How do I chain Nmap and Nuclei together?

Run Nmap to discover live hosts and open ports, save output with -oG or -oN, then extract live host IPs/hostnames and feed them into Nuclei with the -l flag. Nuclei will run its templates against each host. This two-step chain automates service discovery followed by CVE and misconfiguration detection.

What is the best FFUF wordlist for bug bounty?

For general directory fuzzing, SecLists raft-medium-directories.txt and common.txt provide good coverage. For API endpoint discovery, api_endpoints.txt is effective. For parameter fuzzing, burp-parameter-names.txt has high signal. Install SecLists from github.com/danielmiessler/SecLists.

What Nuclei templates should I run for bug bounty?

Start with severity filters: nuclei -severity critical,high for highest-impact findings. The -tags cve flag targets known CVEs specifically. The -tags misconfig flag catches exposed panels, default credentials, and security misconfigurations. Running all templates (-t /path/to/nuclei-templates) gives maximum coverage but takes longer.

How fast is Nmap + Nuclei + FFUF on a real target?

On a single host: Nmap fast scan (~2 min), Nuclei critical/high templates (~5 min), FFUF with medium wordlist (~10 min). Total: roughly 15–20 minutes per host. On large scopes with hundreds of subdomains, parallel execution is essential. PhantomRed runs this pipeline server-side with parallelization built in.

Nmap + Nuclei + FFUF Automation Pipeline

// why these three tools

The core of every automated recon pipeline

Nmap, Nuclei, and FFUF together cover the three most valuable phases of external reconnaissance: understanding what is running (Nmap), detecting known vulnerabilities against what is running (Nuclei), and discovering hidden attack surface that isn't linked anywhere (FFUF).

Each tool is best-in-class for its specific job. Nmap is the standard for port and service discovery. Nuclei is the fastest way to run thousands of vulnerability templates. FFUF is the fastest web fuzzer available for path and parameter discovery. Chaining them in sequence produces a comprehensive initial recon pass without manual intervention between steps.

PhantomRed runs this entire chain automatically server-side. This guide covers how to run and chain them yourself — including the specific flags that matter for bug bounty and pentest workflows.

// tool 01

Nmap — port and service discovery

Nmap (Network Mapper) is the standard tool for discovering open ports, running services, and software versions on a target. For pentest recon, the goal is to build a complete picture of what is exposed and what software is running before running any vulnerability scanner.

🔍

Nmap

Network exploration and security auditing

brew install nmap | apt install nmap

Key flags for pentest recon

Flag	What it does
-sV	Service version detection — identifies software names and version strings on open ports
-sC	Runs default NSE scripts — anonymous FTP, HTTP info, SSL certs, SMB info, and more
-F	Fast mode — scans only the top 100 most common ports instead of all 65535
-p-	Scans all 65535 ports — slower but finds non-standard service ports
-T3	Normal timing — balanced speed vs stealth. Use T4 for speed, T2 for quieter scanning
-oN	Normal output format — human-readable file output for review and documentation
-oG	Greppable output — machine-parseable format, easy to pipe into other tools
-iL	Input from file — scan a list of targets instead of a single host
--open	Only show open ports — filters out closed and filtered ports for cleaner output

Commands for bug bounty recon

# Fast scan — top 100 ports, quick results
nmap -F --open target.com -oN nmap_fast.txt

# Full recon scan — versions + scripts
nmap -sV -sC --open target.com -oN nmap_full.txt

# Scan a list of hosts from a file
nmap -sV -sC --open -iL live_hosts.txt -oN nmap_bulk.txt

# All ports scan (slower but thorough)
nmap -p- -sV -T3 target.com -oN nmap_allports.txt

# Extract live IPs from greppable output for next stage
grep "open" nmap_fast.gnmap | awk '{print $2}' > live_ips.txt
  

// tool 02

Nuclei — CVE and misconfiguration scanning

Nuclei is a fast, template-based vulnerability scanner developed by ProjectDiscovery. It runs community and official templates against targets to detect CVEs, exposed admin panels, default credentials, misconfigurations, and security header issues. With 9000+ templates, it is the fastest way to run a comprehensive vulnerability check against a discovered attack surface.

