<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-workflow-templates
description: >-
  Build Nuclei workflow templates that chain multiple templates into
  conditional scanning pipelines. Covers technology detection workflows,
  tag-based routing, subtemplate execution, and shared-context workflows.
domain: cybersecurity
subdomain: nuclei-templating
tags:
  - nuclei
  - workflows
  - automation
  - template-chaining
  - conditional
  - pipelines
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Building Workflow Templates

## Overview

Workflow templates orchestrate multiple detection templates into intelligent
scanning pipelines. They enable conditional execution — run specific CVE checks
only after confirming the target technology, chain reconnaissance into
exploitation, and build comprehensive assessment suites.

Mode: `[MODE: BLUE]` — Automated security assessment pipeline design.

## Prerequisites

| Requirement | Details |
|---|---|
| Nuclei v3+ with workflow support | Required |
| Library of detection templates to chain | Required |
| Understanding of target technology stacks | Required |

## Key Concepts

### Basic Workflow

```yaml
id: wordpress-security-workflow

info:
  name: WordPress Security Assessment Workflow
  author: nerf
  severity: info
  description: |
    Comprehensive WordPress security assessment that first detects
    WordPress installation then runs targeted vulnerability checks.
  tags: workflow,wordpress,cms

workflows:
  - template: technologies/wordpress-detect.yaml
    subtemplates:
      - template: vulnerabilities/wordpress/wp-xmlrpc-enabled.yaml
      - template: vulnerabilities/wordpress/wp-user-enumeration.yaml
      - template: vulnerabilities/wordpress/wp-debug-log.yaml
      - template: vulnerabilities/wordpress/wp-config-backup.yaml
```

### Tag-Based Workflow

```yaml
id: tech-specific-cve-workflow

info:
  name: Technology-Specific CVE Scanning Workflow
  author: nerf
  severity: info
  description: |
    Detects running technologies then applies relevant CVE templates
    based on identified software.
  tags: workflow,cve,tech-detect

workflows:
  - template: technologies/tech-detect.yaml
    subtemplates:
      - tags: apache
        templates:
          - cves/apache/
      - tags: nginx
        templates:
          - cves/nginx/
      - tags: iis
        templates:
          - cves/iis/
      - tags: tomcat
        templates:
          - cves/tomcat/
      - tags: php
        templates:
          - cves/php/
```

### Multi-Stage Reconnaissance Workflow

```yaml
id: comprehensive-recon-workflow

info:
  name: Comprehensive Reconnaissance Workflow
  author: nerf
  severity: info
  tags: workflow,recon,assessment

workflows:
  # Stage 1: Technology fingerprinting
  - template: technologies/waf-detect.yaml
  - template: technologies/tech-detect.yaml
    subtemplates:
      # Stage 2: Version-specific checks
      - tags: apache
        templates:
          - cves/apache/
      - tags: nginx
        templates:
          - cves/nginx/

  # Stage 3: Generic misconfiguration checks
  - template: misconfiguration/
    subtemplates:
      - template: exposures/

  # Stage 4: Exposure and leak checks
  - template: exposures/configs/
  - template: exposures/backups/
```

### Matcher-Conditional Workflow

```yaml
id: authenticated-assessment-workflow

info:
  name: Authenticated Assessment Workflow
  author: nerf
  severity: info
  tags: workflow,auth,assessment

workflows:
  # First check if login page exists
  - template: detect/login-page.yaml
    subtemplates:
      # If login found, try default credentials
      - template: default-logins/
        subtemplates:
          # If login succeeds, run authenticated checks
          - template: authenticated/admin-checks.yaml
          - template: authenticated/privilege-escalation.yaml
          - template: authenticated/data-exposure.yaml
```

### Parallel Workflow Execution

```yaml
id: full-assessment-workflow

info:
  name: Full Security Assessment Workflow
  author: nerf
  severity: info
  tags: workflow,assessment,comprehensive

workflows:
  # These run in parallel as independent chains
  - template: technologies/tech-detect.yaml
    subtemplates:
      - tags: wordpress
        templates:
          - vulnerabilities/wordpress/
      - tags: joomla
        templates:
          - vulnerabilities/joomla/

  - template: misconfiguration/http-missing-security-headers.yaml
  - template: exposures/configs/
  - template: exposures/tokens/
  - template: vulnerabilities/generic/
```

## Workflow

### Step 1: Run Workflow

```bash
node scripts/agent.js --action run --target https://staging.example.com \
  --workflow workflow.yaml --output /tmp/workflow-results.json
```

### Step 2: Validate Workflow

```bash
node scripts/agent.js --action validate --workflow workflow.yaml
```

## Verification

- [ ] Workflow starts with detection/fingerprinting templates
- [ ] Subtemplates only run when parent template matches
- [ ] Tag-based routing covers all expected technology stacks
- [ ] Template paths are relative and resolve correctly
- [ ] Independent scan chains are at the same workflow level
- [ ] Workflow tested end-to-end against known target stack
- [ ] Performance acceptable — no unnecessary template execution

## References

- [Nuclei Workflows](https://docs.projectdiscovery.io/templates/workflows/overview)
- [Nuclei Template Matchers](https://docs.projectdiscovery.io/templates/reference/matchers)
