<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Custom Nuclei Templates — API Reference

## Nuclei CLI

```bash
# Run with single template
nuclei -t template.yaml -u https://target.com

# Run template directory
nuclei -t ./templates/ -l targets.txt

# Run with tags
nuclei -tags cve,sqli -u https://target.com

# Severity filter
nuclei -severity critical,high -u https://target.com

# JSON output
nuclei -t template.yaml -u https://target.com -jsonl -o results.json

# Validate templates
nuclei -validate -t ./templates/

# Update templates
nuclei -update-templates

# Rate limiting
nuclei -t template.yaml -l targets.txt -rate-limit 100 -concurrency 25

# Proxy through Burp
nuclei -t template.yaml -u https://target.com -proxy http://127.0.0.1:8080
```

## Template Structure

### Matchers

```yaml
# Word matcher
matchers:
  - type: word
    words: ["error", "exception"]
    condition: or
    part: body  # body, header, all

# Status matcher
  - type: status
    status: [200, 301]

# Regex matcher
  - type: regex
    regex:
      - "(?i)sql syntax"
      - "ORA-[0-9]+"

# Binary matcher
  - type: binary
    binary: ["504b0304"]  # ZIP header

# DSL matcher (complex conditions)
  - type: dsl
    dsl:
      - "status_code == 200 && contains(body, 'admin')"
      - "len(body) > 1000"
```

### Extractors

```yaml
# Regex extractor
extractors:
  - type: regex
    regex:
      - '"token":"([a-zA-Z0-9._-]+)"'
    group: 1

# JSON extractor
  - type: json
    json:
      - ".data.token"

# XPath extractor
  - type: xpath
    xpath:
      - "//input[@name='csrf']/@value"

# KVal (key-value) extractor
  - type: kval
    kval:
      - "set-cookie"
```

### Variables and Payloads

```yaml
# Variables
variables:
  domain: "{{Hostname}}"
  path: "/api/v1"

# Payloads (wordlist)
payloads:
  username:
    - admin
    - root
    - test
  password:
    - password
    - admin123
    - test

attack: clusterbomb  # or pitchfork, sniper

# Built-in variables
# {{BaseURL}} — full URL with path
# {{RootURL}} — URL without path
# {{Hostname}} — hostname only
# {{Host}} — host:port
# {{Port}} — port number
# {{Path}} — URL path
# {{Scheme}} — http or https
```

### Workflows

```yaml
id: comprehensive-scan
info:
  name: Comprehensive Web Scan
  author: custom
  severity: info

workflows:
  - template: http/technologies/tech-detect.yaml
    subtemplates:
      - tags: wordpress
        templates:
          - http/vulnerabilities/wordpress/
      - tags: joomla
        templates:
          - http/vulnerabilities/joomla/
```

## Template Categories

| Category | Description |
|----------|-------------|
| `http/cves/` | Known CVE detection |
| `http/misconfiguration/` | Server misconfigurations |
| `http/exposures/` | Exposed files and data |
| `http/technologies/` | Technology fingerprinting |
| `http/vulnerabilities/` | Generic vulnerability checks |
| `network/` | Network service detection |
| `dns/` | DNS misconfiguration |
| `ssl/` | TLS/SSL checks |
| `headless/` | Browser-based checks |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | No findings |
| 1 | Findings detected |
| 2 | Template or runtime error |
