nuclei vulnerability scanning

When it applies

Recon has produced live in-scope hosts (automation-recon-pipeline) and you want fast coverage of known issues — CVEs, exposed panels, misconfigurations — before spending manual time. Also the right tool for re-checking a fixed finding across all hosts. For writing a template that codifies your own finding, load automation-nuclei-templates (that skill is the deep guide; the essentials are below).

Why it works

nuclei runs declarative YAML templates (9000+ community templates, HTTP/DNS/TCP/SSL/file protocols) against many targets in parallel with matchers on the response. You trade stealth for breadth: it's fast and consistent, and loud.