nuclei -u https://target-staging.com -tags wordpress,wp-plugin,wp-theme -severity critical,high
The Paradigm Shift: Why Nuclei Dominates Modern Auditing
Developed by ProjectDiscovery, Nuclei is a fast, template-based vulnerability scanner. Instead of hardcoding checks into a compiled application, Nuclei relies on simple YAML templates.
When a security researcher discovers a new arbitrary file upload vulnerability in a popular WordPress plugin, they don't wait for a CVE assignment. They write a 15-line YAML script detailing the exact HTTP request needed to trigger the flaw and push it to the public `nuclei-templates` repository.
Within hours of a zero-day disclosure, you can pull that template and launch it against your entire target infrastructure.
The Tactical Advantages of YAML
- Speed to Execution: Go from reading a security advisory on Twitter to actively scanning your target lists in under an hour.
- Customization: If you discover a proprietary logic flaw in a custom WordPress setup (which we will cover in our Core Auditing Guide), you can write your own private Nuclei template to hunt for it across other clients.
- Massive Concurrency: WPScan is generally designed to scan one WordPress URL at a time. Nuclei is engineered to take a list of 10,000 subdomains and blast them simultaneously using highly optimized Go routines.
Deploying the Arsenal: Setting the Stage
Before launching a campaign, you must ensure your Nuclei environment is synced with the latest threat intelligence. Nuclei's power is entirely dependent on its template library.
After installing the binary, your first operational command should always be an update:
```bash nuclei -update-templates ```
This command pulls the latest YAML definitions from the community repository. Because the WordPress plugin ecosystem is vast and highly volatile, running this update daily is mandatory for maintaining a high-growth, high-accuracy auditing pipeline.
Tactical Execution: The Targeted WordPress Scan
If you run Nuclei blindly against a target, it will throw every template it has, from Cisco router exploits to Jenkins server misconfigurations. This is incredibly loud, wildly inefficient, and guaranteed to alert the target's Security Operations Center (SOC).
We must be surgical. We are targeting WordPress, so we will instruct Nuclei to only load templates tagged specifically for this CMS ecosystem.
The Surgical Strike Command
```bash nuclei -u https://target-staging.com -tags wordpress,wp-plugin,wp-theme -severity critical,high -o tactical_results.txt ```
Deconstructing the Payload
- `-tags wordpress,wp-plugin,wp-theme`: This is the filtering mechanism. Nuclei will ignore all generic web exploits and only load templates designed to interact with WordPress core, its plugins, and its themes.
- `-severity critical,high`: In a large-scale audit, you do not have time to manually verify hundreds of "Low" severity information disclosures (like an exposed readme.txt). We are hunting for shells. This flag restricts the scan to Remote Code Executions (RCE), SQL Injections, and authentication bypasses.
- `-o tactical_results.txt`: Outputs the findings for direct integration into your reporting framework or exploitation pipeline.
Scaling Up: Mass Scanning Subdomain Architectures
The true power of Nuclei is unlocked when we connect it to the intelligence gathered during Phase 01: Reconnaissance.
In our Domain Cartography Playbook, we used OWASP Amass to generate a massive list of hidden staging servers, forgotten development environments, and secondary blog installations.
Instead of passing a single URL to Nuclei, we pass the entire infrastructure map.
```bash nuclei -l amass_discovered_subdomains.txt -tags wordpress -severity critical,high -json-export nuclei_critical_hits.json ```
By exporting the results as a JSON file (`-json-export`), we create a structured dataset. This dataset can be programmatically parsed by custom Python scripts to automatically generate target lists for Metasploit in Phase 3.
You are no longer hacking a single website; you are systematically dismantling an organization's entire digital perimeter.
The Ghost Protocol: WAF Evasion and Infrastructure Shielding
There is a glaring issue with mass concurrency: it generates a massive amount of network traffic.
If you point Nuclei at a list of 5,000 subdomains protected by Cloudflare or Wordfence, your IP address will be blacklisted within seconds. You will be locked out of the target network before Nuclei even finishes parsing its templates.
To sustain this level of aggressive, automated vulnerability analysis, your technical toolkit must evolve to include Dedicated ISP Proxies.
Integrating ISP Proxies for Uninterrupted Scanning
Standard datacenter proxies are easily identified and blocked by modern Web Application Firewalls (WAFs). Dedicated ISP proxies, however, provide IP addresses associated with legitimate residential internet service providers. To a WAF, your aggressive Nuclei scan looks like a distributed network of standard home users browsing the site.
You can route Nuclei through your proxy infrastructure using proxy chains or the built-in HTTP proxy flags:
```bash nuclei -l targets.txt -tags wordpress -proxy http://your_dedicated_isp_proxy:port -rl 50 -c 15 ```
Tuning the Engine for Stealth
Even with ISP proxies, behavioral analysis engines will flag impossible traffic spikes. You must tune Nuclei's engine to mimic aggressive, yet humanly plausible, interaction.
- `-rl 50`: (Rate Limit) Restricts the scanner to 50 HTTP requests per second.
- `-c 15`: (Concurrency) Limits the engine to 15 concurrent workers.
By combining dedicated ISP proxies with strict rate limiting, you achieve the "Ghost Protocol." You are scanning thousands of endpoints for critical zero-days, but your traffic is slow, distributed, and completely undetectable by automated behavioral defenses.
The Handoff: From Detection to Weaponization
Nuclei will not hand you a reverse shell. It is a detection engine, not an exploitation framework.
When Nuclei flags a positive hit for a WordPress zero-day, it provides the template name, the exact URL that is vulnerable, and the extracted data that proves the vulnerability exists.
Your workflow must now pivot. You take the highly targeted, mathematically proven JSON output from Nuclei and move immediately into the manual verification and exploitation phase.
We have bypassed the WAF, we have scanned the entire infrastructure, and we have our list of critical vulnerabilities. It is time to break the doors down.
Ready for the next step? Proceed to our advanced tutorial on Tactical Brute Forcing, where we explore how to bypass rate limits on `wp-login.php` using advanced XML-RPC manipulation.