Nuclei Workflow Automation

What does Nuclei workflow automation solve?

It makes repeated scans of large target sets easier to reproduce: filter live hosts, prioritize templates, control request rates, and compare findings across runs before handing validated evidence to remediation teams.

Practice discovery and service enumeration in Academy Recon Foundations, or review reconnaissance versus enumeration before designing a pipeline. Use the recon workflow generator to plan the commands for your authorized scope.

Why Traditional Nuclei Usage Breaks at Scale

Most hunters start with Nuclei the same way: nuclei -u https://target.com -t cves/. It works for one target. It falls apart the moment you have 400 subdomains, a rotating scope, or a program that went wide overnight.

The core problems with manual Nuclei usage are orchestration, deduplication, and triage noise. Running Nuclei in isolation — without a prior httpx probe, without scope filtering, without severity gating — produces thousands of findings that are 80% false positives and 20% things you already reported last week. The real work isn't running the scan. It's everything around it.

How Automation Improves Offensive Security Workflows

Effective Nuclei automation isn't about running more templates faster. It's about building a pipeline where every stage produces structured output that the next stage consumes. The pattern is always: enumerate → validate → scan → triage.

When you wire Subfinder, httpx, and Nuclei together with consistent I/O formats, you get a reproducible workflow you can re-run against a target every 24 hours with zero manual setup. New subdomains get automatically swept. Severity thresholds gate what you even look at. Results are structured enough to diff against previous runs.

Example Workflow: Full Nuclei Automation Pipeline

This is a production-grade pipeline that takes a root domain and produces a severity-filtered Nuclei findings report. Each stage feeds the next via output files. Run this on a VPS or schedule it as a cron job against programs you actively hunt.

#!/usr/bin/env bash
# PhantomRed — Nuclei Automation Pipeline
# Usage: ./nuclei-pipeline.sh target.com
# Requires: subfinder, amass, httpx, nuclei (via go install or Homebrew)

TARGET="$1"
OUTDIR="./results/${TARGET}"
mkdir -p "$OUTDIR"

# STAGE 1 — Passive subdomain enumeration
echo "[*] Enumerating subdomains for $TARGET"

/opt/homebrew/bin/subfinder \
  -d "$TARGET" \
  -silent \
  -o "$OUTDIR/subs-subfinder.txt"

/opt/homebrew/bin/amass enum \
  -passive \
  -d "$TARGET" \
  -o "$OUTDIR/subs-amass.txt"

# Merge and deduplicate
cat "$OUTDIR/subs-subfinder.txt" "$OUTDIR/subs-amass.txt" \
  | sort -u \
  > "$OUTDIR/subs-all.txt"

echo "[*] Found $(wc -l < $OUTDIR/subs-all.txt) unique subdomains"

# STAGE 2 — Live host probing
echo "[*] Probing live hosts"

/opt/homebrew/bin/httpx \
  -l "$OUTDIR/subs-all.txt" \
  -silent \
  -threads 50 \
  -timeout 10 \
  -tech-detect \
  -status-code \
  -o "$OUTDIR/live-hosts.txt"

echo "[*] Live hosts: $(wc -l < $OUTDIR/live-hosts.txt)"

# STAGE 3 — Nuclei scan (severity-gated, high-value templates)
echo "[*] Running Nuclei scan"

/opt/homebrew/bin/nuclei \
  -l "$OUTDIR/live-hosts.txt" \
  -t exposures/,cves/,vulnerabilities/,misconfiguration/ \
  -severity medium,high,critical \
  -rate-limit 50 \
  -bulk-size 25 \
  -timeout 10 \
  -retries 1 \
  -silent \
  -json \
  -o "$OUTDIR/nuclei-results.json"

# STAGE 4 — Sort and triage by severity
echo "[*] Triage summary:"

/opt/homebrew/bin/jq \
  -r '[.info.severity, .host, .info.name] | @tsv' \
  "$OUTDIR/nuclei-results.json" \
  | sort -k1 \
  > "$OUTDIR/nuclei-sorted.txt"

echo "  Critical : $(grep -c 'critical' $OUTDIR/nuclei-sorted.txt)"
echo "  High     : $(grep -c 'high' $OUTDIR/nuclei-sorted.txt)"
echo "  Medium   : $(grep -c 'medium' $OUTDIR/nuclei-sorted.txt)"
echo "[✓] Results: $OUTDIR/nuclei-sorted.txt"

For targets with JavaScript-heavy frontends, add a katana crawl stage before Nuclei to discover endpoints that subdomain enumeration alone won't surface. See also the Recon Workflow Generator to auto-generate custom pipeline scripts for any target profile.

