Skip to content
HackIndex.io

Web Misconfiguration Scan

3 min read Created Jan 23, 2026 Last updated Mar 28, 2026

Nuclei is the fastest way to confirm known misconfigurations, exposed interfaces, and weak configuration before you go manual. Template-based scanning gives you consistent, reproducible results across all targets. Run this early in vulnerability discovery: results tell you which manual paths are worth pursuing and which checks you can skip.

  • Baseline scan runs a full severity sweep with nuclei to surface credentials, debug consoles, and known CVEs.
  • Tag-based targeting narrows scans to misconfig, exposure, or tech-stack-specific templates.
  • Bulk host scanning feeds httpx or subdomain output into nuclei for wide-scope coverage.
  • Security header check confirms missing CSP, X-Frame-Options, and HSTS with a manual curl.
  • nikto fallback covers server-specific checks when nuclei templates do not have full coverage.

Cross-reference nuclei findings with HTTP tech fingerprinting headers and HTTP header analysis. Missing security headers flagged by nuclei map directly to XSS and clickjacking attack surface. Pair these scans with information disclosure checks for exposed debug endpoints and leaked credentials.

Nuclei Baseline Scan

Run a full severity sweep first. Treat every finding as a lead until you reproduce it with a direct request:

┌──(kali㉿kali)-[~]
└─$ nuclei -u http://$TARGET_IP:$PORT/ -severity low,medium,high,critical
Explain command
-u http://$TARGET_IP:$PORT/ Target URL to scan for misconfigurations and vulnerabilities.
-severity low,medium,high,critical Include findings at all severity levels.
┌──(kali㉿kali)-[~]
└─$ nuclei -u https://$DOMAIN/ -severity low,medium,high,critical

Prioritize findings that expose credentials, debug consoles, directory listings, authentication bypasses, or known CVEs. Anything that returns 200 with sensitive content warrants an immediate manual follow-up request.

Narrow to Relevant Template Tags

Targeting specific tags reduces noise and speeds up the scan when you already know the tech stack:

┌──(kali㉿kali)-[~]
└─$ nuclei -u https://$DOMAIN/ -tags misconfig,exposure,tech -severity low,medium,high,critical
┌──(kali㉿kali)-[~]
└─$ nuclei -u https://$DOMAIN/ -tags php,apache,nginx,iis -severity medium,high,critical

Scan Multiple Hosts

Feed a host list from subdomain bruteforce or httpx output into nuclei for bulk scanning:

┌──(kali㉿kali)-[~]
└─$ nuclei -l live_hosts.txt -severity low,medium,high,critical -o nuclei_results.txt
┌──(kali㉿kali)-[~]
└─$ nuclei -l live_hosts.txt -tags misconfig,exposure -jsonl -o nuclei.jsonl

JSONL output is easier to parse and filter when dealing with many findings across multiple hosts.

Update Templates Before Scanning

Template updates happen frequently. Run an update before any engagement to catch recent CVE templates:

┌──(kali㉿kali)-[~]
└─$ nuclei -update-templates

Manual Security Header Check

Nuclei catches missing headers but a quick manual curl confirms and documents them for reporting:

┌──(kali㉿kali)-[~]
└─$ curl -skI https://$DOMAIN/ | grep -iE 'content-security-policy|x-frame-options|strict-transport-security|x-content-type-options|permissions-policy|referrer-policy' 
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
Explain command
-skI Silent mode, skip TLS verification, fetch response headers only.
grep -iE Case-insensitive extended regex match for security headers.

Missing Content-Security-Policy enables XSS exploitation without needing a CSP bypass. Missing X-Frame-Options enables clickjacking. Both are findings in their own right and lower the bar for XSS exploitation.

nikto as Fallback

┌──(kali㉿kali)-[~]
└─$ nikto -ask=no -h http://$TARGET_IP:$PORT 2>&1 | tee nikto.txt
Explain command
-ask=no Non-interactive mode, skip all confirmation prompts.
-h http://$TARGET_IP:$PORT Target host and port to scan.

References