Nuclei on staging: run curated templates and triage the results

What a template run does

Nuclei sends requests described by YAML templates and reports when a response matches. The community template set covers exposed panels, misconfigurations, default files, and known CVEs. A run is only as targeted as the templates you select, so choosing them is the main decision.

Run it against systems in scope. Some templates send requests that create log noise or trip a web application firewall, so tell the owners of shared environments before you start.

Selecting templates and pace

Update templates first, then filter by tag and severity. -etags excludes categories such as intrusive or fuzz. -rl and -c bound requests per second and concurrency. -jsonl output keeps the matched request so you can reproduce a result.

nuclei -ut
nuclei -u https://staging.hackblue-lab.org \
  -tags exposure,misconfig,tech -etags intrusive,fuzz,dos \
  -severity low,medium,high,critical \
  -rl 20 -c 5 -jsonl -o nuclei.jsonl

jq -r '[.info.severity, ."template-id", ."matched-at"] | @tsv' nuclei.jsonl | sort

A results excerpt

Each line names the template, protocol, severity, and URL. Some templates add extracted values in brackets, such as a version string.

[tech-detect:nginx] [http] [info] https://staging.hackblue-lab.org
[nginx-version] [http] [info] https://staging.hackblue-lab.org [nginx/1.18.0]
[git-config] [http] [medium] https://staging.hackblue-lab.org/.git/config
[http-missing-security-headers:strict-transport-security] [http] [info] https://staging.hackblue-lab.org

Worked triage of three findings

The .git/config match is real: the deploy copied the repository folder into the web root. Fetching the file in a browser confirms it, and the fix is a deploy rule that excludes .git plus a server rule that denies dot-folders.

The version banner is informational. It matters only if that nginx release has a vulnerability relevant to how the host is configured, so it goes into the patch queue rather than the incident queue. The missing HSTS header is a one-line configuration change that belongs in the same ticket as the dot-folder rule.