Skip to content
HackIndex logo

HackIndex

Web Misconfiguration Scan

3 min read Mar 28, 2026

Nuclei is the fastest way to confirm known misconfigurations, exposed interfaces, and weak configuration before you go manual. Template-based scanning gives you consistent, reproducible results across all targets. Run this early in vulnerability discovery — results tell you which manual paths are worth pursuing and which checks you can skip.

Cross-reference nuclei findings with HTTP tech fingerprinting headers. Missing security headers flagged by nuclei map directly to XSS and clickjacking attack surface.

Nuclei Baseline Scan

Run a full severity sweep first. Treat every finding as a lead until you reproduce it with a direct request:

┌──(kali㉿kali)-[~]
└─$ nuclei -u http://$TARGET_IP:$PORT/ -severity low,medium,high,critical
┌──(kali㉿kali)-[~]
└─$ nuclei -u https://$DOMAIN/ -severity low,medium,high,critical

Prioritize findings that expose credentials, debug consoles, directory listings, authentication bypasses, or known CVEs. Anything that returns 200 with sensitive content warrants an immediate manual follow-up request.

Narrow to Relevant Template Tags

Targeting specific tags reduces noise and speeds up the scan when you already know the tech stack:

┌──(kali㉿kali)-[~]
└─$ nuclei -u https://$DOMAIN/ -tags misconfig,exposure,tech -severity low,medium,high,critical
┌──(kali㉿kali)-[~]
└─$ nuclei -u https://$DOMAIN/ -tags php,apache,nginx,iis -severity medium,high,critical

Scan Multiple Hosts

Feed a host list from subdomain bruteforce or httpx output into nuclei for bulk scanning:

┌──(kali㉿kali)-[~]
└─$ nuclei -l live_hosts.txt -severity low,medium,high,critical -o nuclei_results.txt
┌──(kali㉿kali)-[~]
└─$ nuclei -l live_hosts.txt -tags misconfig,exposure -jsonl -o nuclei.jsonl

JSONL output is easier to parse and filter when dealing with many findings across multiple hosts.

Update Templates Before Scanning

Template updates happen frequently. Run an update before any engagement to catch recent CVE templates:

┌──(kali㉿kali)-[~]
└─$ nuclei -update-templates

Manual Security Header Check

Nuclei catches missing headers but a quick manual curl confirms and documents them for reporting:

┌──(kali㉿kali)-[~]
└─$ curl -skI https://$DOMAIN/ | grep -iE 'content-security-policy|x-frame-options|strict-transport-security|x-content-type-options|permissions-policy|referrer-policy' 
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff

Missing Content-Security-Policy enables XSS exploitation without needing a CSP bypass. Missing X-Frame-Options enables clickjacking. Both are findings in their own right and lower the bar for XSS exploitation.

nikto as Fallback

┌──(kali㉿kali)-[~]
└─$ nikto -ask=no -h http://$TARGET_IP:$PORT 2>&1 | tee nikto.txt

References