Nuclei Templates

Custom Nuclei YAML templates for automated vulnerability detection — Open Redirect, WP-Setup, IIS, Git Exposure, CORS, Credential Disclosure, Blind SSRF, SQLi, CRLF, and more.

13 Categories23 CommandsCopy Ready

Intro

Introduction

1 commands

1Nuclei templates define request method, target endpoints, response matches, and conditions to detect vulnerabilities.

Nuclei by ProjectDiscovery automates security testing using customizable YAML templates. This guide covers custom templates for Open Redirect, WP-Setup, IIS, Git Exposure, CORS, Credential Disclosure, Blind SSRF, SQLi, CRLF, and more.

Template 1

Template Collection — Overview

1 commands

1Full Nuclei template collection — private + default templates organized by vulnerability type

https://github.com/coffinxp/nuclei-templates

Template 2

Open Redirect Detection

2 commands

1Detect open redirect by injecting query params with domain URL and checking for redirection

cat domains.txt | nuclei -t openRedirect.yaml --retries 2

2Full guide: Hunting high-paying open redirect bugs

https://infosecwriteups.com/from-zero-to-hero-hunting-high-paying-open-redirect-bugs-in-web-apps-fdb80286236e

Template 3

WP-Setup Disclosure

1 commands

1Identify wp-admin/setup-config.php exposing credentials — often P1 in bug bounty

cat domains.txt | nuclei -t wp-setup-config.yaml

Template 4

Microsoft IIS Scanner

2 commands

1Leak sensitive files: credentials, config files, maintenance scripts from IIS servers

cat domains.txt | nuclei -t iis.yaml -c 30

2After discovery, use ShortScan to find sensitive files and directories

shortscan https://domain.com -F

Template 5

Git Exposure

2 commands

1Detect exposed .git directories leaking source code, commit history, and credentials

cat domains.txt | nuclei -t gitExposed.yaml

2After detection, use Git Dumper to recover deleted commits and extract repo details

./gitdumper.sh https://domain.com/.git/ outputdir

Template 6

CORS Misconfiguration

4 commands

1Detect permissive CORS policies allowing unauthorized cross-origin access

cat domains.txt | nuclei -t cors.yaml

2Verify CORS via curl — check for permissive ACAO headers

curl -H 'Origin: http://example.com' -I https://domain.com/wp-json/ | grep -i -e 'access-control-allow-origin' -e 'access-control-allow-methods' -e 'access-control-allow-credentials'

3Basic CORS verification — check if Origin is reflected in ACAO

curl -H 'Origin: http://example.com' -I https://domain.com/wp-json/

4CORS PoC exploit HTML — test CORS vulnerabilities in browser

https://github.com/coffinxp/scripts/blob/main/CorsExploit.html

Template 7

Credential Disclosure

1 commands

1Detect exposed passwords, API keys, and sensitive credentials in web responses

cat domains.txt | nuclei -t credentials-disclosure-all.yaml -c 30

Template 9

SQL Injection (Error-Based)

1 commands

1Detect error-based SQL injection via Nuclei template

cat domains.txt | nuclei -t errorsqli.yaml -dast

Template 10

Swagger XSS Detection

3 commands

1Find Swagger/OpenAPI endpoints exposed on subdomains

subfinder -d domain.com -all -silent | httpx-toolkit -path /swagger-api/ -sc -content-length -mc 200

2Swagger XSS testing resources and payloads

https://github.com/coffinxp/swagger

3Full guide: Swagger XSS and HTML injection in APIs

https://infosecwriteups.com/the-dark-side-of-swagger-ui-how-xss-and-html-injection-can-compromise-apis-1b670972a443

Template 11

CRLF Injection

3 commands

1Detect CRLF injection — HTTP response splitting via newline injection

cat domains.txt | nuclei -t cRlf.yaml -rl 50 -c 30

2Verify CRLF via curl — inject Set-Cookie header with %0a

curl -I "https://domain.com/%0aSet-Cookie:coffin=hi;"

3Full guide: Master CRLF injection techniques

https://infosecwriteups.com/master-crlf-injection-the-underrated-bug-with-dangerous-potential-33bb0d62e031

Template 12

Conclusion

1 commands

1Full collection: github.com/coffinxp/nuclei-templates. More templates added regularly.

Nuclei custom templates automate security testing with flexibility and accuracy. Master them to enhance your vulnerability scanning — whether beginner or advanced.

Tools

Tools & Resources

Nuclei Templates Collection

Custom Nuclei templates for Open Redirect, WP-Setup, IIS, Git, CORS, CRLF, SSRF, SQLi, and more

CORS PoC Exploit

Browser-based CORS vulnerability PoC

Swagger XSS Resources

Swagger/OpenAPI XSS testing payloads and resources

Nuclei Templates

Custom Nuclei YAML templates for automated vulnerability detection — Open Redirect, WP-Setup, IIS, Git Exposure, CORS, Credential Disclosure, Blind SSRF, SQLi, CRLF, and more.

