<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-custom-nuclei-templates
description: >-
  Build custom Nuclei templates for vulnerability detection, misconfiguration
  scanning, and exposure identification. Covers HTTP, DNS, network, and headless
  protocol templates with matchers, extractors, workflows, and template validation.
domain: cybersecurity
subdomain: automation-scripting
tags:
  - nuclei
  - vulnerability-scanning
  - templates
  - misconfiguration
  - exposure-detection
  - yaml
  - automation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1595.002"]
---

# Building Custom Nuclei Templates

## Overview

Nuclei is a fast, customizable vulnerability scanner driven by YAML templates.
This skill covers building custom templates for HTTP-based vulnerability detection,
network service scanning, DNS misconfiguration checks, and multi-step workflows.
Templates enable consistent, repeatable scanning across large target sets.

Mode: `[MODE: RED]` — Vulnerability detection with DETECTION OPPORTUNITIES notes.

## Prerequisites

| Requirement | Details |
|---|---|
| Nuclei v3+ installed (`go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest`) | Required |
| YAML editing capability | Required |
| Target list for testing templates | Required |
| Knowledge of HTTP protocols and common vulnerability patterns | Required |

## Key Concepts

### Basic HTTP Template

```yaml
id: custom-admin-panel-detection
info:
  name: Admin Panel Detection
  author: custom
  severity: info
  description: Detects exposed admin panels
  tags: misconfiguration,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin"
      - "{{BaseURL}}/admin/login"
      - "{{BaseURL}}/administrator"
      - "{{BaseURL}}/wp-admin"

    matchers-condition: or
    matchers:
      - type: word
        words:
          - "admin"
          - "login"
          - "dashboard"
        condition: or

      - type: status
        status:
          - 200
          - 302
```

### CVE Detection Template

```yaml
id: cve-2024-example
info:
  name: Example CVE Detection
  author: custom
  severity: critical
  description: Detects vulnerability in target application
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-XXXXX
    cwe-id: CWE-89
  tags: cve,sqli,critical

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/search?q=test'%20OR%201=1--"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "SQL syntax"
          - "mysql_fetch"
        condition: or

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        regex:
          - "(?i)(sql syntax|mysql_fetch|ORA-[0-9]+)"
```

### Multi-Step Authentication Template

```yaml
id: authenticated-endpoint-check
info:
  name: Authenticated Endpoint Access Check
  author: custom
  severity: high
  tags: auth,bola

http:
  - raw:
      - |
        POST /api/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"username":"test","password":"test"}

      - |
        GET /api/admin/users HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{token}}

    extractors:
      - type: regex
        name: token
        part: body
        internal: true
        regex:
          - '"token":"([a-zA-Z0-9._-]+)"'

    matchers:
      - type: status
        status:
          - 200
```

## Workflow

### Step 1: Generate Template Skeleton

```bash
node scripts/agent.js --action generate --type http --id custom-check-001 --severity medium
```

### Step 2: Validate Template

```bash
node scripts/agent.js --action validate --template /tmp/custom-check-001.yaml
```

### Step 3: Test Template

```bash
node scripts/agent.js --action test --template /tmp/custom-check-001.yaml --target https://example.com
```

## Verification

- [ ] Template validates with `nuclei -validate`
- [ ] Matchers correctly identify target condition
- [ ] Extractors capture expected data
- [ ] Template runs without errors against test targets
- [ ] Severity and metadata are accurate

## References

- [Nuclei Template Guide](https://docs.projectdiscovery.io/templates/)
- [Nuclei Templates Repository](https://github.com/projectdiscovery/nuclei-templates)
- [ProjectDiscovery Documentation](https://docs.projectdiscovery.io/)
- [MITRE ATT&CK T1190 — Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)
