Nuclei Command & Template Builder
Build a nuclei command from choices, or write a nuclei detection template as YAML with matchers and extractors, checked against the official flag list and template schema.
Runs in your browser Your input never leaves your device.
nuclei sends real test requests. Use it only on systems you own or have written permission to test. This page builds a command or a template and runs nothing. The template builder writes detection templates only: no payload lists, fuzzing or attack types.
—What each part does
| Flag | Meaning |
|---|
Matchers
Extractors (optional)
—
Commands and templates are built in your browser; nothing is run. Flags were checked against the official nuclei flag list and templates against the official template schema. Run nuclei -validate -t your-template.yaml before using a new template.
Report a problem with this tool
About this tool
nuclei is a template-driven scanner: a command chooses targets and templates, and templates describe a request and how to recognise the answer. This tool has two parts. The command builder turns your choices into a quoted nuclei command: targets or a target file, an exclude list, templates and folders, tags and excluded tags, template IDs, authors, severities to run or skip, protocol types, custom headers and variables, redirects, rate limit, concurrency, bulk size, timeout and retries, and output options such as -silent, JSON lines and an output file. Modes cover scanning, listing the templates that match your filters, listing tags and validating templates. Templates tagged intrusive or dos are skipped by default, and warnings appear for high request rates, credentials in headers and severities that need an agreed window. The template builder writes a detection template: id, info (name, author, severity, description, tags, references), one HTTP request with method, paths, headers and body, any number of matchers (status, words, regex, size, DSL, with part, condition, negative and case-insensitive options) and extractors (regex with group, key-value and JSON). It checks the template id pattern, status codes, sizes and regular expressions, and reminds you that nuclei uses Go (RE2) regular expressions, which do not support lookahead, lookbehind or back-references. By design it offers no payload lists, fuzzing or attack types: templates are for recognising software and exposures. Every flag the command builder can emit exists in the official nuclei flag list (pinned from the nuclei repository), every command round-trips through bash quoting, and hundreds of generated templates were parsed by two YAML parsers and validated against the official nuclei template JSON schema. Run nuclei -validate on a new template before using it. nuclei sends real requests, so use it only on systems you own or have written permission to test.
How to use it
- Choose Command or Template.
- For a command, enter targets and filters, set a modest rate limit, and read the warnings.
- For a template, fill in the info, the request and at least one matcher that identifies the product or issue.
- Copy the result, validate templates with nuclei -validate, and run only against systems you are authorised to test.
Common problems
- The command or template is not shown
- Fix the listed problem first, such as an invalid target, a status code outside 100 to 599 or an invalid regular expression. Output appears only when everything is valid.
- My regular expression is rejected
- nuclei uses Go regular expressions. Remove lookahead, lookbehind and back-references, and test the pattern with a Go-compatible tester.
- The template matches too much
- A status-only matcher matches any page with that code. Add a word or regex matcher for something specific to the product, and keep the condition between matchers on and.