Runner: Nuclei icon

Runner: Nuclei

Interact with Nuclei

Runner: Nuclei

AI-generated

Overview

This node integrates with the Nuclei security scanner, a tool designed for fast and customizable vulnerability scanning using templates. It allows users to run Nuclei scans on specified targets with various configurable options, including template selection, filtering, output formatting, rate limiting, and advanced configurations.

Typical use cases include:

  • Automated vulnerability scanning of web applications or network hosts.
  • Security assessments by running specific or custom Nuclei templates.
  • Integration into security orchestration workflows to detect vulnerabilities continuously.
  • Customizing scan behavior with fine-grained control over templates, output, and performance parameters.

For example, a user can specify a list of target URLs or IPs, select templates related to HTTP vulnerabilities, and configure output to receive JSON results with request/response pairs omitted for easier parsing.

Properties

Name Meaning
Only Success Boolean flag to indicate whether to return only successful scan results.
Options Collection of multiple option groups to customize the scan:
- Target Options related to scanning targets, e.g., scan all IPs associated with DNS records, specify IP version (4 or 6).
- Templates Options to select which templates to run, such as automatic scans, new templates, template URLs, workflows, or disabling strict syntax checks.
- Filtering Filters to include or exclude templates based on authors, IDs, severity levels, tags, types (protocols), matchers, and conditions.
- Output Output-related options like including/excluding request-response pairs, exporting in markdown or SARIF format, displaying matcher status, timestamps, or disabling metadata printing.
- Configurations Various scan configurations such as allowing local file access, client certificates, disabling redirects, setting headers, network interface, max redirects, response size limits, TLS options, environment variables, etc.
- Interactsh Options for configuring interaction server settings used for out-of-band service testing (OAST), including cache sizes, polling durations, server URLs, tokens, or disabling interactsh.
- Fuzzing Options to override fuzzing type and mode defined in templates.
- Uncover Enable and configure uncover engine integration with search engines like Shodan, Censys, ZoomEye, etc., including query, fields, limits, and rate limits.
- Rate Limit Controls concurrency and request rate limits, including bulk sizes, concurrency for headless scans, requests per second/minute.
- Optimizations Performance and behavior optimizations such as input read timeout, retries, scan strategy, error tracking, disabling HTTP probing, project folder usage, timeouts, and more.
- Headless Options to enable headless browser support for templates requiring it, including additional Chrome options, page timeouts, showing browser UI, and using system-installed Chrome.
- Statistics Options to expose metrics, display statistics, set update intervals, and output stats in JSONL format.
- Cloud Options to manage cloud-based scans, data sources, targets, templates, reports, and outputs, including enabling/disabling reporting sources and controlling storage/display preferences.
Advanced Config Allows setting environment variables, adding files with content, and collecting files during execution.
Debug Mode Boolean flag to enable detailed debug information in node input and output.

Output

The node outputs a JSON array where each element corresponds to a scanned target. Each element contains:

  • host: The scanned host or target identifier.
  • response: An array of JSON objects representing individual findings or events returned by Nuclei for that host. These are parsed from the JSONL output of the Nuclei CLI.
  • success: A boolean indicating if the scan was successful for that target.

If binary data is involved (not explicitly shown in this code), it would typically represent raw request/response pairs or exported files, but here the focus is on JSON-formatted scan results.

Dependencies

  • Requires the Nuclei CLI tool installed and accessible in the environment where the node runs.
  • No direct API keys or external credentials are handled by this node; however, some options may require authentication files or tokens configured externally (e.g., client certificates, interactsh tokens).
  • The node uses an internal runner container to execute the Nuclei command-line process.
  • Network access permissions must be granted to allow scanning of specified targets.

Troubleshooting

  • Common issues:

    • Targets not reachable or DNS resolution failures will result in no findings or errors.
    • Misconfiguration of template filters or options may cause no templates to run or unexpected results.
    • Insufficient permissions or missing Nuclei installation will cause execution failures.
    • Large scans without proper rate limiting or concurrency controls may overload the system or network.

  • Error messages:

    • Errors from the Nuclei CLI will appear in the node's output or logs. Common errors include invalid template paths, malformed options, or network timeouts.
    • If the node returns empty responses, verify that targets are correct and accessible.
    • Authentication errors when using client certificates or interactsh tokens indicate misconfigured credentials or missing files.

  • Resolutions:

    • Ensure Nuclei is installed and executable in the runtime environment.
    • Validate all input properties and options for correctness.
    • Use debug mode to get detailed logs for troubleshooting.
    • Adjust rate limits and concurrency to avoid resource exhaustion.

Links and References

Discussion