How to Install and Use Nuclei in Linux to Scan for Web Vulnerabilities and Misconfigurations

Modern web infrastructure moves quickly, with continuous deployments, third-party libraries, and microservice architectures creating a constantly shifting attack surface. Identifying exposed admin interfaces, known CVEs, unpatched frameworks, and default credentials across multiple hosts requires high-speed, repeatable vulnerability scanning. Nuclei, developed by ProjectDiscovery, has become the industry standard open-source vulnerability scanner for security engineers and system administrators.

Nuclei functions on a community-driven, YAML-based template engine. By sending tailored HTTP, DNS, TCP, and SSL requests and analysing responses against deterministic matchers, Nuclei minimizes false positives while scanning thousands of endpoints concurrently.

Core Architecture and Features

Nuclei distinguishes itself from traditional monolithic scanners through several architectural advantages:

• Template-Driven Scanning: All security checks are defined in human-readable YAML templates covering CVEs, default credentials, exposed panels, and cloud misconfigurations.
• Zero-Noise Matchers: Templates specify precise regex, status code, and header matchers, virtually eliminating false-positive alerts.
• Massive Concurrency: Written in Go, Nuclei utilizes lightweight goroutines to scan multiple hosts across hundreds of protocol checks simultaneously.
• Extensible Protocols: Supports HTTP, DNS, TCP, SSL, WHOIS, and WebSocket probing out of the box.

Installing Nuclei on Linux

You can install Nuclei via pre-compiled GitHub binaries, Homebrew, or using the Go compiler:

# Method 1: Pre-compiled Binary (Fastest)
curl -s https://api.github.com/repos/projectdiscovery/nuclei/releases/latest | grep "browser_download_url.*linux_amd64.tar.gz" | cut -d : -f 2,3 | tr -d \" | wget -qi -
tar -xvf nuclei_*_linux_amd64.tar.gz
sudo mv nuclei /usr/local/bin/
nuclei -version

# Method 2: Via Go (Requires Go 1.21+)
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

Updating Vulnerability Templates

Nuclei relies on the official ProjectDiscovery community templates repository, which updates daily with new CVE definitions. Before running scans, update your local template database:

nuclei -update-templates

Templates are stored in ~/.local/nuclei-templates or ~/nuclei-templates.

Command Flags and Filter Options

The table below highlights essential command-line arguments for customising scans:

Flag	Description	Usage Example
-u, -target	Target URL or IP address	nuclei -u https://example.com
-l, -list	Text file containing target URLs	nuclei -l hosts.txt
-s, -severity	Filter templates by severity	-severity critical,high
-t, -templates	Specify specific template or directory	-t cves/ -t exposures/
-c, -concurrency	Number of concurrent template workers	-c 50 (default 25)
-o, -output	Write findings to an output file	-o scan_results.txt

Running Security Scans with Nuclei

1. Scanning a Single Target for Critical Vulnerabilities

To audit an endpoint against critical and high severity templates only:

nuclei -u https://example.com -severity critical,high

2. Scanning for Exposed Panels and Sensitive Files

To detect exposed administrative panels, debug dashboards, and exposed Git directories:

nuclei -u https://example.com -t exposures/ -t panels/

3. Batch Scanning Multiple Hosts with Rate Limiting

When assessing an entire server subnet, pipe targets from a file while capping request rates to prevent server disruption:

nuclei -l targets.txt -rl 150 -c 25 -o findings.txt

Frequently Asked Questions

Can Nuclei scans cause service degradation on target servers?

Nuclei is designed to perform non-destructive HTTP handshakes. However, running high concurrency flags without rate limits can saturate small web servers. Always use the -rate-limit (-rl) flag when testing production environments.

How can I export Nuclei findings to JSON for automated CI/CD pipelines?

Add the -json-export results.json flag to your command. Nuclei will output structured JSON objects containing matched CVEs, raw request-response pairs, and severity tags.