Nuclei Scanner Tutorial: 9 Powerful Steps for Safe Vulnerability Testing

A Nuclei scanner can test a website or service against targeted security checks written as YAML templates. It is not a one-click proof of compromise. The useful workflow is to select an authorized target, choose appropriate templates, limit the traffic, and verify any match against the application you actually control. This Nuclei scanner tutorial walks through nine practical steps for a beginner-friendly lab.

I use a VMware-based environment with Parrot OS and Kali Linux, so I prefer tools whose commands and output I can understand without a heavy dashboard. The examples below fit that style, but they are illustrative commands, not a claim that I ran this exact Nuclei exercise or discovered a vulnerability. Your target, installed templates, tool version and observed results may differ. The goal is a repeatable method, not an impressive-looking terminal screenshot.

The Nuclei scanner belongs to ProjectDiscovery’s open-source security toolkit. Its templates can check more than traditional web-server issues, but running additional checks is not the same thing as gaining permission for them. For the foundation behind the tool, see the ProjectDiscovery homepage.

Key Takeaways

• A Nuclei scanner sends requests chosen by its templates; review what you are about to run before targeting an application.
• Use an intentionally vulnerable local training application or a system for which you have written authorization.
• Begin with a small, low-rate template selection and one known lab URL rather than a broad default scan.
• Interpret severity as a template label, not as proof that a vulnerability is exploitable in your environment.
• Save your version, template selection, exact scope and verification notes so the result can be reproduced.
• Keep Nuclei, Nikto and ZAP in different roles: targeted detection, server reconnaissance and interactive application testing.

Tool or workflow	Best use in a lab	What it does not prove
Nuclei	Repeatable template-driven checks	That every match is a confirmed exploit
Nikto	Web-server exposure and configuration clues	Complete application security coverage
OWASP ZAP	Proxy-assisted and application-focused analysis	Full coverage of every user journey

The table is intentionally simple. A Nuclei scanner complements manual inspection, proxy tools and patch review; none of them replaces a documented test plan.

1. Decide What Your Nuclei Scanner Is Allowed to Touch

Before running the Nuclei scanner, make a tiny scope document. Record the exact scheme, address, port, owner, testing window and excluded paths or services. A target that looks local in a browser may redirect to a remote identity provider, analytics host or third-party API. Permission for one web application does not cover those destinations. Your Nuclei scanner should begin with one host you can name and restore.

An intentionally vulnerable application is ideal for practice because you can inspect its behavior without involving real users. OWASP Juice Shop is one possibility, and a separate deliberately vulnerable VM is another. I would keep the exercise on a dedicated lab network, turn off unnecessary internet-facing forwarding, use disposable accounts and prepare a reset or snapshot. The OWASP Foundation homepage is a useful starting point for learning about safe application-security practices.

For the commands in this guide, imagine that the training application is listening on port 3000 of the same machine or network namespace as your scanner. That is when 127.0.0.1 is correct. In my usual multi-VM setup, a Nuclei scanner running inside Parrot cannot use its own loopback address to reach a service inside a different Ubuntu guest. It needs the Ubuntu guest’s lab-only address instead.

Write a stop condition as well: if you notice unexpected traffic, unstable performance, authentication changes or an unfamiliar redirect, stop and review. A low request rate reduces pressure but does not make a poorly chosen template harmless. This is why the authorization checklist comes before every command.

HackersGhost Note:
One correctly scoped target teaches more than a scan of fifty machines that you cannot confidently identify. In a lab, precision is a feature.

2. Install the Nuclei Scanner on Kali Linux or Parrot OS

Nuclei is distributed as a command-line program. Depending on your system, you may use a verified package, a published release or the upstream Go build process. Linux repositories sometimes lag behind upstream development, so document both the program version and the update method you choose. These commands show the upstream Go route; check the current requirements in ProjectDiscovery’s installation guidance before running them.

go version
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
export PATH="$PATH:$HOME/go/bin"
nuclei -version

The installation example assumes a supported Go toolchain and a normal per-user Go binary directory. If the terminal reports that nuclei cannot be found, check whether the binary exists under $HOME/go/bin and whether that directory is in your PATH. The temporary export affects the current shell. Do not assume every Linux distribution or Go installation uses identical directories.

