projectdiscovery/nuclei
Nuclei
Nuclei is a modular security scanning framework designed for automated vulnerability detection and infrastructure reconnaissance. It functions as a template-driven engine that executes security checks across diverse network protocols, allowing users to define custom detection logic to identify vulnerabilities, misconfigurations, and exposed assets.
The platform distinguishes itself through its highly extensible architecture, which supports distributed scanning, headless browser automation for dynamic web content, and out-of-band interaction monitoring to detect blind vulnerabilities. It integrates advanced reconnaissance capabilities, including cloud infrastructure assessment, subdomain discovery, and technology fingerprinting, into a unified workflow that can be orchestrated via a command-line interface or programmatic API.
Beyond core scanning, the project provides a comprehensive suite of tools for external attack surface management, including asset inventorying, visual evidence capture, and automated ticketing integration. It supports collaborative security operations through team workspaces, centralized template management, and real-time alerting, ensuring that vulnerability findings can be tracked, verified, and remediated within a single environment.
The platform is distributed as a command-line utility and supports containerized execution, enabling integration into existing CI/CD pipelines and automated security workflows.
Features
- Configuration-Driven Scanning Engines - Executes modular security checks by interpreting YAML-based definitions to perform automated vulnerability detection.
- Vulnerability Scanners - Provides an automated engine that executes security checks across diverse network protocols to identify vulnerabilities and misconfigurations.
- Automated Security Scanners - Provides a high-performance engine for identifying security weaknesses and misconfigurations across large-scale network environments.
- Vulnerability Assessment Frameworks - Provides a modular framework for automating vulnerability detection and infrastructure reconnaissance using customizable templates.
- Vulnerability Scanning - Executes automated security checks against web applications and network infrastructure to identify vulnerabilities.
- Distributed Scanning Agents - Orchestrates parallel security assessments across multiple nodes for large-scale discovery.
- Scan Orchestration - Executes, schedules, and configures automated vulnerability assessments while managing import and export workflows for scan data.
- Attack Surface Management - Maps and monitors internet-facing assets, subdomains, and cloud infrastructure to maintain a comprehensive view of organizational exposure.
- Digital Footprint Mappers - Identifies internet-facing infrastructure by analyzing DNS records, security certificates, and third-party data sources to visualize an organization's complete online presence.
- Subdomain Enumeration Tools - Identifies subdomains by testing combinations of domain names and wordlists against target infrastructure.
- Vulnerability Ticketing Integrators - Creates and updates tickets in external management platforms based on detected vulnerabilities to streamline the remediation process.
- Cloud Infrastructure Management - Connects to cloud providers to continuously track assets, identify exposed services, and detect risky configurations.
- Asset Discovery Tools - Orchestrates multi-step discovery workflows including DNS resolution, port scanning, and endpoint crawling to map attack surfaces.
- Security Automation Templates - Fetches security scanning templates from remote repositories to automate vulnerability detection.
- AI Template Generators - Uses artificial intelligence to convert vulnerability proof-of-concept data into structured scanning templates for automated security testing.
- Security Orchestration - Centralizes the management of automated vulnerability assessments, team collaboration, and integration with external ticketing workflows.
- Out-of-Band Interaction Monitoring - Captures asynchronous network callbacks to identify blind vulnerabilities that do not produce immediate responses.
- Template Synchronization - Integrates community-contributed detection templates to provide real-time coverage against emerging vulnerabilities and trending exploits.
- Out-of-Band Testing - Detects blind vulnerabilities by capturing asynchronous network interactions triggered by security probes.
- Interaction Monitoring - Captures asynchronous network callbacks from targets to identify blind vulnerabilities that do not produce immediate HTTP responses.
- Headless Browser Orchestrators - Uses headless browser automation to render dynamic web content and discover endpoints.
- Reconnaissance and Discovery - Fast vulnerability scanner based on simple YAML templates.
- Vulnerability Scanners - Configurable targeted scanning based on templates.
- Vulnerability Scanning - Template-based scanner for finding known vulnerabilities.
- Web Application Scanners - Template-based scanner for fast, targeted vulnerability discovery.
- Dynamic Analysis - Template-based security scanning for web applications.
- Exploitation Tools - Fast, template-based vulnerability scanner for web targets.
- Infrastructure Scanners - Fast, template-based vulnerability scanner for infrastructure and web services.
- Network Reconnaissance - Executes customizable vulnerability scans using YAML-based templates.
- Security and Auditing - Vulnerability scanner using YAML templates.
- Security Testing - Automated scanner for identifying common site vulnerabilities.
- Vulnerability Assessment - Template-based vulnerability scanning for web and infrastructure.
- Vulnerability Auditing - Fast, template-based targeted scanning for security issues.
- Vulnerability Exploitation Tools - Fast, template-based vulnerability scanner.
- Vulnerability Scanners - Fast, customizable vulnerability scanner using YAML-based templates.
- Cloud Infrastructure - Evaluates cloud environments for misconfigured resources, overly permissive access settings, and exposed assets across major cloud providers.
