{"id":2372,"date":"2025-03-01T20:35:41","date_gmt":"2025-03-01T12:35:41","guid":{"rendered":"https:\/\/systw.net\/note\/?p=2372"},"modified":"2025-07-27T18:23:03","modified_gmt":"2025-07-27T10:23:03","slug":"nuclei","status":"publish","type":"post","link":"https:\/\/systw.net\/note\/archives\/2372","title":{"rendered":"Nuclei"},"content":{"rendered":"\n<p>Nuclei \u7528\u65bc\u57fa\u65bc\u6a21\u677f\u8de8\u76ee\u6a19\u767c\u9001\u8acb\u6c42\uff0c\u5f9e\u800c\u5be6\u73fe\u96f6\u8aa4\u5831\u4e26\u63d0\u4f9b\u5c0d\u5927\u91cf\u4e3b\u6a5f\u7684\u5feb\u901f\u5f31\u9ede\u6383\u63cf\u3002 Nuclei \u63d0\u4f9b\u5404\u7a2e\u5354\u5b9a\u7684\u6383\u63cf\uff0c\u5305\u62ec TCP\u3001DNS\u3001HTTP\u3001SSL\u3001File\u3001Whois\u3001Websocket\u3001Headless\u3001Code \u7b49\uff0c\u5e38\u898b\u7528\u6cd5\u5982\u4e0b\u3002<\/p>\n\n\n\n<p><a href=\"https:\/\/github.com\/projectdiscovery\/nuclei\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/projectdiscovery\/nuclei<\/a><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">\u9078\u76ee\u6a19<\/h4>\n\n\n\n<p>TARGET:<br>   -u, -target string[]          target URLs\/hosts to scan<br>   -l, -list string              path to file containing a list of target URLs\/hosts to scan (one per line)<\/p>\n\n\n\n<p>Run nuclei on single host:<br><code>$ nuclei -target example.com<\/code><\/p>\n\n\n\n<p><code>$ nuclei -u example.com<\/code><br><br>Run nuclei against a list of hosts:<br><code>$ nuclei -list hosts.txt<\/code><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<p><\/p>\n\n\n\n<h4 class=\"wp-block-heading\">\u904e\u6ffe<\/h4>\n\n\n\n<p>-tags: Filter based on tags field available in the template.<br>-severity: Filter based on severity field available in the template.<br> -t, -templates:   list of template or template directory <br>-id, -template-id:   templates to run based on template ids<\/p>\n\n\n\n<p>\u6307\u5b9atemplate\u6a94\u6848\u6216template\u76ee\u9304<\/p>\n\n\n\n<p><code>$ nuclei -u example.com -t CVE-2024-4577.yaml<\/code><br><code>$ nuclei -u example.com -t http\/cves\/ -t ssl<\/code><br><code>$ nuclei -u https:\/\/example.com -t cves\/ -t exposures\/<\/code><\/p>\n\n\n\n<p>\u900f\u904eid\u6307\u5b9a\u7279\u5b9atemplate, \u4f8b\u5982wp-xmlrpc.yaml\u5167\u7684ID\u70bawordpress-xmlrpc-file<\/p>\n\n\n\n<p><code>$ nuclei -u https:\/\/example.com -template-id wordpress-xmlrpc-file<\/code><br><code>$ nuclei -u https:\/\/example.com -id wordpress-xmlrpc-file<\/code><\/p>\n\n\n\n<p>\u6307\u5b9atag<br><code>$ nuclei -u https:\/\/example.com -tags cve<\/code><br><code>$ nuclei -u https:\/\/example.com -tags sqli<\/code><br><code>$ nuclei -u https:\/\/example.com -tags lfi,xss,rce   <\/code><\/p>\n\n\n\n<p>\u6307\u5b9aseverity<br><code>$ nuclei -u https:\/\/example.com -tags cve -severity critical,high<\/code><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">\u8f38\u51fa<\/h4>\n\n\n\n<p>\u8f38\u51fa\u7d50\u679c\u5230report.csv<\/p>\n\n\n\n<p><code>$ nuclei -target example.com -o report.csv<\/code><\/p>\n\n\n\n<p>Run nuclei with a JSON output:<br><code>$ nuclei -target example.com -json-export output.json<\/code><\/p>\n\n\n\n<p>-v: \u986f\u793a\u8a73\u7d30\u8f38\u51fa <\/p>\n\n\n\n<p>-stats \uff1a\u986f\u793a\u9032\u5ea6<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;0:00:02] | Templates: 4870 | Hosts: 217 | RPS: 18 | Matched: 0 | Errors: 25 | Requests: 36\/1455202 (0%)\n&#91;0:00:03] | Templates: 4870 | Hosts: 217 | RPS: 16 | Matched: 0 | Errors: 25 | Requests: 46\/1455202 (0%)\n&#91;0:00:03] | Templates: 4870 | Hosts: 217 | RPS: 14 | Matched: 0 | Errors: 25 | Requests: 47\/1455202 (0%)<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">\u6548\u80fd <\/h3>\n\n\n\n<p>-c or -concurrency \u540c\u6642\u8acb\u6c42\u7684\u6578\u91cf\uff0c\u9810\u8a2d25<\/p>\n\n\n\n<p>rate-limit \u6bcf\u79d2\u6700\u5927\u8acb\u6c42\u6578\uff0c\u9810\u8a2d150<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">\u5176\u4ed6\u63a7\u5236\u904b\u4f5c\u65b9\u5f0f<\/h4>\n\n\n\n<p>-mhe or -max-host-error \uff1a \u55ae\u4e00\u76ee\u6a19\u5bb9\u8a31\u591a\u5c11\u6b21\u9019\u985e\u932f\u8aa4\uff0c\u8d85\u904e\u5c31\u505c\u6b62\u5c0d\u8a72\u76ee\u6a19\u6383\u63cf<br>This flag controls the maximum number of (network type) errors to allow per host before removing the unresponsive host from the scan (current default is 30)<\/p>\n\n\n\n<p>\u8aaa\u660e\uff1a\u7528 Nuclei \u53bb\u6279\u6b21\u6383\u63cf\u5927\u91cf\u7db2\u7ad9\u6216\u76ee\u6a19\u6642\uff0c\u6bcf\u500b\u76ee\u6a19 host \u53ef\u80fd\u6703\u9047\u5230\u4e00\u4e9b\u9023\u7dda\u554f\u984c\uff0c\u50cf\u662f\uff1a<\/p>\n\n\n\n<p>\u2022 \u7121\u6cd5\u9023\u7dda (Connection timeout)<br>\u2022 DNS \u89e3\u6790\u5931\u6557<br>\u2022 SSL\/TLS \u63e1\u624b\u932f\u8aa4<br>\u2022 \u5176\u4ed6\u985e\u4f3c\u7684 network type error<\/p>\n\n\n\n<p>\u9019\u500b\u53c3\u6578\u5c31\u662f\u7528\u4f86\u8a2d\u5b9a\u300c\u55ae\u4e00\u76ee\u6a19\u5bb9\u8a31\u591a\u5c11\u6b21\u9019\u985e\u932f\u8aa4\uff0c\u8d85\u904e\u5c31\u505c\u6b62\u5c0d\u8a72\u76ee\u6a19\u6383\u63cf\u300d\uff0c\u907f\u514d\u6d6a\u8cbb\u6642\u9593\u5361\u5728\u5df2\u7d93\u6b7b\u6389\u7684\u76ee\u6a19\u4e0a\u3002<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>-resume   \u56de\u5fa9\u5230\u4e4b\u524d\u4e2d\u65b7\u7684\u9032\u5ea6\u7e7c\u7e8c\u6383\u63cf<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># nuclei -l url.list\n...omit...\n^C&#91;INF] CTRL+C pressed: Exiting\n&#91;INF] Creating resume file: \/Users\/Eo\/.config\/nuclei\/resume-cfb3outnsevg6m3t0jvg.cfg\n\n# nuclei -l url.list -resume \"\/Users\/Eo\/.config\/nuclei\/resume-cfb3outnsevg6m3t0jvg.cfg\" <\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">rule<\/h4>\n\n\n\n<p>nuclei\u662f\u7279\u5fb5\u6383\u63cf\u985e\u578b\u7684\u5de5\u5177\uff0c\u6240\u4ee5\u4f9d\u8cf4\u5927\u91cf\u7684\u7279\u5fb5\u898f\u5247\uff0c\u4e5f\u7a31nuclei-template<\/p>\n\n\n\n<p>\u898f\u5247\u6e05\u55ae  <a href=\"https:\/\/github.com\/projectdiscovery\/nuclei-templates\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/projectdiscovery\/nuclei-templates<\/a><\/p>\n\n\n\n<p>\u898f\u5247\u5beb\u6cd5  <a href=\"https:\/\/docs.projectdiscovery.io\/templates\/introduction\" target=\"_blank\" rel=\"noopener\">https:\/\/docs.projectdiscovery.io\/templates\/introduction<\/a><\/p>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u5176\u4ed6\u548cNuclei\u642d\u914d\u7684\u6383\u63cf\u5de5\u5177 <\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>NucleiScanner&nbsp;<\/li>\n\n\n\n<li>scan4all<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">NucleiScanner&nbsp;<\/h3>\n\n\n\n<p>NucleiScanner\u662f\u4e00\u500b\u81ea\u52d5\u5316\u5de5\u5177\u3002\u5b83\u4f7f\u7528Subfinder\u4f86\u6536\u96c6\u5b50\u7db2\u57df\uff0cGau\u900f\u904e\u904e\u6ffe\u4e0d\u9700\u8981\u7684\u64f4\u5145\u529f\u80fd\u4f86\u6536\u96c6URL\uff0cParamSpider\u7528\u65bc\u8b58\u5225\u6f5b\u5728\u7684\u5165\u53e3\u9ede\uff0cNuclei Scanning templates\u7528\u65bc\u6383\u63cf\u6f0f\u6d1e\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Tools included:<a href=\"https:\/\/github.com\/0xKayala\/NucleiScanner#tools-included\" target=\"_blank\" rel=\"noopener\"><\/a><\/h4>\n\n\n\n<p><a