Community curated list of templates for the nuclei engine to find security vulnerabilities.
We're excited to share about Nuclei-Templates v9.8.5! This new version includes newly added AWS cloud config review templates. These templates can be used by companies or pentesters for identifying misconfigurations in the AWS cloud environment.
Similarly by leveraging aws code templates, security teams will be able to write their own checks for identifying misconfigurations that are specific to their particular workflows. This will enable them to effectively identify and remediate potential security issues within AWS environments.
To use cloud configuration review templates, first we need set up the environment. This setup is similar to using the aws-cli, where you either add aws_access_key_id and aws_secret_access_key to the ~/.aws/credentials file or export them as environment variables.
nuclei -id aws-code-env -code
We've also introduced the concept of profiles, which allow users to run a specific set of templates tailored for a particular use case. For running AWS templates, we have a profile named aws-cloud-config.
Now you're all set to run the templates!
nuclei -config ~/nuclei-templates/profiles/aws-cloud-config.yml -cloud-upload
142 | CVEs Added: 10 | First-time contributions: 6Full Changelog: https://github.com/projectdiscovery/nuclei-templates/compare/v9.8.1...v9.8.5
77 | CVEs Added: 29 | First-time contributions: 6Full Changelog: https://github.com/projectdiscovery/nuclei-templates/compare/v9.8.0...v9.8.1
We're thrilled to share that with the launch of Nuclei Templates version 9.8.0, we've broadened our scope in network security checks. Our template library now boasts over 8,000 entries, encompassing more than 7,202 templates for web applications. This collection includes 2,200 web-related CVEs and features more than 850 templates aimed at identifying web vulnerabilities.
With the help of active community contributions, we have been adding all the latest web CVEs and vulnerabilities in the wild. While we continue to do so, we are focused on expanding our template offerings to include network vulnerabilities, providing the most comprehensive scanning.
With this release, we're inviting contributors to aid us in enriching our network vulnerability detection, facilitated by the new JS protocol. This makes it simpler to incorporate network checks through the newly introduced JS modules. For guidance on crafting JS templates, check out our documentation here.
Next, we are aiming to expand coverage of LDAP and Kerberos related checks. We are looking forward to getting more contributions from the community
85 | CVEs Added: 8 | First-time contributions: 5B636160776167737022757F6025667965636562702C6C6967702275667275637024627F636379644022757F602E6F602C656E6E61686360237564716C607D65647D29656C63657E60256864702E6960222C6C61402D654720286364716342202567616373756D602F64702E6F63727560702473727966602568645 🐛
Full Changelog: https://github.com/projectdiscovery/nuclei-templates/compare/v9.7.8...v9.8.0
In our latest release, we are thrilled to announce new addition of 120+ OSINT - Phishing Detection templates, thanks to the contributions of our community member @rxerium. These templates are accessible at Phishing Detection templates.
These templates are specifically added to help OSINT analysts, threat researchers, and security professionals in discovering and studying phishing campaigns therefore, we have added them to the OSINT scan profile here. Users can execute the OSINT scan configuration profile with nuclei -u <host> -config ~/nuclei-templates/config/osint.yml
Please note that these templates are not included in the default run. To use them, users can simply include them in the scan using nuclei -u <host> -tags phishing -itags phishing.
By identifying and analyzing phishing sites, OSINT analysts can discover patterns, monitor the activities of threat actors, and collect data essential for broader security research or investigative journalism. This makes it a valuable addition to the OSINT toolkit.
126Full Changelog: https://github.com/projectdiscovery/nuclei-templates/compare/v9.7.7...v9.7.8
82 | CVEs Added: 21 | First-time contributions: 8Full Changelog: https://github.com/projectdiscovery/nuclei-templates/compare/v9.7.6...v9.7.7
49 | CVEs Added: 22 | First-time contributions: 12Full Changelog: https://github.com/projectdiscovery/nuclei-templates/compare/v9.7.5...v9.7.6
In our latest release, we have added a significant number of trending CVEs and are excited to announce the addition of new local privilege escalation templates. These valuable contributions come from our community, with a notable contribution from @daffainfo, and are available at Local Privilege Escalation Templates. These templates utilize the newly introduced code protocol, enhancing their capability to detect vulnerabilities more effectively.
It's important to note that these templates are specifically designed for local execution to identify privilege escalation vulnerabilities. For security reasons, they are not executed as part of the default Nuclei scan. We ensure the security and authenticity of these templates by signing them officially. To run these templates, users need to provide the -code flag along with -itags local. These additions are particularly useful for penetration testing and red-teaming focusing on privilege escalation, and we plan to further expand their coverage in future updates. Following are the other highlights of this release:
106 | CVEs Added: 14 | First-time contributions: 14Full Changelog: https://github.com/projectdiscovery/nuclei-templates/compare/v9.7.4...v9.7.5
Full Changelog: https://github.com/projectdiscovery/nuclei-templates/compare/v9.7.3...v9.7.4
45 | CVEs Added: 16 | First-time contributions: 6Full Changelog: https://github.com/projectdiscovery/nuclei-templates/compare/v9.7.2...v9.7.3
61 | CVEs Added: 25 | First-time contributions: 8Full Changelog: https://github.com/projectdiscovery/nuclei-templates/compare/v9.7.1...v9.7.2