[opensourcedex]

ProjectDiscovery is a free, open source threat detection & response project written in Go and released under MIT. It has 31,272 GitHub stars, 3,875 forks and 107 open issues, and was last pushed 2 days ago. On this registry it ranks #1 of 2 tracked projects in Threat Detection & Response, with 5 head-to-head comparisons available. It gained 146 stars over the last 6 tracked days.

ProjectDiscovery — Advanced vulnerability detection and management platform

What is ProjectDiscovery?

What it is

Nuclei is a high-performance, open-source vulnerability scanner built by ProjectDiscovery, part of the ProjectDiscovery ecosystem. It operates as a CLI tool using a simple YAML-based DSL to define custom vulnerability checks, enabling precise, real-world exploitation simulation to eliminate false positives.

The project solves the problem of slow, inaccurate, or rigid vulnerability scanning by offering a modular, community-driven platform. Security teams and researchers can rapidly detect known and emerging vulnerabilities across applications, APIs, networks, DNS, and cloud infrastructure without relying on heuristic or signature-only detection methods.

Key capabilities

  • Execute fast, parallel scans using YAML templates for HTTP, TCP, DNS, SSL, WHOIS, JavaScript, and code execution protocols
  • Eliminate false positives by modeling multi-step exploitation paths in templates
  • Integrate with Jira, Splunk, GitHub, Elastic, and GitLab for reporting and workflow automation
  • Scan subdomains, cloud configurations, and network services for misconfigurations and CVEs
  • Run custom templates or pull from the community-maintained nuclei-templates repository
  • Support CI/CD pipeline integration for automated regression testing
  • Access templates for trending vulnerabilities contributed by thousands of security professionals

Who uses it and how

  • Security researchers use it to rapidly validate CVEs and share detection logic via public templates
  • DevSecOps teams embed Nuclei in CI/CD pipelines to catch vulnerabilities before deployment
  • Pentesters run targeted scans against applications, APIs, and infrastructure during engagements
  • Cloud engineers scan AWS, GCP, Azure, and Kubernetes configurations for misconfigurations
  • SOCs and red teams use it for continuous attack surface monitoring and validation

Getting started

Install via go install or download prebuilt binaries from GitHub releases; a free cloud tier is available at cloud.projectdiscovery.io.

When to use it — and when not to

Nuclei replaces manual or heuristic-based scanners with precise, template-driven detection but requires YAML authoring skill for advanced use. Self-hosting demands no external dependencies beyond Go, but running it as a service is discouraged due to security risks. It lacks built-in authentication, session management, and UI—features present in Pro/Enterprise editions. For large-scale, continuous scanning with compliance reporting and team collaboration, the hosted Pro/Enterprise tiers are better suited.

project readme (upstream, from github) — read inline

nuclei

English • 中文 • Korean • Indonesia • Spanish • 日本語 • Portuguese • Türkçe

     


Nuclei is a modern, high-performance vulnerability scanner that leverages simple YAML-based templates. It empowers you to design custom vulnerability detection scenarios that mimic real-world conditions, leading to zero false positives.

  • Simple YAML format for creating and customizing vulnerability templates.
  • Contributed by thousands of security professionals to tackle trending vulnerabilities.
  • Reduce false positives by simulating real-world steps to verify a vulnerability.
  • Ultra-fast parallel scan processing and request clustering.
  • Integrate into CI/CD pipelines for vulnerability detection and regression testing.
  • Supports multiple protocols like TCP, DNS, HTTP, SSL, WHOIS, JavaScript, Code and more.
  • Integrate with Jira, Splunk, GitHub, Elastic, GitLab.


Table of Contents



Get Started

1. Nuclei CLI

Install Nuclei on your machine. Get started by following the installation guide here. Additionally, we provide a free cloud tier that comes with generous monthly free limits:

  • Store and visualize your vulnerability findings
  • Write and manage your Nuclei templates
  • Access the latest Nuclei templates
  • Discover and store your targets

[!Important]

This project is in active development. Expect breaking changes with releases. Review the release changelog before updating.
This project is primarily built to be used as a standalone CLI tool. Running nuclei as a service may pose security risks. It's recommended to use with caution and additional security measures.

2. Pro and Enterprise Editions

For security teams and enterprises, we provide a cloud-hosted service built on top of Nuclei OSS, fine-tuned to help you continuously run vulnerability scans at scale with your team and existing workflows:

  • 50x faster scans
  • Large scale scanning with high accuracy
  • Integrations with cloud services (AWS, GCP, Azure, Cloudflare, Fastly, Terraform, Kubernetes)
  • Jira, Slack, Linear, APIs and Webhooks
  • Executive and compliance reporting
  • Plus: Real-time scanning, SAML SSO, SOC 2 compliant platform (with EU and US hosting options), shared team workspaces, and more
  • We're constantly adding new features!
  • Ideal for: Pentesters, security teams, and enterprises

Sign up to Pro or Talk to our team if you have a large organization and complex requirements.



Documentation

Browse the full Nuclei documentation here. If you’re new to Nuclei, check out our foundational YouTube series.


Installation

nuclei requires go >= 1.24.2 to install successfully. Run the following command to get the repo:

go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

To learn more about installing nuclei, see https://docs.projectdiscovery.io/tools/nuclei/install.

Command Line Flags

To display all the flags for the tool:

nuclei -h
Expand full help flags
Nuclei is a fast, template based vulnerability scanner focusing
on extensive configurability, massive extensibility and ease of use.

Usage:
  ./nuclei [flags]

Flags:
TARGET:
   -u, -target string[]          target URLs/hosts to scan
   -l, -list string              path to file containing a list of target URLs/hosts to scan (one per line)
   -targets-inline string        inline multiline target list (for use in template profiles)
   -eh, -exclude-hosts string[]  hosts to exclude to scan from the input list (ip, cidr, hostname)
   -resume string                resume scan from and save to specified file (clustering will be disabled)
   -sa, -scan-all-ips            scan all the IP's associated with dns record
   -iv, -ip-version string[]     IP version to scan of hostname (4,6) - (default 4)

TARGET-FORMAT:
   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger, http) (default "list")
   -ro, -required-only            use only required fields in input format when generating requests
   -sfv, -skip-format-validation  skip format validation (like missing vars) when parsing input file
   -vtt, -vars-text-templating    enable text templating for vars in input file (only for yaml input mode)
   -vfp, -var-file-paths string[] list of yaml file contained vars to inject into yaml input

TEMPLATES:
   -nt, -new-templates                    run only new templates added in latest nuclei-templates release
   -ntv, -new-templates-version string[]  run new templates added in specific version
   -as, -automatic

readme truncated — read the full docs on github

Frequently asked questions

Is ProjectDiscovery free to use?

ProjectDiscovery is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does ProjectDiscovery do?

Advanced vulnerability detection and management platform

What is ProjectDiscovery written in?

ProjectDiscovery is primarily written in Go. Its source is publicly available at https://github.com/projectdiscovery/nuclei, and it has 31,272 GitHub stars.