Writing a Nuclei template that checks your own baseline

Templates as policy checks

Community templates look for other people’s mistakes. A team can also write templates for its own rules: every login page sends HSTS, no host exposes an actuator endpoint, the status page never shows stack traces. Running those weekly turns a written standard into something measured.

The template

This template requests /login and matches when the status is 200 and the response headers do not contain Strict-Transport-Security. negative: true inverts a word matcher. Give internal templates an id prefix so they never collide with community ones.

Snippet

id: hb-login-missing-hsts
info:
  name: Login page without HSTS
  author: hackblue-blue
  severity: low
  tags: hb-baseline,headers
http:
  - method: GET
    path:
      - "{{BaseURL}}/login"
    matchers-condition: and
    matchers:
      - type: status
        status: [200]
      - type: word
        part: header
        words: ["strict-transport-security"]
        case-insensitive: true
        negative: true

Validate, then run across the inventory

nuclei -validate parses the template and reports schema errors. Test it against one host where you know the answer before running it on the full list from the httpx lesson.

Snippet

nuclei -validate -t templates/hb-login-missing-hsts.yaml
nuclei -t templates/hb-login-missing-hsts.yaml -u https://staging.hackblue-lab.org
nuclei -t templates/ -tags hb-baseline -l live-urls.txt -rl 10 -o baseline.txt

[hb-login-missing-hsts] [http] [low] https://staging.hackblue-lab.org/login

Worked rollout

The first full run flags four of nineteen hosts. Three share a reverse proxy configuration, so one change fixes them. The fourth is a vendor appliance; the ticket goes to the vendor and the host gets an exception with an expiry date in the template repository’s README.

The scheduled job then fails only on new hosts, which is exactly when someone needs to look.

Diagram

From written rule to scheduled check

Rule
State the requirement in one sentence.
Policy
```
Login pages must send Strict-Transport-Security.
```
Template
Express it as matchers on one request.
YAML
```
type: word
part: header
negative: true
```

Validate

Parse and test on a known host.

Command

nuclei -validate -t templates/hb-login-missing-hsts.yaml

Schedule
Run the tag weekly across the inventory.
Command
```
nuclei -t templates/ -tags hb-baseline -l live-urls.txt
```

Check yourself

1. What does negative: true do on a word matcher?

2. Which command checks a template for schema errors before any request is sent?

3. A vendor appliance cannot send HSTS yet. How should the baseline handle it?