Standard profile
Curated Nuclei vulnerability checks
Nuclei, by ProjectDiscovery, is an open-source scanner driven by YAML templates. Each template describes one check: a request to send and the response pattern that indicates a specific vulnerability, misconfiguration or exposure. The community maintains thousands of templates. ScanBastion runs a curated subset, in the Standard profile only.
Why curated
The full template library includes checks that are not appropriate to run against a production website you do not operate yourself: templates that attempt denial of service, brute-force credentials, fuzz parameters at volume, or confirm a vulnerability by exploiting it. ScanBastion maintains an allow-list of templates chosen for three properties:
- Non-destructive. The template reads; it does not write, delete, authenticate or exploit. Templates tagged
intrusive,dos,fuzzorbruteforceare excluded outright. - Relevant to websites. Checks for network services, cloud control planes and internal infrastructure are left out. This is a website scanner.
- Low noise. Templates with a history of false positives on ordinary sites are reviewed before being enabled and may be run with reduced severity or marked as always needing review.
The allow-list is versioned, so a report states which template set was in force when the scan ran. Templates are updated on a schedule after review, not pulled live from the community repository.
Template categories in the first release
| Category | Examples | Typical confidence |
|---|---|---|
| Exposed files and directories | Readable .git metadata, .env files, backup archives, database dumps, editor swap files, exposed phpinfo() | High: the content is in the response |
| Exposed panels | Admin consoles, database managers, CI dashboards and debug endpoints reachable from the internet | High for reachability; whether it is intended needs review |
| Misconfigurations | Directory listing, permissive CORS, default pages, verbose error pages, open redirects detectable without payloads | High to medium |
| Technology and version detection | CMS, plugins, frameworks and JavaScript libraries with known published advisories for the detected version | Medium: a version string is not proof of exploitability |
| Known CVEs, safe checks only | Web application CVEs where the template confirms the vulnerable condition without exploiting it | Medium to high, template-dependent |
Traffic and limits
Each template sends one or a few specific HTTP requests. For the Standard profile the total request budget, the requests per second and the per-template timeout are fixed per target. A template that times out is recorded as not completed, and the report says so on its first page, so a clean result is never mistaken for a complete one. You can stop the stage at any point; stopped templates are listed as not run.
An example finding
/assets/js/vendor.min.js · Confidence: Medium · Needs reviewThe page loads a jQuery version with published cross-site scripting advisories. Whether the site is exploitable depends on how it uses the affected functions, so review usage before treating this as a confirmed vulnerability. Remediation: upgrade to a supported jQuery 3.x release, test dependent plugins, then rescan to verify.
This example shows why the three fields exist. The severity is High because the advisories are real. The confidence is Medium because version detection cannot see whether the vulnerable code path is reachable. The verification is Needs review because no one has confirmed it yet. Presenting it as "1 High vulnerability" without the other two fields would mislead the client.
What this check cannot tell you
- Whether a detected version is exploitable in this particular site. Backported patches, unused code paths and web application firewalls all change the answer.
- Anything a template does not exist for. Nuclei finds known patterns. A novel flaw in custom code is not a pattern.
- Anything behind authentication. Templates run unauthenticated in the first release.
- Results for templates that were excluded. If a check would require an intrusive request, ScanBastion does not run it, and the report lists the category as out of scope rather than silently clean.
References
- Nuclei documentation, including how templates and rate limiting work.
- nuclei-templates, the community template repository that the curated set is drawn from.