href=\"https:\/\/github.com\/projectdiscovery\/nuclei\" target=\"_blank\" rel=\"noopener\">Nuclei<\/a>&nbsp;<code>git clone https:\/\/github.com\/projectdiscovery\/nuclei.git<\/code><br><br><a href=\"https:\/\/github.com\/projectdiscovery\/subfinder\" target=\"_blank\" rel=\"noopener\">Subfinder<\/a>&nbsp;<code>git clone https:\/\/github.com\/projectdiscovery\/subfinder.git<\/code><br><br><a href=\"https:\/\/github.com\/lc\/gau\" target=\"_blank\" rel=\"noopener\">Gau<\/a>&nbsp;<code>git clone https:\/\/github.com\/lc\/gau.git<\/code><br><br><a href=\"https:\/\/github.com\/0xKayala\/ParamSpider\" target=\"_blank\" rel=\"noopener\">ParamSpider<\/a>&nbsp;<code>git clone https:\/\/github.com\/0xKayala\/ParamSpider.git<\/code><br><br><a href=\"https:\/\/github.com\/projectdiscovery\/httpx\" target=\"_blank\" rel=\"noopener\">httpx<\/a>&nbsp;<code>git clone https:\/\/github.com\/projectdiscovery\/httpx.git<\/code><\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Templates:<a href=\"https:\/\/github.com\/0xKayala\/NucleiScanner#templates\" target=\"_blank\" rel=\"noopener\"><\/a><\/h4>\n\n\n\n<p><a href=\"https:\/\/github.com\/projectdiscovery\/nuclei-templates\" target=\"_blank\" rel=\"noopener\">Nuclei Templates<\/a>&nbsp;<code>git clone https:\/\/github.com\/projectdiscovery\/nuclei-templates.git<\/code><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>refer<br><a href=\"https:\/\/github.com\/0xKayala\/NucleiScanner\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/0xKayala\/NucleiScanner<\/a><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">scan4all<\/h3>\n\n\n\n<p>\u6574\u5408 vscan\u3001nuclei\u3001ksubdomain\u3001subfinder\u7b49\uff0c\u5145\u5206\u81ea\u52d5\u5316\u3001\u667a\u80fd\u5316 \u4e26\u5c0d\u9019\u4e9b\u96c6\u6210\u7684\u9805\u76ee\u9032\u884c\u4ee3\u78bc\u7d1a\u5225\u512a\u5316\u3001\u53c3\u6578\u512a\u5316\uff0c\u500b\u5225\u6a21\u7d44,\u5982 vscan filefuzz\u90e8\u5206\u9032\u884c\u4e86\u91cd\u5beb\u3002\u4e26\u5305\u542b15000+PoC\u6f0f\u6d1e\u6383\u63cf\uff1b23 \u7a2e\u61c9\u7528\u5f31\u53e3\u4ee4\u7206\u7834\uff1b7000+Web\u6307\u7d0b\uff1b146\u7a2e\u5354\u5b9a90000+\u898f\u5247Port\u6383\u63cf\uff1bFuzz\u3001HW\u6253\u9ede\u3001BugBounty\u795e\u5668<\/p>\n\n\n\n<p>refer<br><a href=\"https:\/\/github.com\/GhostTroops\/scan4all\/blob\/main\/README_CN.md\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/GhostTroops\/scan4all\/blob\/main\/README_CN.md<\/a><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n","protected":false},"excerpt":{"rendered":"<p>Nuclei \u7528\u65bc\u57fa\u65bc\u6a21\u677f\u8de8\u76ee\u6a19\u767c\u9001\u8acb\u6c42\uff0c\u5f9e\u800c\u5be6\u73fe\u96f6\u8aa4\u5831\u4e26\u63d0\u4f9b\u5c0d\u5927\u91cf\u4e3b\u6a5f\u7684\u5feb\u901f\u6383\u63cf\u3002<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"enabled":false},"version":2}},"categories":[369],"tags":[],"class_list":["post-2372","post","type-post","status-publish","format-standard","hentry","category-red-team"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/2372","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=2372"}],"version-history":[{"count":2,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/2372\/revisions"}],"predecessor-version":[{"id":2400,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/2372\/revisions\/2400"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=2372"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=2372"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=2372"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}