pt-nuclei-template-creation

Nuclei Template Creation

Authorized Use Only

Run generated templates only against targets explicitly in scope. Templates that send payloads (SSRF callbacks, command injection probes, authentication attempts) must respect the same rules of engagement as manual testing. Validate on an approved test host before scanning production.

Objectives

1. Convert a confirmed finding into a YAML template with low-to-zero false positives.
2. Produce a template that validates against the official JSON schema and passes nuclei -validate.
3. Document severity, remediation, and references so the template is report-ready.
4. Minimize request count and avoid destructive payloads.

Workflow

1. Gather inputs:
   • Exact request that triggers the condition (method, path, headers, body)
   • Exact response signal that confirms it (status, body string, header, timing)
   • CVE/CWE IDs, vendor, product, affected versions, references
   • Severity justification (CVSS or business-impact rationale)
2. Choose protocol and request style:
   • http: with method + path for simple GET/POST checks
   • http: with raw: for precise control (custom headers, malformed requests, multi-step auth)
   • dns:, ssl:, tcp:, javascript: for non-HTTP targets
   • Never use the deprecated requests: key — always http:
3. Build matchers for the narrowest reliable signal:
   • Prefer matchers-condition: and combining status + body/header evidence
   • Use type: word for literal strings, type: regex only when patterns vary
   • Use type: dsl for cross-field logic (e.g. status_code == 200 && contains(body, "x"))
   • Set part: explicitly (body, header, all) — do not rely on defaults when precision matters
   • Add negative: true matchers to exclude known false-positive pages
4. Add extractors only if output is needed:
   • regex with group: for version numbers or tokens
   • kval for response headers
   • Mark internal: true if the value feeds a later request rather than report output
5. Self-review against the quality checks below, then validate.