☢️

Nuclei

Template-based vulnerability scanner by ProjectDiscovery

go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

Key flags for bug bounty scanning

Flag	What it does
-u	Single target URL or host to scan
-l	Input from file — list of URLs or hosts
-t	Template path — specify a template directory or individual template file
-severity	Filter by severity: critical, high, medium, low, info — use critical,high for first pass
-tags	Filter by template tags: cve, misconfig, exposed-panels, default-logins, and more
-o	Output file path for findings
-json	JSON output format — machine-parseable, good for piping into reports
-rate-limit	Max requests per second — reduce to avoid triggering WAFs or rate limits
-c	Concurrency — number of templates to run in parallel. Default 25, reduce if unstable
-update-templates	Pull latest templates from the community repo before scanning

Commands for bug bounty scanning

# Update templates first
nuclei -update-templates

# Scan single target — critical and high severity only
nuclei -u https://target.com -severity critical,high -o nuclei_critical.txt

# Scan a list of hosts from Nmap output
nuclei -l live_hosts.txt -severity critical,high -o nuclei_findings.txt

# CVE-specific scan
nuclei -l live_hosts.txt -tags cve -o nuclei_cves.txt

# Exposed panels and misconfigurations
nuclei -l live_hosts.txt -tags misconfig,exposed-panels -o nuclei_misconfig.txt

# Full scan with rate limiting (safer against production targets)
nuclei -l live_hosts.txt -rate-limit 50 -o nuclei_full.txt -json
  

// tool 03

FFUF — path and parameter fuzzing

FFUF (Fuzz Faster U Fool) is the fastest web fuzzer in the standard pentest toolkit. It discovers hidden directories, admin panels, backup files, API endpoints, and unlinked parameters by substituting a wordlist into a URL pattern. For bug bounty work, FFUF often finds the most interesting attack surface that isn't discoverable by Nuclei or Nmap.

💥

FFUF

Fast web fuzzer for directory and parameter discovery

go install github.com/ffuf/ffuf/v2@latest

Key flags for bug bounty fuzzing

Flag	What it does
-u	Target URL with FUZZ as the injection point (e.g. https://target.com/FUZZ)
-w	Wordlist path — the list of values to substitute at FUZZ position
-mc	Match HTTP status codes — only show responses with these codes (e.g. 200,301,302,403)
-fc	Filter status codes — hide responses with these codes (e.g. -fc 404 to hide not-found)
-fs	Filter by response size — hide responses of a specific byte size (filters false positives)
-o	Output file for results
-of	Output format — json, csv, html, md, or all
-t	Threads — number of concurrent requests. Default 40, increase for speed
-rate	Rate limit in requests per second — reduce to avoid WAF blocks
-recursion	Recurse into discovered directories — finds nested paths automatically
-e	Extensions to append — e.g. -e .php,.bak,.txt to find backup files

Commands for bug bounty fuzzing

# Basic directory fuzzing
ffuf -u https://target.com/FUZZ -w /path/to/common.txt -mc 200,301,302,403

# With output file and filter for noise
ffuf -u https://target.com/FUZZ -w /path/to/raft-medium.txt \
  -mc 200,301,302,403 -fc 404 -o ffuf_dirs.json -of json

# Find backup files and config files
ffuf -u https://target.com/FUZZ -w /path/to/common.txt \
  -e .bak,.old,.txt,.zip,.sql,.config -mc 200

# Parameter fuzzing
ffuf -u "https://target.com/page?FUZZ=test" \
  -w /path/to/burp-params.txt -mc 200

# With rate limiting for production-safe scanning
ffuf -u https://target.com/FUZZ -w /path/to/wordlist.txt \
  -rate 50 -mc 200,301,302 -o ffuf_safe.json
  

// putting it together

Chaining Nmap → Nuclei → FFUF

The full power of these tools comes from chaining them: Nmap discovers what is running, Nuclei checks what is running for known vulnerabilities, and FFUF finds hidden attack surface on the discovered web services.

Stage 1: Nmap discovers live hosts and open ports

Run Nmap against your scope. Extract live web hosts (ports 80, 443, 8080, 8443) for the next stages.

