Nuclei Templates

A standard Nuclei template consists of an id for identification, an info block for metadata (name, author, severity, description, references, classification, tags), and a protocol-specific block (like http or network) containing requests and matchers.

Key metadata fields include:

• severity: critical|high|medium|low|info
• classification: Can include cve-id, cwe-id, or cvss-metrics.
• tags: Comma-separated strings for categorization.

id: template-identifier
info:
  name: Human Readable Vulnerability Name
  author: your-github-username,vulnerability-discoverer-handle
  severity: critical|high|medium|low|info
  description: Clear explanation of what this template detects
  reference:
    - https://link-to-vulnerability-details
  classification:
    cve-id: CVE-2024-1234
    cwe-id: CWE-89
  tags: cve,sqli,rce
  metadata:
    verified: true
    shodan-query: 'http.title:\"VulnApp\"'

http:
  - method: GET
    path:
      - "{{BaseURL}}/vulnerable-endpoint"
    
    matchers:
      - type: word
        words:
          - "vulnerability_indicator"
        part: body

Avoid weak matchers that rely on generic terms (like admin or login) or version-only detection, as these cause high false positive rates. Instead, use a Multi-Layer Verification Strategy by setting matchers-condition: and and combining multiple layers:

1. Layer 1 (Identification): Identify the specific application (e.g., exact page title or unique body text).
2. Layer 2 (Version): Confirm the vulnerable version range using regex.
3. Layer 3 (Exploitation): Verify actual vulnerability presence using a unique payload response or command output indicator.

Use condition: or within a layer if multiple proof methods are available.

# Multi-layer verification example
matchers-condition: and
matchers:
  - type: word                    # Layer 1: Identify application
    words:
      - "Grafana Dashboard"
      - "grafana.com/login"
    part: body
    
  - type: regex                   # Layer 2: Confirm version
    regex:
      - 'version.*[6-8]\.[0-5]\.[0-9]'
    part: body
    
  - type: word                    # Layer 3: Verify exploit success
    words:
      - "unauthorized_data_access"
      - "/api/snapshots/{{randstr}}"
    part: body
    condition: or

For high-fidelity templates, use a multi-layered approach by setting matchers-condition: and and defining multiple matcher layers. This strategy typically involves:

1. Layer 1: Identify the specific application or service.
2. Layer 2: Confirm the vulnerable version via regex.
3. Layer 3: Verify the actual vulnerability exists (e.g., checking for exposed debug info or configuration leaks).

# Use multiple verification layers
matchers-condition: and
matchers:
  - type: word           # Layer 1: Identify the application
    words:
      - "VulnApp Management Console"
    part: body
    
  - type: regex          # Layer 2: Confirm vulnerable version
    regex:
      - 'Version: [1-2]\.[0-5]\.[0-9]'
    part: body
    
  - type: word           # Layer 3: Verify vulnerability exists
    words:
      - "debug_info_exposed"
      - "configuration_leak"
    part: body
    condition: or

HTTP templates define requests using methods (GET, POST, PUT, DELETE), paths, headers, and bodies.

Key features:

• Dynamic Variables: Use {{BaseURL}} or {{Hostname}} to reference the target.
• Custom Headers/Body: Define headers and body (supports multi-line strings using |).
• Cookie Handling: Use disable-cookie: false (default) to reuse cookies.
• Matchers Condition: Use matchers-condition: and to require all matchers to pass, or or for any.

http:
  - method: GET|POST|PUT|DELETE
    path:
      - "{{BaseURL}}/endpoint"
        # Alternative dynamic variable
      - "{{Hostname}}/another-path"
    
    headers:
      User-Agent: Custom-Agent-String
      Content-Type: application/json
      Origin: https://example.com
    
    body: |
      {"param": "{{payload}}"}
    
    disable-cookie: false
    
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "success_indicator"
        part: body