For a Nuclei scanner installed by a system package manager, update through that manager instead of mixing packages and manually copied binaries without keeping track of them. Avoid installing random release files from unofficial mirrors. A downloaded executable has real privileges under your account; source verification matters as much as the scan configuration.

Open the built-in help and compare your installed flags with the examples in this article. Nuclei changes over time, and the local help output is authoritative for the version actually on your machine.

nuclei -h
nuclei -version
nuclei -health-check

The health check can help reveal local setup problems, but it is not a vulnerability assessment of your target. At this point the Nuclei scanner is merely installed. You have not yet authorized any external testing or validated that a training application is reachable.

3. Inspect and Update Nuclei Templates Before You Scan

The engine and its template library are related but separate moving parts. A Nuclei template contains metadata and one or more requests or matchers that define what the program will test. Templates can use different protocols, perform more than one request and sometimes trigger out-of-band callbacks. That makes template review a safety step, not optional housekeeping.

Start by checking which templates are available to your Nuclei scanner. ProjectDiscovery maintains community templates and distributes updates, but the selection on disk can be different across systems and dates. Read a template’s purpose, severity, protocol, requests and matchers before you run it on anything important.

nuclei -update-templates
nuclei -templates-version
nuclei -tl
nuclei -tgl

The listing commands can produce long output. Their purpose is discovery: find a narrow group appropriate for your exercise rather than treating every available template as mandatory. Nuclei’s -tags, -severity, -id and -t options let you restrict selection. A named template path is often easier to audit than a broad scan across the entire library.

If you create or modify your own YAML file, run nuclei -validate -t ./your-template.yaml before the exercise. Validation checks the template’s structure; it does not certify its safety or accuracy. Review YAML downloaded from unfamiliar sources and be cautious about templates that execute code, use headless browsers or send payloads beyond your intended checks.

HackersGhost Note:
I would rather inspect one template carefully than explain later why an unknown template contacted a service outside my lab.

4. Choose a Conservative First Nuclei Scanner Command

For a first exercise, avoid the tempting command that runs a broad default set. It is easy to demonstrate what the Nuclei scanner does with a small informational selection and a strict request limit. Confirm the target in a browser first, then select the exact lab URL. A service running inside another VM requires its real lab address, not the loopback address from these examples.

nuclei -u http://127.0.0.1:3000 -tags tech -severity info -rl 2 -c 1 -ni

Read the switches before pressing Enter. -u provides the one target. -tags tech requests templates marked for technology detection; which ones match depends on your installed library. -severity info confines the selection to informational templates. -rl 2 caps the request rate at two requests per second, while -c 1 limits template concurrency. -ni excludes Interactsh-based, out-of-band templates.

This is a Nuclei scanner learning exercise, not a guarantee that every selected template is passive. Even informational detection may send network requests. Check the templates if you need to know exactly what will happen, and do not confuse a low severity label with low operational risk. If no template matches, that does not mean the host is secure.

Expect possible outcomes such as an empty finding list, a technology hint, an unsupported protocol message or a connection error. Do not invent a finding to make a tutorial feel complete. If your application is on another host, confirm basic connectivity and permitted routes before changing scan options. An absent response can be a routing problem, a service configuration issue or simply a check that does not apply.

If you need a deliberately vulnerable application that you can reset, read my OWASP Juice Shop walkthrough before testing the more advanced templates.

OWASP Juice Shop Walkthrough: 7 Safe Beginner Challenges

5. Understand Nuclei Templates, Filters and What a Match Means

A typical Nuclei scanner finding includes a template identifier, a severity label and the affected target. Depending on the template and output format, it may also contain a matcher name, extracted data or request details. The key point is that a match means the template’s conditions were satisfied. It does not establish business impact by itself, nor does it rule out environmental context that makes a result irrelevant.

