nuclei

Documentation

Overview

Package nuclei verifies scan findings with projectdiscovery/nuclei: it locates the matching template file for a CVE and runs the nuclei binary to confirm the vulnerability against the target.

Index

• Variables
• func FindTemplate(dir, cve string) (string, bool)
• func NucleiBinary() (string, error)
• type NucleiResult
  • func ParseLine(line string) (NucleiResult, error)
  • func Run(target string, templates []string, extraArgs []string) ([]NucleiResult, error)

Variables

var ErrBinaryNotFound = errors.New("nuclei binary not found")

ErrBinaryNotFound is returned by Run when no usable nuclei binary can be resolved (neither $NUCLEI_BIN nor `nuclei` on PATH). The pipeline treats it as a soft failure and skips verification.

Functions

func FindTemplate

func FindTemplate(dir, cve string) (string, bool)

FindTemplate resolves the evidence template for cve under dir: first <dir>/http/cves/<year>/<cve>.yaml (year = the CVE's 4-digit year, when it is within 2002-2026), then a recursive search below <dir>/http/cves/ for any file named <cve>.yaml.

func NucleiBinary

func NucleiBinary() (string, error)

NucleiBinary resolves the nuclei binary: $NUCLEI_BIN when set, otherwise `nuclei` looked up on PATH.

Types

type NucleiResult

type NucleiResult struct {
	TemplateID  string `json:"template_id"`
	CVE         string `json:"cve,omitempty"`
	MatchedAt   string `json:"matched_at"`
	Severity    string `json:"severity"`
	Name        string `json:"name"`
	MatcherName string `json:"matcher_name,omitempty"`
}

NucleiResult is one verified match emitted by nuclei (JSON Lines).

func ParseLine

func ParseLine(line string) (NucleiResult, error)

ParseLine decodes one JSON Lines match into a NucleiResult. The CVE field is filled from info.classification.cve-id when present, falling back to the template-id itself when it looks like a CVE id.

func Run

func Run(target string, templates []string, extraArgs []string) ([]NucleiResult, error)

Run executes

nuclei -target <target> -t <t1> -t <t2> ... -json -silent [extra args...]

and parses the JSON Lines stdout into stable NucleiResults.