13 Categories23 CommandsCopy Ready

Intro

Introduction

1 commands

1Nuclei templates define request method, target endpoints, response matches, and conditions to detect vulnerabilities.

Nuclei by ProjectDiscovery automates security testing using customizable YAML templates. This guide covers custom templates for Open Redirect, WP-Setup, IIS, Git Exposure, CORS, Credential Disclosure, Blind SSRF, SQLi, CRLF, and more.

Template 1

Template Collection — Overview

1 commands

1Full Nuclei template collection — private + default templates organized by vulnerability type

https://github.com/coffinxp/nuclei-templates

Template 2

Open Redirect Detection

2 commands

1Detect open redirect by injecting query params with domain URL and checking for redirection

cat domains.txt | nuclei -t openRedirect.yaml --retries 2

2Full guide: Hunting high-paying open redirect bugs

https://infosecwriteups.com/from-zero-to-hero-hunting-high-paying-open-redirect-bugs-in-web-apps-fdb80286236e

Template 3

WP-Setup Disclosure

1 commands

1Identify wp-admin/setup-config.php exposing credentials — often P1 in bug bounty

cat domains.txt | nuclei -t wp-setup-config.yaml

Template 4

Microsoft IIS Scanner

2 commands

1Leak sensitive files: credentials, config files, maintenance scripts from IIS servers

cat domains.txt | nuclei -t iis.yaml -c 30

2After discovery, use ShortScan to find sensitive files and directories

shortscan https://domain.com -F

Template 5

Git Exposure

2 commands

1Detect exposed .git directories leaking source code, commit history, and credentials

cat domains.txt | nuclei -t gitExposed.yaml

2After detection, use Git Dumper to recover deleted commits and extract repo details

./gitdumper.sh https://domain.com/.git/ outputdir

Template 6

CORS Misconfiguration

4 commands

1Detect permissive CORS policies allowing unauthorized cross-origin access

cat domains.txt | nuclei -t cors.yaml

2Verify CORS via curl — check for permissive ACAO headers

curl -H 'Origin: http://example.com' -I https://domain.com/wp-json/ | grep -i -e 'access-control-allow-origin' -e 'access-control-allow-methods' -e 'access-control-allow-credentials'

3Basic CORS verification — check if Origin is reflected in ACAO

curl -H 'Origin: http://example.com' -I https://domain.com/wp-json/

4CORS PoC exploit HTML — test CORS vulnerabilities in browser

https://github.com/coffinxp/scripts/blob/main/CorsExploit.html

Template 7

Credential Disclosure

1 commands

1Detect exposed passwords, API keys, and sensitive credentials in web responses

cat domains.txt | nuclei -t credentials-disclosure-all.yaml -c 30

Template 9

SQL Injection (Error-Based)

1 commands

1Detect error-based SQL injection via Nuclei template

cat domains.txt | nuclei -t errorsqli.yaml -dast

Template 10

Swagger XSS Detection

3 commands

1Find Swagger/OpenAPI endpoints exposed on subdomains

subfinder -d domain.com -all -silent | httpx-toolkit -path /swagger-api/ -sc -content-length -mc 200

2Swagger XSS testing resources and payloads

https://github.com/coffinxp/swagger

3Full guide: Swagger XSS and HTML injection in APIs

https://infosecwriteups.com/the-dark-side-of-swagger-ui-how-xss-and-html-injection-can-compromise-apis-1b670972a443

Template 11

CRLF Injection

3 commands

1Detect CRLF injection — HTTP response splitting via newline injection

cat domains.txt | nuclei -t cRlf.yaml -rl 50 -c 30

2Verify CRLF via curl — inject Set-Cookie header with %0a

curl -I "https://domain.com/%0aSet-Cookie:coffin=hi;"

3Full guide: Master CRLF injection techniques

https://infosecwriteups.com/master-crlf-injection-the-underrated-bug-with-dangerous-potential-33bb0d62e031

Template 12

Conclusion

1 commands

1Full collection: github.com/coffinxp/nuclei-templates. More templates added regularly.

Nuclei custom templates automate security testing with flexibility and accuracy. Master them to enhance your vulnerability scanning — whether beginner or advanced.

Tools

Tools & Resources

Nuclei Templates Collection

Custom Nuclei templates for Open Redirect, WP-Setup, IIS, Git, CORS, CRLF, SSRF, SQLi, and more

CORS PoC Exploit

Browser-based CORS vulnerability PoC

Swagger XSS Resources

Swagger/OpenAPI XSS testing payloads and resources