Consider a hypothetical banner-detection template. It might recognize a technology string in a header. That can be useful inventory evidence, but the string alone might be altered by a proxy or left behind after an upgrade. A vulnerability-specific template may be more precise, yet its conclusion can still depend on version detection, configuration, authentication state or a response that another system generates.

Use filters to make a Nuclei scanner session auditable. For example, you can choose one template by its confirmed ID, or one reviewed YAML file using -t. For a more general lab exercise, -severity info,low selects labels; it is not a definition of harmless behavior. -etags excludes unwanted categories, while -pt http restricts the protocol family, subject to the exact templates selected.

nuclei -tl -tags tech
nuclei -u http://127.0.0.1:3000 -tags tech -severity info -pt http -rl 2 -c 1 -ni

A Nuclei scanner template can also contain expressions, matchers and extractors. A matcher decides when the result should be reported; an extractor can copy relevant values into output. That helps explain why repeating one URL with a different template may produce entirely different findings. Read the source of a surprising template before accepting its interpretation.

6. Keep Traffic, Scope and Output Under Control

A Nuclei scanner can take a list of targets, but more targets are not always better. For the first controlled exercise, one known URL provides clearer results and makes unexpected behavior easier to spot. If you later use a file with multiple URLs, confirm that every entry is explicitly authorized and that the application owners agreed to the request rate and testing window.

The CLI offers -rl to limit requests per second, -c for template concurrency, and additional tuning for timeouts and retries. Set them conservatively before starting the Nuclei scanner rather than dialing them back only after a fragile app becomes slow. Run testing on a non-production copy when you can; a rate limiter cannot guarantee that templates will not change state.

nuclei -u http://127.0.0.1:3000 -tags tech -severity info -rl 2 -c 1 -timeout 5 -retries 0 -ni -o nuclei-lab-findings.txt

The command saves reported findings to a local text file. Check the file before sharing it: even an informational scan can reveal internal hostnames, paths, tokens or service details. Use a dedicated results directory with appropriate file permissions, do not publish raw logs and keep your original scope notes alongside the output. The Nuclei scanner may also emit operational messages to the terminal that do not appear in the findings file.

Be careful with redirects. A training app may return a response that points to another origin, and some tools can follow redirects when you enable particular options or templates. Inspect the destination before allowing it. Similarly, out-of-band templates may call external interaction services unless you explicitly disable that behavior. In this example, -ni is deliberate: the exercise does not require a third-party callback channel.

7. Read Nuclei Scanner Results Without Trusting Them Blindly

When the Nuclei scanner reports a possible weakness, start with the smallest reasonable explanation. Which template produced the result? What did its matcher test? Was the request sent to the correct host and path? What response supports the claim? A scan is the beginning of analysis, not the final report.

Imagine a hypothetical finding described as an exposed administrative panel. Before categorizing it as a vulnerability, ask whether the page is intentionally visible, whether it requires valid authentication, whether a reverse proxy changes its behavior and whether the template merely matched a common heading. If you cannot confirm access beyond a login page, do not claim an access-control failure. The same reasoning applies to headers, version strings and debug endpoints.

For repeatable investigations, a Nuclei scanner can write structured output. JSONL contains one JSON object per finding and is convenient when comparing results programmatically. However, raw output may include sensitive request information. Use the -or option to omit raw request/response pairs in structured exports when those details are unnecessary, and avoid uploading sensitive files to public analysis services.

nuclei -u http://127.0.0.1:3000 -tags tech -severity info -rl 2 -c 1 -ni -jsonl -or -o nuclei-lab-findings.jsonl

If a finding appears once and disappears on the next attempt, investigate timing, caching, authentication and template changes. A confirmation should be as narrow as possible and stay within permission. Sometimes the correct conclusion is simply “not reproduced under the documented test conditions.” That is useful data. A Nuclei scanner is much more valuable when you are comfortable reporting negative or ambiguous results.

Never publish actual credentials, session cookies or internal network maps in a blog example. Replace those with a clear written description after you have finished the test. A responsible tutorial can teach how to interpret evidence without exposing private infrastructure.