# Scan and save greppable output
nmap -sV -sC --open -iL scope.txt -oG nmap_out.gnmap

# Extract web hosts (port 80 or 443 open)
grep "80/open\|443/open" nmap_out.gnmap | awk '{print $2}' > web_hosts.txt
    

Stage 2: Nuclei scans web hosts for known vulnerabilities

Feed the web hosts from Stage 1 into Nuclei. Start with high-severity templates for fastest triage.

# Add https:// prefix to hosts
sed 's/^/https:\/\//' web_hosts.txt > web_urls.txt

# Run Nuclei against all discovered web URLs
nuclei -l web_urls.txt -severity critical,high -o nuclei_out.txt
    

Stage 3: FFUF fuzzes each web host for hidden paths

Run FFUF against each live web host to discover hidden directories, admin panels, and backup files.

# Loop through web URLs and fuzz each
while read url; do
  host=$(echo $url | sed 's/https:\/\///' | tr '/' '_')
  ffuf -u "${url}/FUZZ" -w /path/to/common.txt \
    -mc 200,301,302,403 -o "ffuf_${host}.json" -of json
done < web_urls.txt
    

Or: let PhantomRed run the full chain automatically

PhantomRed executes Nmap, Nuclei, FFUF, and SQLMap server-side in a single automated pipeline. Submit a target and get a risk-scored, AI-analyzed report — without managing any of the above locally.

# The PhantomRed equivalent of all stages above:
Go to phantomred.com/dashboard
Submit your target domain or IP
PhantomRed runs the full pipeline server-side
Download your risk-scored report
    

// faq

Frequently asked questions

How do I chain Nmap output into Nuclei? +

Run Nmap with -oG to produce greppable output. Extract live hosts with: grep "open" nmap_out.gnmap | awk '{print $2}' > live_hosts.txt. Prepend https:// using sed: sed 's/^/https:\/\//' live_hosts.txt > urls.txt. Then run: nuclei -l urls.txt -severity critical,high -o nuclei_out.txt.

What wordlist should I use with FFUF for bug bounty? +

For directory fuzzing: SecLists raft-medium-directories.txt and common.txt are the most widely used. For API endpoint discovery: api_endpoints.txt from SecLists. For parameter fuzzing: burp-parameter-names.txt. Install SecLists from: github.com/danielmiessler/SecLists. Clone to /opt/SecLists for a standard path.

How do I avoid getting blocked when running FFUF? +

Use the -rate flag to limit requests per second: -rate 50 for production-safe scanning. Add a realistic User-Agent with -H "User-Agent: Mozilla/5.0...". Avoid running multiple FFUF processes against the same host simultaneously. If you hit a 429 (rate limit), stop and reduce the rate. Some WAFs block based on IP — use the program's VPN or recognized scanner IP if provided.

Which Nuclei templates have the best signal-to-noise for bug bounty? +

For highest signal: -severity critical,high -tags cve finds known CVEs; -tags exposed-panels finds admin panels and management interfaces; -tags default-logins catches credential stuffing candidates; -tags misconfig finds misconfigured security headers and exposed services. Avoid running -severity info on a first pass — it generates a high volume of low-signal findings that slow triage.

Can PhantomRed run Nmap, Nuclei, and FFUF for me automatically? +

Yes. PhantomRed runs Nmap, Nuclei, FFUF, and SQLMap server-side in a single automated pipeline. You submit a target domain or IP through the dashboard, and the platform executes the full chain — no local installation, no wordlist management, no template updates required. An AI layer then analyzes all findings and produces a risk-scored report. Free tier includes 3 scans per month.

// related guides

Guides, comparisons, and resources for bug bounty hunters and pentesters.

Nmap + Nuclei + FFUF Automation How to Automate Bug Bounty Recon PhantomRed vs Burp Suite PhantomRed vs OWASP ZAP Recon Automation for Bug Bounty

// skip the toolchain

Run Nmap + Nuclei + FFUF automatically

PhantomRed chains the full pipeline server-side. Submit a target, get a risk-scored report. Free tier includes 3 scans per month — no credit card required.

Try PhantomRed Free → View Hunter Profile ↗