<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# File Detection Templates — API Reference

## File Protocol Execution

```bash
# Scan a single file
nuclei -target /etc/ssh/sshd_config -t file-template.yaml -json

# Scan multiple files from list
nuclei -l file-targets.txt -t file-template.yaml -json

# Scan a directory
nuclei -target /etc/ -t file-template.yaml -json
```

## File Template Fields

| Field | Type | Description |
|-------|------|-------------|
| `extensions` | list | File extensions to match (`all` for any) |
| `path` | list | Specific file paths to check |
| `denylist` | list | Extensions to exclude |
| `max-size` | string | Maximum file size to scan (e.g., `5mb`) |
| `no-recursive` | bool | Disable recursive directory scanning |

## Extension Filtering

```yaml
# Scan specific extensions
file:
  - extensions:
      - yaml
      - yml
      - json
      - conf

# Scan all files
file:
  - extensions:
      - all

# Exclude extensions
file:
  - extensions:
      - all
    denylist:
      - png
      - jpg
      - gif
      - bin
```

## File-Specific DSL Variables

| Variable | Description |
|----------|-------------|
| `raw` | Full file content |
| `path` | File path |
| `extension` | File extension |

## Common File Audit Targets

| Path | Purpose |
|------|---------|
| `/etc/ssh/sshd_config` | SSH server configuration |
| `/etc/passwd` | User accounts |
| `/etc/shadow` | Password hashes |
| `/etc/sudoers` | Sudo configuration |
| `/etc/crontab` | Scheduled tasks |
| `/etc/nginx/nginx.conf` | Nginx configuration |
| `/etc/apache2/apache2.conf` | Apache configuration |
| `~/.ssh/authorized_keys` | SSH authorized keys |
| `~/.bash_history` | Command history |
| `~/.env` | Environment file |
| `/var/log/auth.log` | Authentication log |
| `Dockerfile` | Container build file |
| `docker-compose.yml` | Container orchestration |
| `kubernetes/*.yaml` | Kubernetes manifests |

## CLI Options for File Scanning

| Flag | Description |
|------|-------------|
| `-target` | File or directory path |
| `-l` | List of file paths |
| `-t` | Template file |
| `-json` | JSON output |
| `-silent` | Suppress banner |
| `-v` | Verbose output |
