.md))
- [Network Protocols](https://awesome-repositories.com/f/networking-communication/communication-protocols-architectures/communication-protocols-standards/network-protocols.md) — Performs DNS resolution, TLS inspection, and service probing to analyze network endpoint configurations. ([source](https://docs.projectdiscovery.io/opensource/index.md))
- [DNS Resolution](https://awesome-repositories.com/f/networking-communication/dns-resolution.md) — Queries DNS records like A, CNAME, and PTR to verify connectivity and gather infrastructure metadata. ([source](https://docs.projectdiscovery.io/opensource/dnsx/running.md))
- [Network and Server Infrastructure](https://awesome-repositories.com/f/networking-communication/network-infrastructure-routing/network-infrastructure-configuration/network-and-server-infrastructure.md) — Analyzes TLS configurations, ASN affiliations, and favicon hashes to categorize and map the underlying technology stack of target web servers. ([source](https://docs.projectdiscovery.io/opensource/httpx/running.md))

### Software Engineering & Architecture

- [Event-Driven Architectures](https://awesome-repositories.com/f/software-engineering-architecture/event-driven-architectures.md) — Processes scan results through non-blocking queues for real-time alerting and integration.
- [Download Throughput Controls](https://awesome-repositories.com/f/software-engineering-architecture/performance-reliability/performance-optimization/data-handling-throughput/download-throughput-controls.md) — Controls the speed and intensity of requests using concurrency, parallelism, and rate-limiting settings to avoid triggering security blocks. ([source](https://docs.projectdiscovery.io/opensource/katana/running.md))
- [Automated Fix Verifiers](https://awesome-repositories.com/f/software-engineering-architecture/reproducibility-verifiers/automated-fix-verifiers.md) — Verifies security fixes through automated retesting to ensure vulnerabilities are resolved. ([source](https://docs.projectdiscovery.io/cloud/introduction.md))
- [Plugin-Based Architectures](https://awesome-repositories.com/f/software-engineering-architecture/software-architecture/architectural-patterns/plugin-module-systems/modular-plugin-architectures/plugin-based-architectures/plugin-based-architectures.md) — Wraps various network protocols and third-party tools into a unified interface to extend scanning capabilities.

### Testing & Quality Assurance

- [Screenshot Capture](https://awesome-repositories.com/f/testing-quality-assurance/automation-interaction-tools/screenshot-capture.md) — Renders target web pages using a headless browser to generate screenshots and extract the DOM for visual analysis. ([source](https://docs.projectdiscovery.io/opensource/httpx/running.md))