Nuclei

Nuclei 把「怎麼判斷一個服務有沒有某個漏洞」寫成 YAML 樣板：送什麼請求、比對回應中的哪些特徵、符合幾項才算命中。掃描器本身只負責高速併發地跑這些樣板，偵測邏輯完全來自樣板庫。

這個設計的好處是更新偵測能力不需要更新工具。重大漏洞公開後，社群樣板庫通常在數小時到一兩天內就會出現對應樣板，執行 nuclei -update-templates 就能立刻用上。也因為判斷條件是明寫的，誤報比起純版本比對式的掃描器低得多。

Nuclei encodes "how do I tell whether this service is vulnerable" as a YAML template: what request to send, which response signatures to match, and how many must match to count as a hit. The scanner itself only runs those templates concurrently — all detection logic lives in the template library.

The payoff is that updating detection does not mean updating the tool. After a major disclosure, community templates usually land within hours to a couple of days, and nuclei -update-templates picks them up immediately. Because match conditions are explicit, false positives are far lower than with version-banner scanners.

- 通報後的曝險確認：週報提到某個邊界設備漏洞時，用對應樣板掃一遍自家資產，比人工盤點快得多。
- CI／上線前檢查：對 staging 環境跑一組固定樣板，擋掉暴露的管理介面、預設憑證、外洩的 .git 目錄這類低級但致命的問題。
- 定期資產健檢：搭配 subfinder、httpx 之類的工具做完資產盤點後接著掃。

先用 -severity critical,high 縮小範圍，全樣板掃描的雜訊量對第一次使用的人不太友善。

- Exposure checks after an advisory: when this weekly flags an edge-device vulnerability, scan your own assets with the matching template instead of inventorying by hand.
- CI / pre-release gates: run a fixed template set against staging to catch exposed admin panels, default credentials, and leaked .git directories.
- Recurring asset hygiene: chain it after discovery tooling like subfinder and httpx.

Start with -severity critical,high; a full-library scan is noisy for first-time users.

只掃你有權限測試的目標。部分樣板會送出具攻擊性的請求，對脆弱的正式環境設備可能造成服務中斷，建議先在測試環境驗證，並用 -rate-limit 控制速率。

Only scan targets you are authorised to test. Some templates send intrusive requests that can destabilise fragile production appliances — validate in a test environment first and throttle with -rate-limit.