Nuclei
A template-driven vulnerability scanner that checks apps, APIs, networks, DNS and cloud setups for known issue
- Stars
- 32.5k
- Forks
- 4k
- Licence
- MIT
- Language
- Go
- Last update
- 4 days ago
- Type
- CLI
What it is
Nuclei is a command-line scanner that looks for security weaknesses in websites, APIs, servers, DNS records and cloud configurations. It works by running checks written as small YAML templates, which the community shares and maintains, so new known vulnerabilities can be checked for quickly. People use it to find problems in systems they own or are authorized to test, and to repeat those checks automatically.
- Scan a single target URL or host for known vulnerabilities using the -u flag
- Scan a list of targets from a file using the -l flag
- Write a custom YAML template to check for an internal misconfiguration
- Run scans inside a CI/CD pipeline to catch regressions
- Scan a network range using the README's network scan section
Great for
- Security engineers who want to run community-maintained vulnerability checks against their own systems
- Teams that want to add vulnerability scanning to CI/CD pipelines for regression testing
- Penetration testers who want a scriptable, customizable scanner
- Developers who want to write their own YAML checks for internal issues
Not ideal for
- People who need a point-and-click graphical interface, since the README describes it as primarily a standalone CLI tool
- Anyone wanting to run it as an always-on service, because the README warns that running nuclei as a service may pose security risks
- Users who need scanning without any security background, since reading findings and writing templates assumes familiarity with vulnerabilities
How to get it
- 1
Install with a package manager
You'll need: Go 1.27.3 or newer
Install nuclei with Go
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latestShow all command line flags
nuclei -h - 2
Run it
- Install nuclei using the Go install command from the README
- Run nuclei -h to see available flags
- Scan a target you are authorized to test with nuclei -u <target>
- Review the findings and, if needed, write or customize a YAML template
- 3
Get the most out of it
- Use -l to scan a list of targets from a file instead of one at a time
- Write custom YAML templates for checks specific to your environment
- Use the README's CI/CD integration to run scans automatically and catch regressions
- Consult the official documentation and the YouTube getting-started series linked in the README
Downloads
Strengths
- Checks are plain YAML templates, which makes them readable and easy to customize
- Large community contribution of templates, according to the README
- Supports multiple protocols including HTTP, DNS, TCP, SSL and more
Trade-offs
- The README states the project is in active development and may have breaking changes between releases
- Requires Go 1.27.3 or newer for the documented install method, which is a fairly new version requirement
- Running it as a service carries security risks the README explicitly calls out
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| nuclei (this) | 32.5k | CLI | intermediate | 4 days ago | Security engineers who want to run community-maintained vulnerability checks against their own systems |
| nuclei-templates | 13.3k | Dev tool | intermediate | 4 days ago | Security testers who already use the nuclei scanner and want ready-made checks |
| gitleaks | 30.6k | CLI | beginner | 9 days ago | Developers who want to catch accidentally committed credentials before they reach a shared repository |
| crowdsec | 15.4k | App | intermediate | 6 days ago | System administrators who run Linux servers and want fail2ban-style protection with more flexibility |
| fscan | 14.7k | CLI | intermediate | 1 months ago | Security staff running authorized internal network assessments |
| nginx-admins-handbook | 14.3k | Learning resource | beginner | 2.0 years ago | System administrators who already run NGINX and want practical tips |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.