For a broader introduction to interpreting web-server scan results, my Nikto scanner guide explains why a detected clue is not automatically a confirmed weakness.

Nikto Web Server Scanner: 7 Useful Checks for Beginners

8. Compare Nuclei With Nikto and OWASP ZAP

The Nuclei scanner is particularly suited to focused, repeatable checks selected from a template library. Nikto is often useful for an initial survey of a web server’s exposed resources, while ZAP helps you observe, intercept and explore an application through its requests and responses. These are overlapping perspectives rather than competing substitutes for every task.

A sensible workflow could begin with manual target reconnaissance, use Nikto to identify broad server clues, turn to a small set of relevant Nuclei templates, and use ZAP or browser-based inspection to understand an application workflow. The order depends on your actual question. If you are trying to verify authorization logic, a template scanner might miss an issue that only appears when two real user accounts are compared.

The Nuclei scanner may also be attractive for regression testing because you can save the same scoped checks and repeat them after updates. That does not mean all templates are suitable for production CI. Evaluate their traffic, reliability and potential state-changing behavior before turning on automation. An overnight job that unexpectedly stresses a service is not improved merely because it ran from a pipeline.

This distinction also avoids SEO overlap on HackersGhost. My existing ZAP guide teaches an application-scanning workflow; this Nuclei scanner tutorial concentrates on template selection, cautious CLI execution and findings triage. Readers who need a proxy-centric method can continue with the OWASP ZAP vulnerability scan guide.

OWASP ZAP Vulnerability Scan: 7 Smart Lab Steps

9. Document, Retest and Turn Findings Into a Useful Report

A good Nuclei scanner session ends with a short report that another person can understand without recreating your terminal environment. Include the asset and permission scope, date, tool version, template selection, rate-limit settings, results and their verification status. Separate confirmed issues from informational signals and non-reproducible findings.

For each verified finding, describe what happened, why it matters in that specific lab, how a defender can reproduce the observation safely, and what change could reduce the exposure. If you did not establish impact, say so. Screenshots should reveal enough context to support a claim without displaying private secrets. A scanner severity label can be included, but it should not be the only basis for prioritization.

After a fix, run the same Nuclei scanner selection under comparable conditions, then inspect the behavior manually as needed. Disappearance of an alert can mean remediation, a template update, a changed response or a false negative. Record which explanation is supported. If the app’s version, routes or access rules changed, note that rather than presenting a clean scan as proof of complete security.

If your project involves other people, agree on a disclosure path before testing. Store sensitive results privately and limit distribution to those responsible for resolving them. The exercise is successful when it teaches you to turn a possible signal into a careful explanation, even if there are no dramatic discoveries.

HackersGhost Note:
My favorite security report is not the one with the most red labels. It is the one where the scope, evidence, uncertainty and next action are unmistakable.

Common Nuclei Scanner Mistakes to Avoid

• Running every template: a default scan is broader than most beginner exercises need and may include checks you have not reviewed.
• Confusing severity with confidence: a critical label cannot replace manual verification and target-specific context.
• Mixing up VM addresses: loopback refers to the machine running the command, not another guest on your lab network.
• Ignoring template changes: record both engine and template versions before comparing results from different dates.
• Scanning public systems without consent: being able to reach a URL is not an authorization to probe it.
• Sharing raw findings: reports can contain internal addresses, tokens, response bodies or other details that should remain private.

Final Thoughts: Make Every Scan Explainable

The strongest beginner habit is to keep the Nuclei scanner predictable. Install from a trusted source, document the template versions, confirm the exact target, begin with conservative filters, and interpret each match as a hypothesis until you have enough evidence. A single clear finding can be more useful than a screen full of unexplained alerts.

In my HackersGhost workflow, the aim is to understand what a tool did and what its result actually supports. That makes this Nuclei scanner tutorial a natural companion to the existing Nikto, ZAP and Juice Shop guides—and a practical foundation for more advanced, explicitly authorized vulnerability research later.

Nuclei scanner FAQ