automation-nuclei-templateslisted

# Custom nuclei templates ## When it applies You confirmed a bug (or a CVE pattern) and want to (a) find every other affected host and (b) keep a regression check. A nuclei template turns "one request + one match condition" into a scalable, shareable detector. ## Why it works nuclei runs declarative YAML: send request(s), assert matchers on the response. If your finding is expressible as request→observable signal, it's a template — and then it scans thousands of hosts consistently, no manual repetition. ## Method 1. **Capture the minimal repro**: the exact request and the unambiguous signal that proves the bug (status, a body string, a header, a reflected marker, response time). 2. **Write the template**: `id`, `info` (name/severity/tags), then `http:` with `method`, `path` (use `{{BaseURL}}`), any `payloads`, and `matchers` (`word`/`status`/`regex`/`dsl`). Use `matchers-condition: and` to avoid false positives; add an `extractor` to pull the proof. 3. **Reduce false positives**: match a signal unique to the vuln (a computed reflection, a specific error), not a generic 200; test against a known-good and known-bad host. 4. **Validate**: `nuclei -t mytemplate.yaml -u https://known-vuln` (should hit) and against a safe host (should not). Lint with `-validate`. 5. **Scale/share**: run across your live-hosts list; contribute non-sensitive templates upstream. ## Gotchas - Overbroad matchers = noisy, untrusted results; require a signal that only the vuln produces.