How PhantomRed Automates This

PhantomRed provides separate recon and vulnerability scanning modes, with findings and reports in a structured dashboard. Use the workflow generator to plan your recon commands; the shell pipeline above remains an example for your own authorized environment.

PhantomRed saves completed scans and supports scan comparisons, risk trends, scheduled rescans, and reporting. Review scan differences to identify changes, then validate findings before remediation.

Manual Nuclei Workflow vs PhantomRed

The commands above work — but every stage needs a human to wire it to the next, set the right limits, and triage the output. Here is what the manual chain looks like next to an automated run.

Real Nuclei Automation Workflow Examples

These are production patterns used by active bug bounty hunters. Each example is self-contained — copy, adapt for your target, and run. Explanations cover where false positives occur, why rate limiting matters, and how to handle output at scale.

One-liner: Live subdomain sweep into Nuclei

The fastest way to go from a root domain to vulnerability findings. Pipes subfinder directly into httpx for live filtering, then into nuclei for scanning — no intermediate files needed for quick recon.

subfinder -d target.com -silent |   httpx -silent |   nuclei -t cves/,exposures/ -severity medium,high,critical -silent

Severity-gated scan from live host list

When you already have a live.txt from a previous httpx run, skip re-probing and go straight to scanning. Gate severity at critical and high to eliminate low-signal noise before triage.

cat live.txt | nuclei   -severity critical,high   -rl 50   -bulk-size 25   -timeout 10   -silent   -json   -o nuclei-high-crit.json

Tag-based scan: exposures and misconfigs only

Instead of selecting by template directory, select by tag. This lets you run cross-category scans targeting specific vulnerability classes without loading unrelated templates. Useful for focused recon passes on new scope additions.

nuclei   -list live.txt   -tags exposure,misconfig,default-login   -rl 50   -silent   -json   -o exposure-scan.json

Nmap → Nuclei service-based chaining

When you have open port data from Nmap, feed service-specific hosts directly into Nuclei with matching templates. This eliminates wasted template execution against services that aren't even running the relevant software.

# Extract hosts with port 8080 open from Nmap XML
python3 -c "
import xml.etree.ElementTree as ET, sys
tree = ET.parse('nmap-output.xml')
for host in tree.findall('.//host'):
    for port in host.findall('.//port[@portid="8080"]'):
        if port.find('state').get('state') == 'open':
            addr = host.find('address').get('addr')
            print(f'http://{addr}:8080')
" > targets-8080.txt

# Scan only those hosts with relevant templates
nuclei   -l targets-8080.txt   -t vulnerabilities/,panels/   -rl 30   -json   -o nmap-nuclei-results.json

Output triage: extract and sort JSON findings

Nuclei JSON output contains everything — host, template ID, severity, matched URL, and extracted values. Use jq to flatten it into a triage-ready format you can diff against previous runs.

# Sort by severity, extract host + template + matched URL
jq -r   '[.info.severity, .host, .info.name, .matched_at] | @tsv'   nuclei-results.json   | sort -k1   > triage-sorted.txt

# Count by severity
jq -r '.info.severity' nuclei-results.json   | sort | uniq -c | sort -rn

# Diff against previous run (net-new only)
comm -13   <(sort previous-run.txt)   <(sort triage-sorted.txt)   > new-findings.txt

Nuclei Template Categories Explained

Nuclei ships with 9,000+ community templates organized into categories. Knowing which categories to run — and when — is the difference between a 10-minute targeted scan and a 3-hour noise fest. Here are the six categories that matter most for bug bounty and pentesting workflows.

Common Mistakes in Nuclei Automation

Most hunters make the same five mistakes when they first automate Nuclei. Each one either burns time on false positives, misses real findings, or risks getting banned from a program. Here's what to avoid and why.

Benefits of Nuclei Workflow Automation

• Reproducible results — the same pipeline runs against the same target every day with zero manual setup, so you catch newly introduced vulnerabilities on scope expansion
• Reduced false positive volume — gating scans on live hosts (httpx first) eliminates a large fraction of template execution against dead or redirect-only subdomains
• Faster triage — JSON output with severity fields means you can sort, filter, and diff findings programmatically instead of reading through raw text
• Template precision — running targeted categories (exposures, CVEs, misconfigs) rather than all 9,000+ templates keeps scan time under 15 minutes for most mid-sized programs
• Rate-limit safety — parameterized rate limits and bulk-size controls prevent accidental hammering of targets, which matters especially on private programs
• Coverage continuity — scheduled pipelines ensure you're the first hunter to catch a new exposure when a target deploys a misconfigured service or rotates to a vulnerable framework version

Frequently Asked Questions