Nuclei is a fast, template based vulnerability scanner focusing
on extensive configurability, massive extensibility and ease of use.

Usage:
  nuclei [flags]

Flags:
TARGET:
   -u, -target string[]  target URLs/hosts to scan
   -l, -list string      path to file containing a list of target URLs/hosts to scan (one per line)

TEMPLATES:
   -tl                      list all available templates
   -t, -templates string[]  template or template directory paths to include in the scan
   -w, -workflows string[]  list of workflows to run
   -nt, -new-templates      run newly added templates only
   -validate                validate the passed templates to nuclei

FILTERING:
   -tags string[]                         execute a subset of templates that contain the provided tags
   -include-tags string[]                 tags from the default deny list that permit executing more intrusive templates
   -etags, -exclude-tags string[]         exclude templates with the provided tags
   -include-templates string[]            templates to be executed even if they are excluded either by default or configuration
   -exclude-templates, -exclude string[]  template or template directory paths to exclude
   -severity, -impact value[]             Templates to run based on severity. Possible values: info, low, medium, high, critical
   -author string[]                       execute templates that are (co-)created by the specified authors

OUTPUT:
   -o, -output string            output file to write found issues/vulnerabilities
   -silent                       display findings only
   -v, -verbose                  show verbose output
   -vv                           display extra verbose information
   -nc, -no-color                disable output content coloring (ANSI escape codes)
   -json                         write output in JSONL(ines) format
   -irr, -include-rr             include request/response pairs in the JSONL output (for findings only)
   -nm, -no-meta                 don't display match metadata in CLI output
   -nts, -no-timestamp           don't display timestamp metadata in CLI output
   -rdb, -report-db string       local nuclei reporting database (always use this to persist report data)
   -me, -markdown-export string  directory to export results in markdown format
   -se, -sarif-export string     file to export results in SARIF format

CONFIGURATIONS:
   -config string              path to the nuclei configuration file
   -rc, -report-config string  nuclei reporting module configuration file
   -H, -header string[]        custom headers in header:value format
   -V, -var value              custom vars in var=value format
   -r, -resolvers string       file containing resolver list for nuclei
   -system-resolvers           use system DNS resolving as error fallback
   -passive                    enable passive HTTP response processing mode
   -env-vars                   enable environment variables support

INTERACTSH:
   -no-interactsh                     disable interactsh server for OOB testing
   -interactsh-url string             interactsh server url for self-hosted instance (default "https://interact.sh")
   -interactsh-token string           authentication token for self-hosted interactsh server
   -interactions-cache-size int       number of requests to keep in the interactions cache (default 5000)
   -interactions-eviction int         number of seconds to wait before evicting requests from cache (default 60)
   -interactions-poll-duration int    number of seconds to wait before each interaction poll request (default 5)
   -interactions-cooldown-period int  extra time for interaction polling before exiting (default 5)

RATE-LIMIT:
   -rl, -rate-limit int          maximum number of requests to send per second (default 150)
   -rlm, -rate-limit-minute int  maximum number of requests to send per minute
   -bs, -bulk-size int           maximum number of hosts to be analyzed in parallel per template (default 25)
   -c, -concurrency int          maximum number of templates to be executed in parallel (default 10)

OPTIMIZATIONS:
   -timeout int               time to wait in seconds before timeout (default 5)
   -retries int               number of times to retry a failed request (default 1)
   -max-host-error int        max errors for a host before skipping from scan (default 30)
   -project                   use a project folder to avoid sending same request multiple times
   -project-path string       set a specific project path (default "$TMPDIR/")
   -spm, -stop-at-first-path  stop processing HTTP requests after the first match (may break template/workflow logic)

HEADLESS:
   -headless          enable templates that require headless browser support
   -page-timeout int  seconds to wait for each page in headless mode (default 20)
   -show-browser      show the browser on the screen when running templates with headless mode

DEBUG:
   -debug                     show all requests and responses
   -debug-req                 show all sent requests
   -debug-resp                show all received responses
   -proxy, -proxy-url string  URL of the HTTP proxy server
   -proxy-socks-url string    URL of the SOCKS proxy server
   -trace-log string          file to write sent requests trace log
   -version                   show nuclei version
   -tv, -templates-version    shows the version of the installed nuclei-templates

UPDATE:
   -update                        update nuclei to the latest released version
   -ut, -update-templates         update the community templates to latest released version
   -nut, -no-update-templates     do not check for nuclei-templates updates
   -ud, -update-directory string  overwrite the default nuclei-templates directory (default "$HOME/nuclei-templates")

STATISTICS:
   -stats                    display statistics about the running scan
   -stats-json               write statistics data to an output file in JSONL(ines) format
   -si, -stats-interval int  number of seconds to wait between showing a statistics update (default 5)
   -metrics                  expose nuclei metrics on a port
   -metrics-port int         port to expose nuclei metrics on (default 9092)

http://example.com
http://app.example.com
http://test.example.com
http://uat.example.com