- Cloud Synchronizers - Imports and maintains an up-to-date inventory of assets by connecting directly to cloud provider accounts for automated discovery.
- Relationship Visualizers - Maps connections between domains, IP ranges, and cloud services to identify complex attack paths.
- Private Template Managers - Uploads custom security scanning definitions to a remote platform to organize and store vulnerability detection logic for private use.
- Vulnerability Databases - Provides comprehensive vulnerability details including severity and remediation steps.
- Exploitability Validation - Simulates real-world attacks at runtime to confirm that identified vulnerabilities are actually exploitable, reducing false positives.
- Interaction Capturers - Intercepts and logs network interactions across subdomains for comprehensive security monitoring.
- Profile Categorizers - Analyzes raw infrastructure data using technology fingerprinting and visual snapshots to create detailed records for discovered network assets.
- Scan Data Importers - Consolidates vulnerability findings by importing scan data from external sources.
- Automation Triggers - Triggers security assessments via REST API for integration into CI/CD pipelines and automated workflows.
- DNS Reconnaissance - Retrieves comprehensive internet-wide DNS datasets to assist in asset discovery and reconnaissance.
- Domain Filtering Engines - Filters false-positive subdomains by detecting wildcard patterns and tracking resolution frequency.
- Inbound Connection Managers - Hosts network protocols to capture and log inbound connection attempts for security analysis.
- Port Scanners - Identifies active ports on target hosts or networks using SYN, CONNECT, or UDP probes to determine service availability.
- Credential Rotators - Generates a new authentication key for the user account and invalidates the previous one to maintain secure access.
- API Key Authentication - Creates unique API keys for user accounts to enable programmatic access to platform services.
- AI Generation - Creates custom vulnerability detection templates by processing natural language descriptions through an integrated artificial intelligence engine.
- Integrated Editors - Provides an integrated development environment for writing, modifying, and validating security detection logic with syntax highlighting and linting tools.
- Brute Force Tools - Systematically tests potential hostnames against target domains to discover subdomains.
- Web Asset Probing - Identifies and inspects web services across specified ports and protocols by performing automated HTTP and HTTPS connectivity checks.
- Web Path Bruteforcing - Probes specific URL paths across multiple targets to discover hidden endpoints, unsecured files, or administrative interfaces.
- Event-Driven Architectures - Processes scan results through non-blocking queues for real-time alerting and integration.
- Headless Browsers - Uses headless browser engines to render dynamic web content and extract data during reconnaissance.
- Web Crawling - Navigates and discovers web application endpoints by following links and parsing content.
- Team Collaboration Management - Organizes users into teams with defined roles to control access to security resources.
- Asset Inventory Management - Categorizes infrastructure using automated tagging or custom labels to streamline management and risk prioritization.
- External Tool Integrations - Wraps third-party security tools to extend protocol coverage and interaction monitoring.
- Template Management Systems - Manages the lifecycle of security templates, including removal from storage.
- Containerized Execution - Supports running security scans within isolated container environments to ensure consistent execution.
- Domain Correlation - Identifies related organizational assets by correlating certificate transparency logs and registration records.
- Scan Result Exporters - Provides a centralized interface to filter, export, and manage vulnerability findings, including retesting capabilities to verify fixes.
- Template Management - Stores and synchronizes security detection logic in a centralized cloud repository for consistent access and team collaboration.
- Programmatic Managers - Automates the addition and organization of monitored targets by interacting with a REST API for integration into existing workflows.
- Network Protocols - Performs DNS resolution, TLS inspection, and service probing to analyze network endpoint configurations.
- DNS Resolution - Queries DNS records like A, CNAME, and PTR to verify connectivity and gather infrastructure metadata.
- Network and Server Infrastructure - Analyzes TLS configurations, ASN affiliations, and favicon hashes to categorize and map the underlying technology stack of target web servers.
- Authentication Security Policies - Enforces password-based authentication and multi-factor verification requirements to protect user account access.
- Credential Monitoring Services - Tracks and alerts on exposed sensitive information and compromised credentials to identify potential security breaches.
- Credential Retrieval Tools - Fetches unique security keys for authenticated users to authorize requests and manage remote scanning operations.
- Credential Revocation - Invalidates existing authentication keys to prevent further access to platform services.
- Origin Exposure Detection - Identifies when proxied DNS or CDN records inadvertently reveal the underlying origin IP address of a protected service.
- Security Monitoring - Detects and tracks exposed sensitive information to identify potential security breaches.
- Web Technology Detection - Extracts page titles, status codes, and technology signatures from web responses to profile the software and frameworks running on target endpoints.
- Download Throughput Controls - Controls the speed and intensity of requests using concurrency, parallelism, and rate-limiting settings to avoid triggering security blocks.
- Automated Fix Verifiers - Verifies security fixes through automated retesting to ensure vulnerabilities are resolved.
- Plugin-Based Architectures - Wraps various network protocols and third-party tools into a unified interface to extend scanning capabilities.
- Screenshot Capture - Renders target web pages using a headless browser to generate screenshots and extract the DOM for visual analysis.
